MS Chief Security Officer to work for White House 355
NerveGas writes "An Interesting People message reports that Howard Schmidt, Microsoft's Chief Security Advisor, will be leaving MS to work as a security adviser for the White House. With the track record that Microsoft has in the area of computer security, this strikes me as a very bad move." CD: you'd think people would examine the job someone did at thier previous job before offering them a new one. Isn't this is like putting Capt. Hazelwood in charge of an oil tanker?
Job qualifications (Score:5, Funny)
What you mean like the job GW did in Texas? This guy should fit right in.
It's all part of the same kind of thinking. (Score:5, Interesting)
"CD: You'd think people would examine what someone did at his previous job before offering him a new one." [Corrections to grammar and spelling added.]
It's all part of the same kind of thinking. Bomb Afghanistan to save it. (I'm talking about the first bombing by the U.S. government [1983], not the second and third.)
Hire someone from a company known for its inability to make secure software, and put him in charge of what his company always did poorly.
But, of course, maybe he is not really leaving Microsoft, but just working with a government that doesn't believe in privacy to assure that Microsoft software will always be compromised by the government.
Look on the bright side. With Microsoft in the White House, no one who truly wants software security will be running Microsoft products.
--
Links to respected news sources show how U.S. government policy contributed to terrorism: What should be the Response to Violence? [hevanet.com]
Re:It's all part of the same kind of thinking. (Score:5, Insightful)
Hire someone from a company known for its inability to make secure software, and put him in charge of what his company always did poorly.
Who would you prefer?
Getting the point yet? Everyone has holes. Everyone releases patches. It just happens that microsoft designs their code for ease of use, and because of that there happen to be a lot of unqualified microsoft admins. This isnt a MS problem. This is a side effect of their popularity.
You're missing the point, as well as OpenBSD (Score:5, Insightful)
Readers often don't have much experience with MS. (Score:5, Insightful)
1. unauthorized user can autheticate.
2. denial-of-service attack
3. unauthorized user can read files
4. Inject HTML tags into the generated reports.
5. gain root access.
6. denial-of-service attack
7. execute arbitrary code when accessing RPM from untrustworthy source.
8. denial-of-service attack
9. gain root access
Every one of 1 through 9 above are stories about people who made mistakes.
The security problems in Microsoft products, are, in my opinion, not mistakes. They are the result of policies: 1) Only money matters. If you can make more money by being sloppy, then do it. 2) Release software with lots of known shortcomings so that people will want to pay for upgrades later. 3) Relate to your employees by pushing them.
Items 2, 3, 4, 6, and 8, more than half of those you mentioned, do not allow destruction to the system itself. One or more Microsoft security bugs that allow destruction to the system are announced on the average of every month, if I recall correctly.
I am not anti-Microsoft. I am more pro-Microsoft than Bill Gates. Microsoft is a company that has $30,000,000,000 dollars in the bank, instead of being used to clear up the problems in their products.
Today I spent about an hour of my Sunday helping a woman in Brazil clear her computer of the Badtrans worm. Billions of dollars are being wasted by very serious Microsoft bugs. The company is not worrying enough about the quality of its products, in my opinion.
I installed a security bug fix supplied by Microsoft to Internet Explorer on someone's computer last week, and the security bug fix put all the network settings back to least security. This has been going on for years. Microsoft knows this happens. It is a result of policy, not mistake. Why they do that, I don't know. Maybe it has been dictated by the U.S. government that Microsoft will make their systems insecure.
We have a problem on Slashdot that many people who read Slashdot don't work with Microsoft products enough to know how bad things really are.
The Problem With Microsoft (Score:5, Interesting)
Microsoft's product line evolved from a single user application. Programmers on their product line are still in the mentality that if you're sitting at the console, their programs have sole access to the full resources of the computer. How many Windows application installs demand that you close down all other programs and reboot the system when you're done? How many of them actually need you to do that? How many times has some Windows program opened a modal dialog (Which in the historical past prevents the program from being minimized until you acknowledge the dialog) or worse, a system dialog? When was the last time you saw one on Linux? Completely different programmer mentality.
Sure Microsoft's been kludgeing user support into Windows for a while now, but they don't enforce its use. It'd take too long for them to explain to every user out there why they should have to log out and log in as the administrator in order to install that new game or those scanner drivers. Most Windows users are perpetually stuck in the running as root mode, despite years of sysadmin experience that dictates that you should never run as root. And Microsoft will never force them to create a user and use it because that would make them a little less user friendly and a little more like UNIX and that's not the direction they've taken.
BTW: Most Linux dists don't force you to create and use a user ID either, and it's a very common thing to see newbies running as root. They usually stop after the first or second time they manage to trash their entire damn filesystem. And you can never just tell them "Don't run as root -- 30 years of UNIX sysadmin experience can't be wrong!" They seem to have to learn by hard experience.
Re:The Problem With Microsoft (Score:2)
To my pleasant surprise, some applications will recognize that you need to be an Admin to install. They'll post a dialog box that essentially does a "su". Enter the admin password, install, and be done. Not bad.
