Microsoft’s Folly
May 26, 2005 by PingAdam Shostack mentioned the previous post (Hi, Adam!) and noted that Microsoft is “aggressively promoting” the myth that software is unconstrainable. The first of their so-called Ten Immutable Laws of Security says
Law #1: If a bad guy can persuade you to run his program on your computer, it’s not your computer anymore.
Totally false.
The purpose of an operating system is to manage resources. That necessarily includes limiting access to resources. Enforcing the falsehood of Law #1 is a primary goal of operating systems and of computer security.
Coincidentally, the explanation of this “Law” abuses the type of real-world analogy I recently described.
There’s a nice analogy between running a program and eating a sandwich. If a stranger walked up to you and handed you a sandwich, would you eat it? Probably not. How about if your best friend gave you a sandwich? Maybe you would, maybe you wouldn’t—it depends on whether she made it or found it lying in the street.
A sandwich is not like a computer program at all. When you eat a sandwich, you are physically ingesting it and bringing its contents into your bloodstream. There’s no reason that programs should be given that kind of pervasive authority by default.
The “Laws” were written by Scott Culp, the program manager of Microsoft’s Security Response Center. They have been around for a while, and what a pompous title they have! “Laws,” eh? How magnanimous of Culp to decide that he should lay down the law. And if calling them “laws” isn’t enough, he labels them “immutable,” as if lies can be made true merely by forceful assertion. You could say that Windows is designed to make Law #1 true. Indeed, things would be pretty nice for Microsoft if Law #1 were true, since it would allow them to escape a great deal of responsibility.
It’s disappointing that a security manager at the world’s largest operating system company is so badly misinformed about both operating systems and security. Keep in mind, security is supposed to be Microsoft’s “highest priority”.
May 27th, 2005 at 05:30
To be fair, according to Writing Secure Code (ISBN: 0-7356-1588-8) those “laws” were written midway through 2000. At the time, most of the general public were running Win9x, and in Win9x that assertion IS basically true. Further, in practice, even though people are now running Win2k/XP, they tend to run with administrative privileges, so, the assertion tends to remain true.
Now, I do agree with the point you are making as well, that the assertion is hardly a “immutable law”. My point is merely that in practice the statement is entirely true for the vast majority of computer users, and that if people tended to abide by that “law” then the number of security incidences would be much lower than it is now. This isn’t the same as the computers really being more secure…and there is a fine line between getting people to adhere to a principle because it is currently necessary and having them believe that it is inherently necessary/unavoidable…but at the moment general computer users would be safer if they believed this fiction.