Microsoft gleans top 10 basic security errors from thousands of help desk calls

**Mercury** · 03-19-2007, 06:01 PM

Microsoft's Security Response Center gets lots of calls for help with security problems. Here are the top ten laws that you can depend on.

Microsoft's Security Response Center gets lots of calls for help with security problems, and the security experts there say all of the calls fall into one of three categories. First is the one we hear about the most: software flaws resulting in vulnerabilities. Second is the misuse or poor configuration of software. Third are the basic security mistakes that companies and individuals make every day.

That last category is probably the most critical, but it is also the most neglected. At the same time, it is the easiest threat category that we, as individual managers, can address... sometimes at little or no cost.

Vulnerabilities can be patched, but the other two problems can only be addressed through education, either hiring better-trained people to configure software properly or conducting better in-house training.

The last category requires that everyone learn a bit more about the basics of security and that at least one person in the IT department become a real expert. Here are some facts you can depend on:

Law #1: If a bad guy can persuade you to run his program on your computer, it's not your computer anymore.

Law #2: If a bad guy can alter the operating system on your computer, it's not your computer anymore.

Law #3: If a bad guy has unrestricted physical access to your computer, it's not your computer anymore.

Law #4: If you allow a bad guy to upload programs to your Web site, it's not your Web site any more.

Law #5: Weak passwords trump strong security.

Law #6: A computer is only as secure as the administrator is trustworthy.

Law #7: Encrypted data is only as secure as the decryption key.

Law #8: An out of date virus scanner is only marginally better than no virus scanner at all.

Law #9: Absolute anonymity isn't practical, in real life or on the Web.

Law #10: Technology is not a panacea.

More...