To my disgust, most applications don't, and most applications (grumbleQUICKENgrrrRIOgrmblPALMgrrr) decide they need unfettered write access all over the place. It takes some hunting and pecking, granting write access to the four or five files (usually log files) that it wants to write to.
If MS would change their default setup such that users did not have "power" or "admin" privileges, watch how fast software would change to actually install correctly.
Re:The Problem With Microsoft (Score:2)
Is this "user friendlyness" or "end user administration". Plenty of the features of Windows are less than "friendly".
That's not very user friendly. It's my computer after all. Why shouldn't I be allowed to delete any file on the system?
Is it ment to be your "friend" or your "slave". (The latter of the if you tell it to jump off a cliff it'll go and find one variety.)
An example of how bad Microsoft can be: (Score:2)
In my post above, I was making the point that Microsoft is much worse than people realize. Here is a link to a Microsoft Knowledgebase article that eloquently makes that point: User Accounts That You Create During Setup Are Administrator Account Types (Q293834) [microsoft.com]
This is not Windows 95 the article is discussing. It is Windows XP. Here is a cut-and-paste quote from that article:
"After you install Windows XP, you have the option to create user accounts. If you create user accounts, by default, they will have an account type of Administrator with no password."
Even someone who knows how bad Microsoft can be would likely not guess that Windows XP would be designed to be completely and utterly not secure by default. So, we will see a lot of stories about compromised Windows XP systems like this: Some poor guy was testing XP and set up an account to begin using it, and was rooted while he was still looking around.
--
Links to respected news sources show how U.S. government policy contributed to terrorism: What should be the Response to Violence? [hevanet.com]
It would be sensible to explain the issues. (Score:2)
It is interesting what you said.
The presumption has been, however, that Unix/Linux would be used by very knowledgeable people. The presumption of Windows is that people with no experience with it will be using it.
Even if Microsoft doesn't change the way Windows XP operates, it would be sensible to explain the issues carefully on-screen. Recent versions of Mandrake and RedHat do this during install, if I recall correctly.
An attacker would have complete control... (Score:2)
"Windows XP will not authenticate network access attempts by accounts with blank passwords."
The issue is whether an attacker from outside, who gains access to a computer because of some security hole, would have control over that computer. My understanding is that an attacker would have complete control if there were no password.
I've told her to be more careful next time. (Score:2)
Her only fault was not to install one of the many security updates. I've told her to be more careful next time.
You seem to be confusing the two of us. She is an acquaintance who does not understand computers.
If Microsoft cared sufficiently, this would not be a tough problem to solve. Just don't give Outlook Express so much power in the default install.
Re:It's all part of the same kind of thinking. (Score:5, Insightful)
Nice argument, but let's not forget microsoft themselves have been compromised multiple times over the course of the last few months:
1) Remember that incident where someone inside microsoft got hit by a macro virus that allowed remote (apparently russian) script kiddies to access their internal network?
2) How code red hit www.microsoft.com and hotmail?
3) Same thing happened with nimda.
3) there were more but this was off the top of my head.
Of course, bad programming practices happen everywhere but this could be accounted to a) running unpatched boxes and b) microsoft employees opening infected attachments. Both of which were his direct responsibility to prevent.
A side effect of popularity? (Score:5, Insightful)
Second, MS's infmaous security record doesn't stem from "mishaps." It stems from their insistance on a very flawed set of models. "Drivers at Ring-0" and all that. Among the more popular flaws is in their VBA/VBS integration. Bad enough that These languages have access to the whole machine indescriminantly, but docments from untrusted sources now have access to your whole machine? How many times has this happened? It's not something that requires a patch, it requires a rewrite or complete removal as a feature.
Javascripting? Why are so many MSIE flaws handled best by disabling client-side scripting? Think about it -- same problem.
How about their insistance on installing "everything, even if you don't need it?" How many "Nimda" hosts are out there on machines where the owner didn't even know IIS was there? My brother said it best when he said that it was the equivalant of shipping a loaded pistol. It's not dangerous if you know how to use it and if you knew it was loaded, but then again anyone with a finger thinks they can handle a gun... ring true enough?
It's not that the company's popularity makes a common problem seem worse, it's the company's problem of prioritizing "cool stuff" over "secure stuff."
Re:It's all part of the same kind of thinking. (Score:2)
Are you insane, a troll, or do you simply know nothing about Unix? IRIX is by far the most insecure Unix out there (that's still being maintained, anyway, I guess 4.2 BSD might be less secure). It's not meant for network servers, it's meant for graphics workstations and rendering machines.
Re:It's all part of the same kind of thinking. (Score:5, Informative)
Or, even better, people could check what in the hell they are talking about! But then again, this is Slashdot, no fact checking [go2vanguard.com] required:
Mr. Schmidt currently is the Corporate Security Officer for Microsoft Corporation, Redmond, WA. In that capacity he directs the activity of those responsible for security of Microsoft?s Information, personnel and facilities Worldwide.
