Southern Appalachian Digital Collections

Western Carolina University (20) View all

Western Carolinian Volume 67 Number 08

items 10 of 16 items
  • hl_westerncarolinian_2002-09-18_vol67_no08_10.jpg
Item
?

Item’s are ‘child’ level descriptions to ‘parent’ objects, (e.g. one page of a whole book).

  • september 18-24, 2002 technolo 0 news ewsma azine TECHNOLOGY NEWS "Microsoft Update"? HIMOWITZ ON COMPUTERS: Windows— More Roles Than a Prairie Dog Colony By Michael J. Him owitz - The Baltimore Sun 4} t's almost like a greeting from an old friend. You start up your computer, log on to the Internet, and up pops a little gray box: "Microsoft Critical Update Notification: New critical updates are available for your computer. Microsoft strongly suggests that you install these updates now. " When you click the "View Updates" button, you're whisked to Microsoft's Web site, where you can download a fix for the latest Windows security flub. I've seen plenty of these warnings lately. Last week, it was a fix for a critical security flaw that threatened my "Digital Certificates," whatever they are. The week before it was yet another security bug in Internet Explorer that could allow a hacker to take over my computer, and before that, a flaw in Office XP that could allow a script kiddie in Kazakhstan to burn down my house by remote control, or something like that. All told, Microsoft has issued 48 security bulletins so far this year, and may well break last year's record of 60. That doesn't count security bugs that other people discover and make public before Microsoft gets a chance to announce them. What's going on here? Are we risking life, liberty and property every time we turn on our computers? The answer is no. And yes. There's no question that Microsoft Windows and its primary applications have more holes than a prairie dog colony. This is the legacy of a corporate culture that developed around personal computers in the 1980s, when few PCs were connected to anything. The young Bill Gates and his Microsoft cohorts were hackers of the old school whose mission in life was to make computers do cool things and provide tools for developers and users who wanted to do the same thing. The notion that somebody might use those same tools to create mischief wasn't on anybody's mind. Fast forward 20 years and we have hundreds of millions of PCs that are connected on corporate networks and over the Internet. Unfortunately, those computers run software that was the product of a stand-alone mind-set. Consider Internet Explorer and its companion e-mail programs, Outlook and Outlook Express. A Web browser by definition is a programming tool that allows an intruder to take control of your computer—albeit at your invitation. In the best of all worlds, a browser should put strict limits on what a Web programmer can do. It certainly shouldn't let the Web page designer steal information, destroy files or plant programs that can take over your computer. Although it never deliberately let that happen, Microsoft expended far more effort on adding new features and e-commerce tools to IE than it did on building defenses against hackers who might turn those features around for nefarious purposes. Over the past few years, hackers have figured out how to do just that. Outlook and Outlook Express compound these security flaws when you display e- mail in Web page format. No longer do you have to visit a Web site to execute malicious code. All you have to do is open your mail or browse through it in a preview window. Moreover, because Microsoft has built so many programming "hooks" into Windows, it's relatively easy for virus writers to hijack Outlook to spread their work around the world. Unfortunately, these are just two of the many security lapses that Microsoft has been hammered for over the past two years. Many others affect the servers that run corporate networks, e-commerce operations and Web sites. Gates finally owned up to the problem in January, when he sent a rare message to all Microsoft employees announcing a new "Trustworthy Computing" initiative. Henceforth, he declared, the company's top priority would be security and user privacy—new programs and features would come second. Indeed, Microsoft is cleaning up its act. When it finds a flaw, it generally fixes the problem, announces it to the world and—if the bug is serious enough—invites users to download a fix. Which raises another question. How serious are these security bugs? They're certainly treated seriously in the press when Microsoft itself calls them "critical. " Since I've never been bitten by one, I called the best professional troubleshooter I know, Marc Seidler, and asked him how often he encounters the problems these fixes are designed to prevent. Seidler, proprietor of a local consulting business known as The Computer Doctors, has operated on thousands of troubled PCs in businesses and homes over the past half-dozen years. He regularly monitors Microsoft's technical Web sites, which he says are excellent. "I have never seen one of these sort of security issues" in a client's computer, he said. "Most of these things are discovered in the lab," he added, and many are important mainly to large businesses with sophisticated networks. "But if you're sitting at home and have Comcast or DSL (Internet service), it's not an issue. The latest "critical" announcement is a case in point. It describes scenario in which a malicious Web page could execute obscure code that deletes Digital Certificates from a user's computer. These are files containing the keys that allow users to encrypt e-mail (which almost no one does) and more importantly, exchange credit card and other information securely and transparently with e-commerce Web sites. As it turns out, no one has actually done this. In fact, Microsoft discovered the flaw during a routine internal security audit. So why a "critical" update? Because under Microsoft's standards (clearly spelled out on its security Web site), a critical problem is one that could result in code being executed on a user's computer without the user's intervention. The critical designation has nothing to do with the likelihood of an attack. In fact, many of the company's security updates describe flaws that have been found by Microsoft employees or security companies who spend their time probing for cracks in the wall. Seidler says viruses pose a far more serious threat to most users and recommends installing a virus checker and keeping it up to date. Does this mean you shouldn't pay attention when you get a "critical" update notification? Of course you should. Just realize that the flaws you read about so frequently don't signal the end of computing as we know it. For the latest Microsoft security bulletins, surf to www.microsoft.com/technet/ and click on Security in the main menu. Distributed by the Los Angeles Times-Washington Post News Service 02002 The Baltimore Sun TECHNOLOGY NEWS - cyber Security Legislation Administration Pares Down Cyber-security Plan By Ariana Eunjung Cha I The Washington Post As the White House moves to finalize a national plan to better secure cyberspace, high- tech firms and other companies are continuing a furious campaign to have some recommendations struck from the document. The administration no longer plans to recommend that Internet service providers such as America Online, MSN and EarthLink bundle firewall and other security technology with their software. Instead, it will ask ISPs to "make it easier" for home users to get access to such protections. It also does not plan to recommend that a privacy czar be appointed to oversee how companies make use of their customers' personal information, according to several people involved in drafting the document. A government official said the changes were made in hopes the plan would be adopted voluntarily by industry and not necessitate another layer of government regulation. Several companies have argued that if the government tells people what to buy and dictates how they should run their businesses, innovation will be squelched. But others said private industry was more concerned about the costs involved in carrying out the recommendations. Businesses also worry about taking on new legal liability. "I've been really shocked at how companies have been acting in their own interest rather than in the national interest," said Allan Paller, director of the SANS Institute, a computer- security think tank and education center. Harris Miller, president of the Information Technology Association of America, which represents 500 companies, said the private sector is in no way trying to dilute the plan. It was the industry, in fact, that first suggested a plan be developed, he said. "The idea that industry is somehow a reluctant partner is inaccurate," Miller said. At about 150 pages, the National Strategy to Secure Cyberspace, which is scheduled to be released Sept. 18, remains a weighty document outlining about 80 new obligations for the government, companies, universities and even home computer users. The most extensive recommendations are for the government. The plan would restrict federal workers from using certain wireless technologies and mandate that agencies only purchase software that has been certified to be secure. One of the top priorities, according to one draft, is for the government and the private sector is to make sure computers that control major systems such as subways, nuclear reactors and dams are secure. Also under consideration are recommendations calling for the establishment of a center that would study computer viruses, worms and other security threats; an accreditation board that would certify security personnel; and a private-public program that would help pay for security enhancements for critical parts of the Internet, including the routers that direct traffic, as well as operating systems such as Windows, Linux and the Mac OS. Some drafts also outline plans for the collection and analysis of network data that pass through universities _ places often used as jumping-off points for cyber-attacks. The draft also includes a plan to educate home users on how to secure their computers. The national strategy is being compiled and analyzed by Richard Clarke, director of the Office of Cyberspace Security, with input from a cross section of industry representatives, computer science experts and others. It is scheduled to be delivered to President Bush for his signature in the next week. 02002 THE WASHINGTON POST
Object
?

Object’s are ‘parent’ level descriptions to ‘children’ items, (e.g. a book with pages).