Supporting Security
Supporting Security
Inside fixing vulnerabilities at
Inside fixing vulnerabilities at
Microsoft
Microsoft
®®Simon Conant
Simon Conant
MCSE CISSPMCSE CISSPSecurity Program Manager
Security Program Manager
PSS Security
PSS Security
Microsoft Corporation
Microsoft Corporation
[email protected]
[email protected]
Who’s who?
Who’s who?
Product Groups
•
Program Managers
•
Developers
•
Test
Engineers
PSS Security
M
icrosoft
Security
Response
Center
Field testing Field testing Packaging Packaging Documentation Documentation Publishing Publishing
Release
Release
Fix is tested: Fix is tested:--Fixes all of problemFixes all of problem
--Doesn’t break anything elseDoesn’t break anything else
--All products, versions, platforms, languagesAll products, versions, platforms, languages
Broken? Back to step one…
Broken? Back to step one…
Test
Test
Fix architected from step 1
Fix architected from step 1
Fix built for all affected products, platforms, versions, langua
Fix built for all affected products, platforms, versions, languages.ges.
Fix
Fix
Issue first received.
Issue first received.
Evaluated & acknowledged to reporter (all reports acknowledged).
Evaluated & acknowledged to reporter (all reports acknowledged).
Sent to all possibly affected product group “SI” teams.
Sent to all possibly affected product group “SI” teams.
Confirmation of problem (or not). Warteams, discussions, all the
Confirmation of problem (or not). Warteams, discussions, all the
experts pulled in on it.
experts pulled in on it.
Full info on problem, associated issues, workarounds, solutions.
Full info on problem, associated issues, workarounds, solutions.
Evaluation
Evaluation
Process
Process
Why does it take so long?
Why does it take so long?
§
§
It’s all about COMPLEXITY
It’s all about
COMPLEXITY
§
§
The products all are very feature
The products all are very feature
-
-
packed, and are
packed, and are
therefore very complex
therefore very complex
§
§
We support multiple older versions of products
We support multiple older versions of products
§
§
On various platforms
On various platforms
§
§
And for many languages
And for many languages
§
§
It’s all about
It’s all about
QUALITY
QUALITY
§
§
If the fix doesn’t fix ALL of the problem, it’s no good
If the fix doesn’t fix ALL of the problem, it’s no good
§
§
If the fix breaks something else along the way, it’s not
If the fix breaks something else along the way, it’s not
helping our customers either
helping our customers either
§
§
We have to do our very best to get it
We have to do our very best to get it
right first time
right first time
§
Workarounds
Workarounds
No known / possible workaround
High impact or
partial workaround
Low-impact
Workaround
Improvements
Improvements
§
§
No more “
No more “
Under Investigation
Under Investigation
” black hole
” black hole
§
§
Milestones:
Milestones:
§
§
Confirmation of vulnerability, fix in progress
Confirmation of vulnerability, fix in progress
§
§
Know workarounds, mitigations, risk analysis
Know workarounds, mitigations, risk analysis
§
§
Fix completed
Fix completed
§
§
Fix in testing
Fix in testing
–
–
progress
progress
§
§
Fix in release
Fix in release
§
§
Proactive communications
Proactive communications
§
§
PSSSec will own the cases & customer care
PSSSec will own the cases & customer care
§
§
Patch beta testing
Patch beta testing
§
§
Local security support
Local security support
§
Improve the Patching Experience
Improve the Patching Experience
New Patch Policies
New Patch Policies
§
§
Extending support to June 2004
Extending support to June 2004
§
§
Windows 2000 SP2
Windows 2000 SP2
§
§
Windows NT SP6a
Windows NT SP6a
§
§
Non
Non
-
-
emergency security patches on a
emergency security patches on a
monthly release schedule
monthly release schedule
§
§
Allows for planning a
Allows for planning a
predictable monthly test and
predictable monthly test and
deployment cycle
deployment cycle
§
§
Packaged as individual
Packaged as individual
patches that can be deployed
patches that can be deployed
together
together
§
§
Achieves benefits of security
Achieves benefits of security
rollup with increased flexibility
rollup with increased flexibility
Patches for emergency issues will still release immediately
By 5/04: Consolidating to 2 patch installers
By 5/04: Consolidating to 2 patch installers
for W2K and higher, Office & Exchange. All
for W2K and higher, Office & Exchange. All
patches will behave the same way
patches will behave the same way (SUS 2.0, (SUS 2.0,
MSI 3.0) MSI 3.0)
Extend patch
Extend patch
automation to all
automation to all
products
products
11/03: SMS 2003 offers capability to patch all
11/03: SMS 2003 offers capability to patch all
supported Microsoft platforms and applications
supported Microsoft platforms and applications
By end of 2004, all MS patches behave the same
By end of 2004, all MS patches behave the same
at installation (MSI 3.0 + SUS 2.0) and
at installation (MSI 3.0 + SUS 2.0) and
available in one place: MS Update
available in one place: MS Update
Reduce patch size
Reduce patch size
Now: Reduced patch size by 35% or more.