Prior to coming to Microsoft, he was a Supervisory Special Agent, Director of the Air Force Office of Special Investigations, Computer Forensic Lab and Computer Crime and Information Warfare. (HQ AFOSI/CCI). Under his direction he established the first dedicated computer forensic lab in the government. The AF specialized in conducting investigations into intrusions in government/military systems by unauthorized persons in counter intelligence and criminal investigations.
Before AFOSI he was with the FBI at the National Drug Intelligence Center (NDIC) where he headed the Computer Exploitation Team as a Computer Forensic Specialist. As one of the early pioneers in the field of computer forensics and computer evidence collection, he continues to provide training support to an international audience dealing with the new challenges around computer evidence collection and processing.
He was a City police officer from 1983-1994 with the city of Chandler Police Dept. Arizona. While there he was detailed to the FBI academy teaching classes in the use of computers in criminal investigations for approximately 2 years.
Mr. Schmidt served with the US Air Force in various roles from 1967-1983 both active duty and in the civil service. He has served in the military reserves since 1989 and currently serves as a Credentialed Special Agent, US Army Reserves, Criminal Investigation Division (CID). He has testified as an expert witness in federal and military courts in the areas of computer crime, computer forensics and Internet activity.
He holds a Bachelors Degree in Business Administration, (BSBA) and a Master of Arts in Organizational Management (MAOM). He also has a Technician class Ham Radio License, and a Single Engine Land pilots license.
Mr. Schmidt currently is the International president of the Information Systems Security Association (ISSA) and the recently formed IT-ISAC. He is a former executive board member of the International Organization of Computer Evidence (IOCE), served as the co-chairman of the Federal Computer Investigations Committee (FCIC). He is a member of the American Academy of Forensic Scientist (AAFS). He is an advisory board member for the Technical Research Institute of the National White Collar Crime Center. (NWCCC) and he is a distinguished special lecturer at the University of New Haven, CT teaching a graduate certificate course in Forensic Computing. He served as an augmented member to the President's Committee of Advisors on Science and Technology (PCAST) in the formation of an Institute for Information Infrastructure Protection (I3P) He is a regular international speaker in the fields of computer forensics and information assurance.
Mr. Schmidt was one of 29 industry leaders called to the White House to meet with President Clinton on cyber security and has testified before a joint committee on Computer Security and has been instrumental in the creation of public/private partnerships and information sharing iniatives.
Indelible Stain (Score:2)
>> always did poorly.
>
> Or, even better, people could check what in the hell they are talking about! But then again, this is Slashdot, no fact checking
> [go2vanguard.com] required:
[posts resume]
Yet for many seasoned sysadmins concerned for security, having Microsoft on your resume is what a character in ``Dilbert" once called an indelible stain on your resume: it is going to work against you, rather than for you. And you better be able to do some persuasive talking to explain why under your tenure MS failed implement its own software in a secure manner.
Geoff
Re:It's all part of the same kind of thinking. (Score:2)
My thoughts were:
A) poor bastard.
B) man, he must be GOOD. MS rarely gets hit as bad as the public, so he must be doing SOMETHING right....
:/
Re:It's all part of the same kind of thinking. (Score:2)
I think what you have pointed out about Mr. Schmidt should worry people more, not less, regarding his credentials to provide any expertise on the issue of "cyber" security. Reactionists, such as cops, feds and other "prosecute em!" types are of no use to the computer security discipline. And, until proven otherwise, I see no reason not to assume that Mr. Schmidt is one of those types. Afterall, his entire background is on the reactionary side of the model. He has done nothing to contribute to the discipline of information security and assuramce. In short, he is a cop, at best, not a computer security expert by any means.
Instead of working on solutions to prevent intrusions and to manage risk, the White House appears to building up yet another totally ineffective effort at punishing wrong doers.
What the White House needs is real computer security experts at the helm, not another ex-cop. Not to bash Mr. Schmidt, but he just doesn't seem like a real addition to their team. I'm sure the Federal Government has plenty of law enforcement and ex-law enforcement types to guide their decision making, but not enough real experts on the infosec problem.
Re:It's all part of the same kind of thinking. (Score:2)
ROFL--that is about the funniest thing I've seen in a while.
Microsoft is not handling their issues well. (Score:2)
In my opinion, you are missing the point. They could meet their own needs and the needs of the world at large at the same time, but seem unable to do so.
Re:Job qualifications (Score:2)
Re:Job qualifications (Score:2)
Why, just yesterday I was prevented from.... wait... I wasn't prevented from doing anything yesterday. Neither were any of you.
So the loss of civil rights is only a negative thing if it happens to you personally? Real nice.
And maybe yesterday it wasn't me or you, but tomorrow it might be.
Who better to help you implement Magic Lantern (Score:5, Funny)
;)
Huh? (Score:3, Troll)
Re:Huh? (Score:2, Insightful)
Would you rather trust:
1) The Chief Financial Officer in a company that constantly just breaks even
2) The Chief Financial Officer in a company that constantly rakes in cash as if they had a money tree AND the Philosopher's Stone.
or
1) The head of the local mobster offering you proctection
2) The local police chief
responsibility (Score:5, Insightful)
As security advisor at Microsoft, his job presumably was to define policies that keep those holes from getting into the software and/or to keep Microsoft's sites secure. Microsoft's products are full of holes and their services have suffered major security compromises, so he can't have been very effective.
