AusCERT: Security arms race

If you think of the security game as an internet arms race, Microsoft was on the march, but the virus writers would win the battle, according to a US security veteran.

“Virus writers are going to win the battle if they haven't already,” said security expert and internet mapping specialist Bill Cheswick, co-founder of dot com startup and Bell Labs spin-off company, Lumeta.

When it comes to the internet security arms battle, Cheswick said it “isn't going to end nicely".

“We are behind but we can control the battlefield.”

The average user would not be able to secure their computer systems on their own, he told attendees during a keynote address at AusCERT's third annual IT security conference on the Gold Coast.

"We will continue to lose the battle on user education,” he said. "People will never pick good passwords, two-factor authentication is essential."

Although perfect security may not be achievable, Cheswick said, “an uneasy truce may be good enough.”

“Good enough security is good enough. No need for perfect security,” he said.

Cheswick applauded Microsoft's efforts with security, but said a lot of companies would have trouble installing Service Pack 2 for Windows XP.

“Bill [Gates] gets it,” he said, adding “a lot of corporates are going to have trouble [installing SP2] because it's going to break things. It's going to be fun to watch over the next couple of months," he said.

Cheswick said Microsoft was on the right track with its “security by design” pledge, however, “it's too late for that, it's all retrofitting.”

"What we need is a kind of 'Windows OK' -- a thin client implemented with Windows would be fine for most home users," he said. "There should be nothing that you can click on in email or web pages that can hurt your computer. No functions that you don't use, no network services you don't need and no network listeners, shipped with default security settings turned on, and all the security controls in one location.”

Siobhan Chapman attended AusCERT 2004 in the Gold Coast as a guest of AusCERT.