Security Watch

The World's Biggest Bullseye

A talk with the man responsible for securing Microsoft's internal network.

Imagine having the world's biggest bullseye on your back. That would fairly describe Pete Boden, director of information security for Microsoft's IT department. He's the guy responsible for making sure Microsoft's internal network is secure from the hackers and crackers for whom breaking into Microsoft is the ultimate status symbol. I wanted to find out from Boden what it was like to work in such an environment. His answers were revealing.

Q: What are the biggest security issues facing Microsoft IT?

A: The biggest challenges we have is keeping pace with the business. Our business is rapidly changing. Our business model has changed through globalization. A major stress on IT is to provide a level of service around the world, including connectivity issues.

Another area of concern is the distribution of intellectual property on our internal network. As we work with partners and vendors, our network expands and expands. It puts stress on the user base. And intellectual property moves around. For example, marketing product plans and other confidential data we're trying to protect.

We've also put a lot of resources focused on pushing our security boundary to hosts that sit on our network. We're very diligent on software updating, and patch quickly and thoroughly. We spend the majority of our effort maintaining the health of our network.

Q: What was the last major security crisis you faced?

A: We had a public network incident in October 2000, and that was the impetus of a lot of security work. It was a crisis at the time, and helped us crystallize the trustworthy computing initiative. It was a network intrusion that didn't involve any intellectual property, just access to the network environment by a single individual.

Q: How many infiltration attempts do you see in a typical day?

A: It's literally thousands. It's a massive number. A lot of it is traffic we block through firewall rules and intrusion detection. We do a lot of scanning and probing, a lot of analysis. About 5 percent of the total traffic is deliberate attempts to intrude on the network. A lot is automated traffic, script kiddie-type stuff.

Q: How sophisticated are most of the attacks?

A: I compare it to the millions of people playing basketball around the world, but only 300 play in the NBA. Very few [attackers] are creative and have malicious intent and are skilled at that level and can execute sophisticated attacks. We have an internal attack and penetration team, white-hat hackers whose full-time job is to try and hack into the network. We allow them a lot of latitude to be creative. There are five working today.

Q: What do you use for patch management?

A: We use WSUS [Windows Server Update Services] in some smaller environments, but predominantly we use SMS 2003. We push out all security updates, typically on two-week timeframe, but we can lower the timeframe to 48 hours and push out via SMS. Client machines have a deadline, and can be forced [to patch and update themselves].

Q: Do you use biometric authentication? If so, what kind?

A: We use smart cards for three purposes: Remote authentication through a VPN for vendors or other outsiders; anybody with elevated access, like domain administrators, have to authentication whether they're local or remote; and to get access to a high-security line of business applications, like those who have access to source code. We went with smart cards, and they have been deployed about two years now. We've looked at biometric authentication, but haven't gone with it.

About the Author

Keith Ward is the editor in chief of Virtualization & Cloud Review. Follow him on Twitter @VirtReviewKeith.

comments powered by Disqus
Most   Popular

Upcoming Training Events