Since his new role will be similar in nature, it seems reasonable to suspect that he will be equally ineffective at defining national policies to protect our national security infrastructure.
Re:responsibility (Score:5, Interesting)
In a company that large, there will be both fuck-ups and genuinely good workers. I know some extremely talented people working at Microsoft. I also know some losers there. I don't know which side of things this guy is on, but you have to figure that only a few companies have people with enough experience with huge, varied networks to take on this role for the federal government. And Microsoft it very likely to be one of them.
Re:responsibility (Score:3, Insightful)
I think Microsoft is very *unlikely* to have much useful exerperience with "huge, varied networks". What really gets me is that they seem to *like it this way*.
-Paul Komarek
Re:Irresponsibility? (Score:2)
No.
The biggest targets for those cracking computers are banks and telcos. Increasing your bank account and getting free long distance/cellphones, that's what phreakers and other crackers want.
Re:Irresponsibility? (Score:2)
As for being one of the most targetted networks, I'd agree. However, I'm not so sure they're number 2. I expect that other governments, Yahoo, and places like CERT (hosted by Carnegie Mellon) are also big targets.
As for Adam Smith, he *was* wrong. That's why the US (and every other 'capitalist' economy) uses a regulated implementation of capitalism. The free market makes its decisions based on marketing. If it made decisions based on research and development, then R&D would get 50% of revenues and marketing would get the 5% that R&D gets now.
Where is Microsoft today? Using hundreds of programmers to slowly reinvent unix networking. Why slowly? Because they're waiting for people to forget all the FUD they've put out about how bad unix networking is.
And I don't care about Microsoft's 2 million object directory. Why? Because I can piss farther than you!
-Paul Komarek
Re:Irresponsibility? (Score:2)
I would also make the observation that marketing serves an important purpose. It helps keep the public informed about their dazzeling array of choices. It's even ok that most of it is bullshit, because the intent of the advertisement is clear, we can usually fillter out what the truth is. But it helps the market more quickly sort out where the money should go. Course, that's just how I see the world.
You might be surprised to learn under some circumstances DNS replication under windows can be more secure that its UNIX kin, and in software so early in its life too. I suspect UNIX will be better for a couple more years, though MS does have an advantage or two, but everyone who has had a head start on MS has fallen by the wayside when MS decided to compete with them. But with all things it's never about how bad or how good something is. It's whether it's good enough and how popular, something MS seems to understand better than anyone else.
I don't know who told you I squat to pee, but they were lying.
And to the moderators: "Feel free to mod me down, it's going to take a while to get rid of my +1 bonus, cheers."
Re:responsibility (Score:3, Insightful)
One has to wonder what effect this person's tenure with Microsoft will have on his job performance; much in the same way that we had to wonder about Dick Cheney's Haliburton/Enron/oil industry ties when he was coming up with the administration's energy policy. It's a valid concern and one that should be raised.
Re:responsibility (Score:2)
But Schmidt is just "some guy at Microsoft", he is "Microsoft's Chief Security Advisor". As the Chief Security Advisor, he can't say "I'm really quite good, but I just can't get security at this company under control". Getting the company under control is part of the job. In large, hierarchical organization, the buck stops there, and it is justifiable to equate a top-level position with top-level responsibility. If people feel they can't be judged by the record of their part of the organization, they can always step aside.
As for expertise, Microsoft doesn't strike me as a company that has a lot of expertise with "huge, varied networks". In fact, their likely lack of extensive in-house expertise with the kinds of computing systems found in the US government is another factor that raises doubts about this choice.
Re:responsibility (Score:2)
Re:Huh? (Score:4, Interesting)
First off, not to single you out, but this is so friggin typical of slashdot. Everyone (including chrisd from
Finally, apparently this guy knows his shit. From this PBS interview [pbs.org]
He is Chief of Information Security for the Microsoft Corporation. Prior to this he was a Supervisory Special Agent, Director of the Air Force Office of Special Investigations, Computer Forensic Lab and Computer Crime and Information Warfare.
Now, does it seem like a mistake to hire him? After all, he is *leaving* MSFT to go back to the government. Enjoy your crow, everyone!
Re:Huh? (Score:2)
So I don't like him as a choice. But I also expect that he will find himself among compatible people. Except that he appears to be technically competent.
.
MS Security Guy probably didn't write code... (Score:3, Funny)
I know how we all love to flame Microsoft, but if the guy was the head of MS Security, odds are he was an executive who never wrote a line of code.
He's guaranteed not to have anything to do with holes in MS products.
A better thing to look at would be how often was Microsoft's network hacked.
Re:MS Security Guy probably didn't write code... (Score:2)
Oh, you mean like here [nwsource.com] and here [infoworld.com] and here [theregister.co.uk] and here [zdnet.co.uk] and here [zdnet.co.uk] and here [zdnet.co.uk] and ...
