Experts debate security through diversity

The sheer number of worms and viruses directed at Microsoft's Windows operating system and internet Explorer browser have many in...

The sheer number of worms and viruses directed at Microsoft's Windows operating system and internet Explorer browser have many in the computer industry wondering whether we would all be more secure if more users relied on alternatives to Microsoft's products.

That description appeared to fit about two-thirds of the few hundred system administrators and engineers attending a debate between two prominent security experts at the Usenix 2004 conference. A show of hands before and after the debate confirmed that most users in attendance would prefer a more diverse group of operating system and web browser software.

A monoculture, whether it be in biological terms or in computing terms, has been shown to be inherently dangerous to members of that group, said Dan Geer, chief scientist at Verdasys. Geer was formerly chief technical officer at security company @stake until he was fired last year for authoring a report critical of Microsoft's dominance of the computing industry and the insecurity of its products that stems from that position. Microsoft is an @stake client.

Operating system diversity can be a relevant part of a secure network, but forcing companies to diversify their operating systems is a tough proposition in a time of declining IT budgets and heavy emphasis on return on investment, said Scott Charney, chief trustworthy computing strategist at Microsoft.

Geer likened the evolution of the computing world to the evolution of life on earth, putting the computer industry at around "the blue-green algae" stage of development. Early organisms were forced to evolve and diversify to deal with threats, and the computer industry must also diversify if it is to confront the serious threat presented by professional hackers, he said.

"Nature has shown us that a monoculture is a primitive state, or a dying gasp," he said.

Enterprises that standardise on Microsoft products are taking a risk that if Microsoft's products are vulnerable to attacks they could lose important data, Charney said. However, if those enterprises use products from a single supplier it makes it easier for their IT staff to roll out patches and critical updates, and saves the training and education costs required to teach those employees how to run other operating systems, he said.

The problem with that argument is that there will always be a few companies or individuals that fail to patch their systems against new threats, and those infected systems can be used to create havoc across the entire internet, Geer said. If that is going to happen anyway, the companies that have chosen to rely on a different operating system or web browser will be protected against attacks launched at the vulnerable products, he said.

Ultimately, software suppliers must stand up and take accountability for their products, Charney said. In the past, customers have not been as concerned about security and did not demand that suppliers product secure products, but that has changed drastically over the past few years, he said.

Geer called the vulnerabilities in Microsoft's products "a national-security issue", claiming the issue is far too important to the health of the internet to leave up to the software suppliers themselves.

Tom Krazit writes for IDG News Service

Read more on IT architecture