Now: Reduced patch size by 35% or more.
Will have 80% reduction by 5/04.
Will have 80% reduction by 5/04. (Delta (Delta
patching technology and improved functionality
patching technology and improved functionality
with MSI 3.0) with MSI 3.0)
Reduce patch
Reduce patch
complexity
complexity
Reduce risk of
Reduce risk of
patch deployment
patch deployment
Now : Increased internal testing; customer
Now : Increased internal testing; customer
testing of patches pre
testing of patches pre-- release.release.
By 5/04: rollback capability for Windows,
By 5/04: rollback capability for Windows,
SQL, Exchange, Office
SQL, Exchange, Office
Reduce downtime
Reduce downtime
Now:
Now: 10% fewer10% fewer reboots on W2K and higher reboots on W2K and higher
By 5/04:
By 5/04: 30% fewer30% fewer reboots on Win 2003 reboots on Win 2003
(starting in SP1). Up to
(starting in SP1). Up to 70% 70% reduction for reduction for
next server
next server
Your Need
Your Need
Our Response
Our Response
Improve the Patching Experience
Improve the Patching Experience
Patch Enhancements
§
§
Available Now
Available Now
§
§
17
17
prescriptive books
prescriptive books
§
§
How Microsoft secures Microsoft
How Microsoft secures Microsoft
guidance & tools
guidance & tools
§
§
Later this year and throughout 2004
Later this year and throughout 2004
§
§
More prescriptive & how
More prescriptive & how
-
-
to guides
to guides
§
§
Tools & scripts to automate common
Tools & scripts to automate common
tasks
tasks
§
§
Focused on operating a secure environment
Focused on operating a secure environment
§
§
Patterns & practices for defense in depth
Patterns & practices for defense in depth
§
§
Enterprise security checklist
Enterprise security checklist
–
–
the single place
the single place
for authoritative security guidance
for authoritative security guidance
Security Guidance for IT Pros
Security Guidance for IT Pros
Security Guidance for IT Pros
Continue Improving Quality
Continue Improving Quality
Trustworthy Computing Release Process
Trustworthy Computing Release Process
M1 M2 Mn Beta Design Development Release Support Security Review Security Review §
§ Each component team develops Each component team develops
threat models, ensuring that
threat models, ensuring that
design blocks applicable threats
design blocks applicable threats Develop
& Test
Develop & Test
§
§ Apply security design & coding Apply security design & coding
standards
standards §
§ Tools to eliminate code flaws Tools to eliminate code flaws
(
(PREfixPREfix & & PREfastPREfast)) §
§ Monitor & block new attack Monitor & block new attack
techniques techniques Security Push Security Push §
§ TeamTeam--wide stand downwide stand down §
§ Threat model updates, code Threat model updates, code
review, test & documentation
review, test & documentation
scrub scrub Security Audit Security Audit §
§ Analysis against current threatsAnalysis against current threats §
§ Internal & 3Internal & 3rdrd party penetration party penetration testing testing Security Response Security Response §
§ Fix newly discovered issuesFix newly discovered issues §
§ Root cause analysis to Root cause analysis to
proactively find and fix related
proactively find and fix related
vulnerabilities
vulnerabilities
Design docs & specifications Development, testing & documentation Product Service Packs, QFEs
6
6
9
9
…
…
90 days
90 days
…
…
150 days
150 days
Critical or important vulnerabilities in the first…
Critical or important vulnerabilities in the first…
13
13
23
23
TwC
TwC
release?
release?
Yes
Yes
No
No
For some widely
For some widely
-
-
deployed, existing products:
deployed, existing products:
Mandatory for all new products:
Mandatory for all new products:
Bulletins since
Bulletins since
TwC release
TwC release
Shipped Jan. 2003, 8 months ago
Shipped Jan. 2003, 8 months ago
1
1
Service Pack 3 Service Pack 3 Bulletins in Bulletins in prior period prior period9
9
Bulletins since Bulletins since TwC release TwC releaseShipped July 2002, 14 months ago
Shipped July 2002, 14 months ago