Re:MS Security Guy probably didn't write code... (Score:2)
Reminds me of star trek TNG. (Score:3, Funny)
Re:Reminds me of star trek TNG. (Score:2)
Re:Reminds me of star trek TNG. (Score:2)
ONLY LOSERS WATCH TREK!
So you think the White House chose him at random ? (Score:5, Interesting)
Here's a guy who was working for the largest software monopoly in history and now works as security honcho for the most powerful government in history, with people like Ashcroft in it. Makes my nose bleed just thinking about it. The more I see what's happening in Micro$oft's giant sphere of influence, the more I'm glad to be a Linux user, that's for damn sure.
Re:So you think the White House chose him at rando (Score:3, Informative)
How interestingly broad, given that in light of recent terrorist activities any "exigent circumstances" could be said to be met as a matter of course. And there is no doubt that all the information that's bound to be stored on
Kinda makes you wonder how it all fits together, given the walk Microsoft got on the anti-trust case.
Re:Kiss your beloved Linux goodbye. (Score:2)
(Hollings/Stevens).
Checking on someone's previous work. (Score:4, Funny)
What type of work? (Score:2, Interesting)
Re:What type of work? (Score:3, Informative)
See here [vmyths.com] for the kind of stuff this guy's going to be working on.
more info on Schmidt (Score:3, Informative)
Re:more info on Schmidt (Score:2)
I disagree here. Strict policy to include security MUST come from upper management. Otherwise, people down the line will dismiss it as less important and end up taking short cuts. If management allows the time for the design and development of security policies, they will have a better chance of being implemented.
Software engineers (or anyone for that matter) won't do anything extra that hasn't been earmarked by their bosses.
Of course, you could argue that adding security is basic common sense - however, given that most programs look identical from the outside with and without security, if you were in a hurry what would you implement? It's a sad state of affairs, but in these days of relatively high turnover and when speed is important, sometimes the 'little' (seemingly) unimportant things get neglected.
Bottom line is, it's not a few dozen individual software engineers that make this call, it's the CTO or other upper level manager that does - by corporate policy.
Actually a good find (Score:2, Insightful)
Not sure whether to laugh or cry (Score:2, Informative)
This just seems like one of the most phenomenolly stupid ideas the government could make with respect to computers though given the current adminstration I am sure they could figure out some way to outdo themselves. Though I really don't want to see what they do to outdo themselves.
Hmm I heard Mars is nice this time of year
pretty unfortunate (Score:3, Interesting)
If the latter is the case, there is a good chance that this guy will follow the easy and obvious (to laymen) path and push Windows. After all, NT was created by someone with decades of experience and it is 'C4' certified (or whatever). It has zillions of security features, even more so than VMS, so how could it not be secure? And it is used by some of the most security conscious companies in the world. And what's good for Microsoft is good for America anyway. At least those will be the arguments that will likely be heard around the White House when issues about what software infrastructure the armed services and US government should use.
This will be followed by calls for keeping source code for criticial infrastructure under wraps, "like Microsoft is already doing", because "we don't want to give the terrorists the blueprints to our advanced technology". He'll probably preach the Microsoft mantra that open source is dangerous, unsafe, and un-American. And he'll likely conflate "security" RIAA style (fair use hijacking) with national security and point to how badly the RIAA and MPAA has been "hurt" by "security problems" resulting from "open source hackers" and how Microsoft, in contrast, keeps content "secure" and protects copyright holder's rights.
Altogether, this appointment is likely going to hurt open source efforts, as well as national information security.
C2 Certification (Score:3, Interesting)
To the best of my knowledge, NT got a C2 certification umpteen years ago. But (and I'm not making this up), It only achieved C2 when the disk drive was removed and the machine was not attached to any network
I don't think Microsoft attempted to brag about orange book certification since then.
Re:C2 Certification (Score:2)
can't speak to the network, but it was the floppy disk that needed to be removed. How did you plan to run the system with no hard disk and no network? Bootable CD? People do it with Linux every day, but I've never heard of a fully functioning NT system running off a CD.
Do you even know what a C2 certification entails? (Score:3, Insightful)
There's no security without physical security and a floppy/CD attached to a computer giving you a workaround from the single pathflow of username/password login to an ACL-controlled environment fails the C2 spec by default. No one brags about Orange Book certifications because no one enforces it because it's freaking useless in every conceivable work environment. No network + no disk drives == no sneakernet == why bother?
This guy is clueless (Score:5, Informative)
Notice in the 1998 interview that he denies that viruses in mail attachments are a problem.
Re:This guy is clueless (Score:2)
Easy on him guys... (Score:5, Informative)
He could have given Microsoft all the advice in the world and if they were too lazy to implement the appropriate security measures it's not his fault.
Maybe the position at the government was his oppourtunity to get to a better place that would actually listen to him.
Possibly (Score:2)
Not really. (Score:5, Funny)
Actually, no. Captain Hazelwood was drunk at the wheel before the accident. Apparently he was a fine captain when sober. Microsoft has bad security whether or not you consider them to be drunk.
