Enterprise Networks / Security /
For security ask yourself...what would Microsoft do?
Related links
More on this topic.
Breaking news
Today's top news.
By Paul Roberts
IDG News Service, 11/21/03
Despite taking a beating in the press and from customers for security holes
in its products, decision makers at Microsoft appear to think the company
still has something to teach the world about computer security.
The software giant this week published a technical white paper that
describes its internal security practices, which Microsoft hopes will "help
customers successfully secure their environments," the company said.
Advertisement:
The paper, simply titled Security at Microsoft, details the methods and
technologies that the company's Operations and Technology Group (OTG) use
to secure the company's global corporate network of more than 300,000
computers and 4,200 servers.
In the paper, Microsoft describes its risk management strategy, which
involves classifying different computing resources according to their
"value class" -- from servers hosting the Windows source code down to test
servers. Microsoft also provides guidance on how its security group
assesses the potential risks and threats to those assets and creates
policies to secure the assets that are appropriate, given the value of the
data they contain.
Just as interesting are the tidbits of information about Microsoft's
security operation that can be gleaned from the document. For example,
Microsoft discloses that the company experiences more than 100,000
intrusion attempts each month and receives more than 125,000 infected
e-mail messages.
To protect corporate assets from threats introduced by remote workers,
Microsoft said it has invested heavily in smart card technology, deploying
more than 65,000 smart cards to remote workers that enable them to log on
to the corporate network using two-factor authentication.
The company is also candid in admitting to past security failures,
acknowledging that the company has been attacked in the past and that
there is a medium to high probability that within the next year, a
successful attack will occur that could compromise the High Value and/or
Highest Value data
class, such as source code or human resources data, according to the
document.