Reflections of a 20-year IT security veteran

As I announced in my blog last week, I recently accepted a job as a senior security consultant with Microsoft’s ACE (Application Consulting and Engineering) team.

[ RogerGrimes's column is now a blog! Get the latest IT security news from the Security Adviser blog. ]

After 20 years of computer security consulting, much of it on Windows systems, this job is a natural fit for me. I get to continue to consult, write, and speak on computer security topics. Now I can pick up the phone and call the people who wrote the code I’m troubleshooting. I thought I would be bringing the ACE team a new set of skills with my use of Linux and OpenBSD, but there are several team members with even more experience in the open-source arena.

Of course my announcement set off a flurry of e-mails from the usual crowd telling me how stupid I was and how "right" I was for Microsoft, "good riddance," and all of that. I love my adoring public.

The computer security field is a tough one. There is never a shortage of critics, and the hero accolades don't come around too often. We know the answer to most security problems, but most will never get fixed; when they do, it's too late -- the hackers and malware have moved on to something else. The vast majority of computer users in this world don't care about security and, in reality, shouldn't have to be experts. They just want to be able to turn on their computers and have them work.

If you're in this field thinking you're going to "beat" the bad guy and get rid of hacking forever, you're in for a rude awakening. When I first got into this field, computer viruses only ran on Apple computers. Then the IBM PCs and DOS became more popular, and hackers moved to that platform. Windows became more popular, and viruses went there. Malware went from boot viruses to file viruses to macro viruses to e-mail worms and now to HTML-embedded content. I assure you, whatever system emerges in the future and becomes popular will be hacked and exploited.

Twenty years ago, hackers learned how to hack plain text files. All the reader did was TYPE a plain text file, and hidden embedded control characters remapped the keyboard so that the next pressed key formatted the hard drive. When people tell me that someday we'll get rid of malicious hackers, I just remind myself that they know how to hack text files. And if those can be hacked, nothing is safe.

My love for computer security started when I checked out Ross Greenberg's book, FluShot, from the school library. Greenberg made one of the PC's first anti-malware programs. It had rudimentary behavior checking and the ability to write-protect files and folders. Greenberg challenged malicious hackers to attack his BBS (that's bulletin board system for you young whippersnappers), and they did.

Prior to that, I was a paramedic and volunteer firefighter. I think the rescue person in me wanted to help save the world in computers, too. I fell in love with the fight against electronic evildoers. I've never understood what makes a person want to hurt another innocent person or computer, but whatever it is I don't have. I do lots of hacking in my life, but never once have I done it illegally.