Re:Not really. (Score:5, Informative)
Capt. Hazelwood was not at the wheel, or even on the bridge, when the Exxon Valdez struck the reef outside Port Valdez. Contrary to popular opinion ship Captains are not required to be "at the wheel" all the time. The ship was in what the USCG had declared was "outside pilotage" waters and a licensed USCG Merchant Marine Officer (the 3rd Mate) and a compliment of documented seamen were on watch - and at the wheel. Some seamen testified to telling the Officer on watch that the red buoy marking the limit of Bligh Reef was on their starboard side. For whatever reasons, he chose to ignore them.
Capt. Hazelwood had to go down to his office to prepare the flurry of reports that Exxon's yuppie management required every one of their Captains to prepare and send in after loading and as soon as the pilot departs the ship. Prior to leaving the bridge he instructed the Officer on Watch to return to the sea lanes (marked clearly on a radar system on the bridge) after clearing the ice. For whatever reason, this officer declined to follow those instructions.
The USCG officers who claimed he had alcohol on his breath were in an environment of heavy concentration of evaporating chemicals that was so bad that the Chief Mate (whose watch the 3rd mate was taking because the Ch. Mate had been working 36 hours straight loading the ship) testified that he had considered going back and getting a Scott Air Pack to get up the stairway to the bridge. (Compare to trying to detect alcohol on the breath of a friend while putting your nose next to the fill pipe of your car while fueling at at your corner service station.) (Hazelwood was never convicted nor was his USCG license revoked, btw.)
The USCG radar observers in Port Valdez did not make any attempt to follow the ship after the pilot disembarked at the west end of the Valdez Narrows despite warning the ship of pack ice and authorizing the ship to divert from the navigation channel to avoid the ice.
The Exxon Valdez hit Bligh Reef because the ship was undermanned (it was 900 feet long and carried a crew compliment of less than 25 people!), the crew was overworked and exhausted (and many say inexperienced), and Exxon management in Houston was micro-managing the ship with petty requirements, plus the USCG in Port Valdez did not do their jobs.
One of the after effects of this incident was that the USCG returned to the policy of requiring ships to carry an extra officer to help with navigation and loading due to the heavy burden. A policy abandoned by Exxon and the other oil companies several years prior to the accident. A further after effect was a requirement that tankers entering sensitive waters be double-hulled.
Another after effect is that the radar observers in Port Valdez now monitor the ships until they depart Cape Hinchinbrook and enter the open Pacific.
A final after effect is that Port Valdez now allows tanker Captains to return to the Port and tie up in dangerous weather. Prior to the Valdez incident they refused re-entry and required loaded tankers to either stay inside Prince William Sound and motor back and forth in the traffic lanes or depart and suffer damage (and loss of life).
The oil spill would have never caused as much pollution as it did if British Petroleum hadn't allowed the management of the Valdez terminal to decommission the recovery equipment they had promised the State of Alaska they'd keep on hand for the life of the project. They have recommissioned the oil spill equipment since the incident.
Off-topic, but good reading. (Score:2)
Sometimes I love off-topic posts.
::sigh:: (Score:2, Flamebait)
Oh, and for those that claim that this guy isn't responsible for the holes in Microsoft software, and that thus this guy is actually pretty good at his job of protecting MS's network: You're half right. He DOESN'T have anything to do with the Microsoft software security holes. However, he was the one in charge of protecting Microsoft's network during the incident six months to a year ago when a hacker group hacked into Microsoft's network, completely 0wning the whole thing, and Microsoft didn't find out about it until the group had already been making regular visits to the network for three months, downloading the majority of the network (possibly the entire thing, I don't think anyone's really sure) during that time. And while some may wave that off as "one intrusion in X amount of time", remember that these guys got in and then kept making REGULAR VISITS to the Microsoft network without anyone noticing for three months. So while only one group managed to do it, it sounds like they managed to keep doing it on an almost daily basis. That makes for a pretty bad security record, and it would've been a huge fucking disaster if this had been done during the upcoming era of widespread .NET and Passport services, or only a "somewhat large fucking disaster" during the current era of consumer and business consumer information being regularly logged through XP's activation madness.
I guess this proves that from now on, the government will be too busy looking at our computers to even take a passing glance at the situation of their own.
Re:::sigh:: (Score:2)
Anyways, enough with government fuckups. BTW, you mentioned the peeps that were hacking into the ms servers for 3 months before being detected - keep in mind that this is the people who were caught and that we heard about, and since it is not in MS's best interests to say they had been ass fucked by hackers . . .
Corporate security != electronic security (Score:3, Interesting)
In other words, Big Brother stuff. Spook stuff.
That is what a chief security officer does in the traditional corporate environment. He will have an underling (or several) who handle electronic security for him. If he knows what's good for him he'll realize that he shouldn't try and play a game he knows nothing about, and he'll let his underlings have free reign.
Not that it will do any good, of course. As long as Microsoft uses its own software, it will always be vulnerable to the same exploits with which it burdens the rest of the world.
