Microsoft's lessons from the desktop
Although it has become a popular biannual event, Blue Hat can still be an unnerving experience at times as guest hackers occasionally break Microsoft products in front of the people who built them. But studying such simulated attacks--a process known as "threat modeling"--provides invaluable lessons in teaching developers how an application can be attacked and what the security controls should be.
"Often times, we find that developers are thinking like a developer or like a user," said Boden, senior director for MSN and Windows Live security at Microsoft.
That's the challenge facing Microsoft. Many company developers and executives believe that securing Web applications is no different from protecting PC desktop software, something the company has learned over the course of three decades. At the same time, Microsoft must acknowledge the crucial differences in pace and scale that are presenting some of the most difficult security challenges ever encountered in digital technology.
For all its successes, Microsoft has in the past reacted slowly to industry change or has underestimated its impact. Case in point: back in the mid-1990s the company misjudged the significance of the Internet and Web-based computing. What followed has become equal parts lesson and legend, a call to arms from Bill Gates that ultimately sank arch rival Netscape Communications and set the course of Internet history. More recently, Gates and CEO Steve Ballmer have admitted to miscalculating the value of Web search and digital music, long after Google and Apple stole the show.
It is understandable, therefore, why Microsoft is determined not to fall behind in Web security. The key, according to many within the company and beyond, is not treating it like just another set of desktop bugs.
"The same rules apply. It is not a new science, it is a different environment to apply the same science," Boden said. However, he stresses, "We have to be very careful not to get complacent about saying we understand the problem, because it is going to change right in front of our eyes."
The 18-year company veteran understands why many at Microsoft cling to the notion that Web and desktop security are essentially the same. Although the types of threats change, Boden says desktop and server security lessons are equally valid when applied to online applications.
"There are pieces that are different," he said. "But the discipline of understanding what could break, how it could break, the impact of it breaking, how we protect it, how we respond to any event, those are fundamentally the same."
The main differences--and they are crucial--are speed and size. As Boden says, securing Web applications is all about scaling; if security doesn't scale, data could be at risk.
A year ago, Microsoft had about 30,000 servers in its data centers to support its online services. This year that's up to 80,000, and more growth is planned.
"The business stakes are enormous in this area," Boden said. "If we or anybody in this business violates the users' trust, then we're essentially out of the business."
Learning the hard way
If Microsoft veterans sometimes sound as if they've seen it all before, there's good reason: they've learned the hard way.
Five years ago, Microsoft's customers were getting hammered. That's when Gates launched his Trustworthy Computing initiative to make security a priority. Industry analysts have praised the effort, even though there are still plenty of vulnerabilities found in Microsoft software and attacks still occur.
Inside the MSN and Windows Live security offices, banners still work to remind employees of the importance of security, and a "Security Scorecard" keeps track of performance and ties into individual reviews.
The regimented approach hasn't always been welcomed by the rank and file. Like human resources and IT staffs, the security department of any company is sometimes viewed like the internal affairs division within the police force--they're paid to keep an eye on you. The 55 members of the MSN and Windows Live security team set policies, assess risks and respond to security incidents.
Not surprisingly, initial efforts to reach out to other departments and employees were met with trepidation.
"We had a robotic image on a lot of our awareness campaign materials last year, and it portrayed a very stern, standoffish approach to the team," Boden said. "We went away from that, specifically because we want to build better relationships with the development teams."
Things are better now. Boden's department is engaged in an ongoing marketing campaign within the company, which includes hosting regular happy hours with local brews and chips and salsa.
"Redhook, Mac and Jack's, we're not short on beer here in the Northwest," Boden said.