Inundated with queries over leaked code and virus-related support calls, Microsoft SA gave journalists an ad hoc heads-up on its security efforts yesterday. The vendor admitted that patching alone did not solve security issues in a connected world approaching zero-day exploits.
Colin Erasmus, Microsoft SA lead for security, sought to answer ever more strident criticism from security firms, the media and customers with a candid look at the increasing threat of malware in all its forms.
"The US Federal Government has revealed that over $400 million was stolen in 'phishing attacks` last year." He said this category of "hackers" was the fastest growing virus writer category.
The day of zero-day exploits - no time between discovery of a vulnerability and its exploitation - is approaching, he admitted. "In Nimda`s case, it took 331 days. Welchia took 151 and Blaster only 25 days. Virus writers are now reverse-engineering our patches in a very short time, soon in as little as nine days. And to patch 30 to 50 PCs is quite a job; it takes a while."
Beyond patching
"This leads us to say patching is OK, but you have to go somewhere else too," he concluded. "That`s where Windows XP Service Pack 2 (SP2) comes in."
Offering the media a first South African look at SP2, Erasmus demonstrated features of this security-focused update.
Accessible via the Control Panel, a new icon (Security Options) beefs up security with such options as Internet Connection Firewall and blocking of pop-ups in Internet Explorer. The firewall can be switched on with exceptions, off, or on with no exceptions.
Users can log all attempts and connections. Firewall data, however, can run into huge amounts, and Erasmus recommends setting a space limit.
Microsoft`s chief software architect Bill Gates demonstrated SP2 on Tuesday at a security conference in San Francisco, showcasing more features.
The Windows Security Centre in SP2, he said, displays security status and recommends actions. All the features are managed through Active Directory group policy.
Microsoft is also working on an anti-spam initiative including safe lists and what it termed "Caller ID for e-mail" to authenticate e-mail. In addition, Microsoft is using Exchange to filter mail away from the Exchange server.
Share