Re:Corporate security != electronic security (Score:2)
/. home of the stupid anology (Score:5, Insightful)
First off, being the white house I'm sure they throughly examined everything about him.. I had a friend apply for a fairly low position with the DoD and they interviewed his friends and family as well as giving him a lie detector test.
Secondly, this is hardly compareable to the Exxon Valdez thing..
Third who are you to say he did a bad job at MS?
Other then just taking at cheap shot as MS, you have no info about his job performance or even what he specifically did while working at "The Great Evil"
Maybe its just me, or maybe theres a reason you dont see chrisd listed in the hof anywhere..
My comment. (Score:2)
Seriously though, this is rather ominous.
Take MS's awesome track record and keep it in mind, this isn't going to be a MS flame on their fucked security though. He was an advisor, which meant people didn't necessairly listen to him.
Now, we all know that the new guy will be completely impartial? Right?
Bullshit, not only does the DOJ let MS go damn near scott free, but now the white house appoints a former employee to tell them how to work security.
Great, name him "Director of Computer Honesty" too, rename the DOJ to "The Ministry of Peace" to keep with the theme (or was it truth, it's been a while since I read the book).
You know, this might not be that bad - if sysadmins can't patch their servers because the government doesn't allow publication of exploits, it will make hackers / skript kiddies jobs easier. It will escalate to a point where there will be so much bullshit, that sysadmins will all just post their shit anyways, consequences be damned - or just host exploits in Rwanda, Iraq, or some other nation.
This is not to say that his experience will be a total fuckup - he does have a few interesting ideas, and I think that he realizes that what is under his control can never be broken into, which is nice (a realist, instead of some bitch from marketing).
His administration will be a mix of good and bad things, though his support of ammending the freedom of information act certainly makes my worried.
This is just insane (Score:2)
Aside from that, though, what bothers me is the security ideology espoused by Microsoft (and as others mentioned, this guy), the whole 'security-through-obscurity' thing. These people seem to think that building software is like building a house, it can't really be secure, just tight enough so that you don't have to worry, but we know that isn't the case. I mean, Microsoft is a successful company, but they're security is just crap. And when they're called on it they blame others. This is not the kind of attitude that we need to manage a secure government system. I mean we can't just send the FBI in to confiscate the computers of 'suspected' hackers if they're funded by another country.
Bleh, this government sucks. 9/11 has just made them more paranoid and retarded.
That's a good news (Score:2)
Wait a minute...
Re: (Score:2)
Look Ma, I'm a moron (Score:2)
Likewise, it is not a security advisor's job to fix security issues. It is his job to advise people on ways of preventing security problems. Just like a QA tester, he has no control over whether people actually heed his advice.
So does this mean ... (Score:2, Funny)
tourist> yay
tourist> common guys lets go
security officer> um sir please don't tell too many people about this
tourist> er
*walks inside*
While this may seem a strange move (Score:2)
that is what I hate. (Score:2, Insightful)
This kind of bashing is definitely not ok. You know NOTHING about this guy, I'm sure he is VERY high qualified and he is not to blame for the philosophy of a company.
Hey chrisd, do you have any idea which education you must have to become a Chief Security Advisor at Microsoft? Do you?
Demonizing Microsoft, that is what the script kiddies, crackers, etc do. It should not be commited by a sane, open minded community.
For example I know a guy who teaches ppl how to pass the mcse certificates. I once asked him why he is doing this microsoft stuff. He told me that he no fan of Microsoft itself as a company, but it's good money, a nice job.
In his free time he is a sun/java developer and truly fan of linux.
Maybe we shouldn't categorize people because of their jobs. And believe me, Mr. Schmidt knows more OS than win98...
Saying "w1nd0wz sux0rZ, h4X0r1ng m$ r00lez" is just embarassing...
Re:that is what I hate. (Score:2)
it seems to me (Score:5, Funny)
dave
Excuse me.... (Score:2)
The job'll be easier, I'd imagine, since the White House is a smaller and less ambitious (but equally high profile) MS shop and while he now isn't down the hall from the developers (which is not all it's cracked up to be) he is down the hall from the NSA.
I mean really. If you've got to secure an important *MS* shop, who do you think would be better?
Re:Excuse me.... (Score:2)
Men are good.
Socrates is a man.
Therefore, Socrates is good.
This kind of logic has stood up for 2400 years
We hired an old NSA guy to be the security guy at my University. Things have become demonstrably worse in the past six months. Why? He is a Microsoft weenie. Who ever heard of a security maven who repeatedly gets infected by 3-year-old viruses in his mail because he insists on running Outlook -- unpatched.
Re:Excuse me.... (Score:2)
Don't you see the irony of an employee of the bane of IT security getting a White House level position for IT security issues? I bet the WH shifts from Lotus Notes (which is very secure) to Exchange (which is a festering security nightmare) within six months.
Use ya head! (Score:2, Interesting)
So they employ the guy and put him in a safehouse where they can have a long chat, Dubwya gets a clearer picture of what he's up against.
