Risky Business #117 -- McAfee tries to explain data loss incident
Thu, 07/30/2009 - 17:49
Readers of the Risky.Biz website would have heard by now that McAfee accidentally leaked the full contact information of 1400 registrants for its strategic security summit that was held in Sydney on July 17.
McAfee's Asia Pacific President Steve Redman is this week's feature guest -- he joined the program to face the music for that one.
Wed, 08/05/2009 - 09:26
#2
Steve Redman vs Stuart Strathdee
Of the two, I must say I was more impressed by Steve. Of course it shouldn't have happened, especially to a security company, but this wasn't someone getting owned by leaving a glaring hole in their defences, but rather, human error that could equally have happened to you or me in an unguarded moment under pressure. And should he write to everyone, so encouraging those who hadn't noticed the blunder to go rummaging through their recycle bins instead of just letting sleeping dogs lie? I see his dilemma. In any case, this isn't credit card numbers or medical history but simply contact details of people, many of whom probably swapped business cards at the event and make themselves known on LinkedIn.
On the other hand, I just didn't buy Stuart's waffle about "a difficult balancing act". Rubbish! It's black and white to anyone who didn't have the Microsoft brain transplant! If x million people are happy to use pirate copies of Windows without anti-virus when you can even get free AV from a couple of vendors, will even one of those x million pay the license fee so as to get Morro? I doubt it. Against that, the advantages for everyone of pushing Morro to all users with no other AV are overwhelming. I'm afraid it all comes down to Microsoft's pride, and in the same way that they had to swallow their pride and let unregistered users get critical updates, they will have to do the same with Morro if they have any sense.
Regards - Philip
Wed, 08/05/2009 - 10:29
#3
Thanks for the thoughtful
Thanks for the thoughtful comment.
I agree with you about Microsoft's current stance on Morro. It's lousy, and makes it impossible for the company to say it's doing all it can to secure the "ecosystem" without looking completely hypocritical.
That said, Redman's claim that "well, we asked people to delete it, and it's possible they did" is completely ridiculous. To have a senior executive from an information security company demonstrate that he fundamentally doesn't understand the nature of a data breach is simply staggering.
Wed, 08/12/2009 - 12:41
#4
More food for thought....
Hi Patrick and pleriche,
Just before you condemn me to a "Microsoft brain transplant" (not that this is necessarily a bad thing if you knew the people that I work with) I wanted to add that the decision around WGA and MSE is not only limited to just the WGA logic.
We (Microsoft) need to be considerate of anti-competitive, and in some countries political concerns. We can have a positive (ecosystem) impact on the big gap between those who have AV and those who are genuine but don't. In the locations that OneCare was offered this is a large group, and thus we can have a huge impact with the current WSE release plans.
So whilst I hear you both on the WGA concerns, and agree that on that point it is black and white, when you add in the other issues that we (Microsoft) face I hope you don't still feel it is waffle when I said it is a "difficult balancing act."
Anyway, the feedback is appreciated and I'll make sure that where I can influence these decisions I'll highlight this WGA point.
Kind regards,
Stuart.
Thu, 08/13/2009 - 05:27
#5
Does it really matter?
I don’t know if I buy this whole “Oh they clicked on a popup ad that said you got viruses click here to download a scanner and so that means they want protection” line. I sure those people that are clicking these popups, popups that couldn’t declare their intentions more clearly unless they said “click here to download a virus”, aren’t the most security minded individuals in the world. These are the same people that are getting owned by old exploits that have been patched a long time ago, exploits that could have been avoided had they simply installed the updates that they already get for free that are delivered to them automatically! Do you really think these people are going to go out and FIND an antivirus solution and go to the trouble of downloading and installing it? I think not. Don’t even get me started on the actually effectiveness of signature based virus scanners. There is nothing you can do short of physically going to these people’s homes and patching their systems yourself to make them secure. Microsoft has the best of intentions, I’m sure, with this but this is really just a lost cause. I don’t recall which pod cast had this quote but it comes down to forcing grandma off Windows 98 and not letting your users do stupid crap.
Very good interview Patrick, I guess I am glad Steve came on, but he seemed to completly miss your point that it was out and they should appologise. But then again he has probably been told by legal to not admit fault because that implicates them. Regardless I think they should, it makes me question what information I should give to conferences from now on.
I also don't buy the excuse of we don't know how many people it went out to, or we told them to delete it, so we don't even know if it is still out there.
--
"Put me here and I am all yours, not for the money and not for the appluase", Melanie Safka