Reflections of a 20-year IT security veteran

New job, same goals: Improve computer security, protect end-users

As I announced in my blog last week, I recently accepted a job as a senior security consultant with Microsoft’s ACE (Application Consulting and Engineering) team.

[ RogerGrimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

After 20 years of computer security consulting, much of it on Windows systems, this job is a natural fit for me. I get to continue to consult, write, and speak on computer security topics. Now I can pick up the phone and call the people who wrote the code I’m troubleshooting. I thought I would be bringing the ACE team a new set of skills with my use of Linux and OpenBSD, but there are several team members with even more experience in the open-source arena.

Of course my announcement set off a flurry of e-mails from the usual crowd telling me how stupid I was and how "right" I was for Microsoft, "good riddance," and all of that. I love my adoring public.

The computer security field is a tough one. There is never a shortage of critics, and the hero accolades don't come around too often. We know the answer to most security problems, but most will never get fixed; when they do, it's too late -- the hackers and malware have moved on to something else. The vast majority of computer users in this world don't care about security and, in reality, shouldn't have to be experts. They just want to be able to turn on their computers and have them work.

If you're in this field thinking you're going to "beat" the bad guy and get rid of hacking forever, you're in for a rude awakening. When I first got into this field, computer viruses only ran on Apple computers. Then the IBM PCs and DOS became more popular, and hackers moved to that platform. Windows became more popular, and viruses went there. Malware went from boot viruses to file viruses to macro viruses to e-mail worms and now to HTML-embedded content. I assure you, whatever system emerges in the future and becomes popular will be hacked and exploited.

Twenty years ago, hackers learned how to hack plain text files. All the reader did was TYPE a plain text file, and hidden embedded control characters remapped the keyboard so that the next pressed key formatted the hard drive. When people tell me that someday we'll get rid of malicious hackers, I just remind myself that they know how to hack text files. And if those can be hacked, nothing is safe.

My love for computer security started when I checked out Ross Greenberg's book, FluShot, from the school library. Greenberg made one of the PC's first anti-malware programs. It had rudimentary behavior checking and the ability to write-protect files and folders. Greenberg challenged malicious hackers to attack his BBS (that's bulletin board system for you young whippersnappers), and they did.

Prior to that, I was a paramedic and volunteer firefighter. I think the rescue person in me wanted to help save the world in computers, too. I fell in love with the fight against electronic evildoers. I've never understood what makes a person want to hurt another innocent person or computer, but whatever it is I don't have. I do lots of hacking in my life, but never once have I done it illegally.

When I got into fighting viruses, worms, and trojans, there were only a dozen publicly known malware programs. In fact, we were warned about them in an online newsletter called the Dirty Dozen. I remember when Eric Newhouse gave up maintaining the list because the number of malicious programs reached almost 200.

Back in the day, virus scanners were coded to look for a single virus. There was a different scanner for each possible malware program. If the program found the virus, you had to run another companion program to remove it. John McAfee made the first antivirus scanner that could scan for multiple bad programs at once.

I've also watched lots of teenagers and young adults get seduced by the allure of malicious hacking. These days, there is a lot of money (and not a lot of risk) to be made by illegal hacking. I believe that if we catch them early on, many of the people who might become malicious hackers can be directed toward more productive pursuits with a little guidance.

If you know of someone hacking maliciously, intervene and ask them to fight the better fight. It doesn't take much knowledge to write a computer virus or worm. Anybody can do that. It's writing a solid defense tool that defeats all those pesky critters that takes real talent.

After 20 years (and I’ll probably put in another 20 to 30 before I retire), I can truly say I love my career. I'm a lucky working stiff. But the truth is, I wish all computer security problems would just go away. When I say this out loud, some people ask me what I would do with my career. I always respond that I'd spend it helping people to be more productive on the computers instead of chasing away creeps and malware programs.

So, how will this column change with me going to work full-time at Microsoft? Probably not much. I'll continue to be a full-time computer security skeptic and supporter of all computer platforms. Readers might remember that my New Year's resolution recommendation was for them to install OpenBSD, not Vista. It is my goal in life to make computer security better and to educate end users -- whether that's at Microsoft or in this column.