Not quite (Score:2)
Here's how the conversation went (Score:2, Flamebait)
Ashcroft: that's computer survellience.
GWB: well this Texan don't know the difference so why doncha tell me.
Ashkroft: we need to spy on people to make sure they're not terrorists or having abortions or being queer.
GWB: so this guy from MS can help us with that
Ashkroft: yeah he can get MS to put whatever backdoors in so we can spy on whomever we want.
GWB: backdoors? sounds kinda queer.
Ashkroft: those nerds are all kinda queer anyway - so here's the deal. we hire this guy and then tell him what to tell Gates to do.
GWB: why should Gates do what we say - that nerds's got more money than a whorehouse with an oilwell?
Ashkroft: cause Gates has money but we wants access and prestige like everyone else
GWB: ok I'll go with it - how we commin with rounding up the ragheads
Ashkroft: fine, project TexAryan is right on target - all non Christians are being targetted as we speak.
GWB: well shit howdy, get me a drink then.
Qualification? (Score:2)
Depends on what you expect from "security," I guess.
Look on the bright side... (Score:2)
-
Better job (Score:2)
Missing the point (Score:2)
Misleading header. (Score:3, Insightful)
MS tools may not be the best, but once that's what the White House has got, then choosing this guy to advise on security seems to me to be a sound decision, no question about that. But I don't think this move has much to do with White House security at all.
Now, call me paranoid if you wish, but when I read this piece of news I can't help but ask myself what is this individual really up to within the government structure. He's supposed to know MS security like very few people in the world. Wouldn't he be of great help for the Bureau in their desire to do funny stuff with everyone's machine? Or something along those lines? Reading the article we see that he's not going to do things like helping beef up thw WH website security, he will be working with a taskforce that has many ramifications, chaired by Richard Clarke.
From the article:
Clarke was named last month to head a new White House Office of Cyberspace Security that is to focus on developing a plan for protecting the nation's critical infrastructure.
That could mean a lot of things.
No Joke (Score:2)
I actually shrieked out loud in terror when I read this headline. Good lord, I feel like I'm trapped in a bad Dilbert cartoon.
Doesn't anyone here subscribe to bugtraq? (Score:3, Interesting)
No! (Score:2)
No, it would be like making Capt. Hazelwood the Secretary of Transportation [dot.gov].
(Uh, he was in charge of an oil tanker.)
Par for the course in DC (Score:2)
See my previous post... (Score:2)
-Puk
What a security officer does (Score:3, Interesting)
Most large companies have security officers. They usually come from a law enforcement or military background. When you see the title "security officer", think Lieutenant Worf, not Wesley Crusher. The security officer is usually in charge of physical plant security, of running background checks on incoming employees, making sure the guards at the parking lot entrance check the right ID's, etc. Their involvement with computers may reach as far as directing that the company firewall filter out incoming
As far as I know, Microsoft didn't have serious problems of that nature, and that guy did perfectly well at his job. The pinhead marketroids who put all the vulnerabilities into Outlook were in a completely different jurisdiction, so to speak. So I don't have a problem with his going to work for the white house.
Re:I wish... (Score:2)
Ultimately, he's one of the people that dictates where they will draw their balance between cost and security. Sure, they could spend time and money educating their programmers about security concepts, and sure, they could spend a lot of time and money doing code reviews - but do they? Only a little. And he's one of the people that make those decisions.
Is that who you want handling national security policies? "Well, yeah, there's a pretty big hole there, but we don't think that most people will find out about it, especially if we don't tell them about it."
steve
It's a matter of trust (Score:2)
I didn't need that functionality anyway -- there are other ways to move files around. But what about a server that I really need? Well I don't trust bind farther than I can spit a rat but I run the damn thing. I compiled it statically and run it chrooted as a user other than root. Although a previous release of the kernel would still have allowed a compromise of my system, I'm not running that kernel and so I'm willing to trust bind nominally in that configuration. I was able to secure it although I don't trust it.
Windows evolved from a single user operating system and those roots are still very much evident in every application for it that I've ever seen. It is highly in need of clueful administrative staff in order to keep a user base secure, but the lack of a need for a really clueful administrative staff is one of the selling points of Windows -- we were supposed to be able to install NT on all our servers, 95/98 on all our desktops and fire all those high paid UNIX sysadmins, replacing them with chimpanzees. And somehow the CIO doesn't take any flak for this when the company spends a billion dollars trying to clear code red out of the network. The attitudes are more flawed than anything else and that is why I don't trust Windows.
For the record I don't trust Linux or BSD either, but I trust them a lot more. I'd be much happier if the various servers I used were coded in some language where it was harder to make such fatal mistakes, such as Java, Haskell or LISP, but I expect we'll get there eventually.
Re:DEF CON 10? (Score:2, Funny)
DEF CON 10 will be August 2nd-4th, 2002 in Las Vegas. More details soon.
Not quite (Score:3, Funny)
"Howard Schmidt, Microsoft's Chief Security Advisor"
Sure, he gives advise. But nowhere did it say that they actually listen.