It's a cliché that Microsoft's Windows, Outlook, and Office are prime venues for malware and hackers to get into your PCs and networks. But in recent years, Microsoft has tightened up its security issues -- and Adobe Systems has increasingly become the sloppy vendor whose products such as Acrobat and Flash increasingly pose the security holes that bedevil IT. And Apple could be next.
As co-founder and CTO of eEye Digital Security, Marc Maiffret spent much of his time immersed in the world of Microsoft insecurity. When there was a large zero-day vulnerability to be attacked, eEye was usually among the first to find it. He left that job three years ago. In that time, Microsoft has gained newfound respect for its security efforts while other popular software vendors are fingered for making the same mistakes. In an interview with CSO Tuesday, two names came to mind for Maiffret, now chief security architect at FireEye: Adobe, which faces growing criticism for widely exploited flaws in its software, and Apple, which is increasingly the focus of malware writers even though it hasn't seen the level of attacks Microsoft and Adobe have.
[ Researchers say exploits of Adobe's PDF exploded in 2009 and will continue to climb in 2010. | Master your security with InfoWorld's interactive Security iGuide. | Stay up to date on the latest security developments with InfoWorld's Security Central newsletter. ]
Q: What's your take on the security vendor community today?
Maiffret: When you look at the industry and the mainstay players, they'll even tell you that their [malware] signature technology doesn't work anymore but that "hey, we have this great behavior-anomaly technology." What they don't tell you, and what the IT community can see, is that with those technologies you are either at one end of the spectrum or the other. If you tune the technology up you may catch a lot of things, but that includes a lot of false positives. At the other end, the admins tune it down to reduce the false positives but then they end up missing stuff. At the end of the day, you really can't have either of these scenarios, but everyone knows we can't have a utopia, either. The reality is that we're at the point where it's not even the sophisticated attacks that cause all the problems. We're seeing it with everyday spyware. It's very hard to tell the two apart from a threat perspective. In the process, we've seen a massive failure of the vendor community to grasp these things.
Q: We used to talk a lot about Microsoft's security problems. How are they doing now?
Maiffret: I think a lot of people are surprised that I've become one of the big advocates of saying Microsoft is getting a lot of things right. They're not perfect, but their approach to secure code has really come along. A few years ago I gave a talk called "More than a Microsoft World" where I tried to wake people to the fact that they weren't always going to be worrying about just Microsoft and Patch Tuesday in the years to come, but also Adobe, Apple, and so on. There are so many third-party applications on the desktop to worry about now.
Q: A lot of security practitioners compare the Adobe of today to the Microsoft of yesterday.
