Hello, I'm Eric Trabro of Government Security.com and Information Security Media Group, and I'm pleased to be speaking with Scott Charney, Microsoft's corporate vice president for Trustworthy Computing, engineering excellence, and environmental sustainability. Welcome, Scott. Thanks for having me. You have an interesting title, Vice President of Trustworthy Computing.
Define trustworthy, and as the Internet and computing evolve, does the meaning of trustworthy change, too? Trustworthy computing really originated with Bill Gates' memo on January 15, 2002, where he highlighted the need to increase trust in computing. And the real example was the telephone system, which historically has just been secure, reliable, and private. And those three attributes were key to the success of computing, too.
In the computing environment, it was much more challenging. There were many viruses and worms and security. There was a lot of concern about fair information use and how information about people was used. And the Morris Worm in 1988 showed the reliability of the system was certainly at risk.
Trustworthy computing is primarily about those three core attributes. And I think every bit is important today, although to some extent, the weighting has changed. Back in the early time frame of trustworthy computing, security was clearly the number one issue. People were very concerned about viruses and worms and unauthorized access to data.
But with the cloud computing issues that we have today, I think over time, privacy has grown in importance and reliability has grown in importance, too. So how is that changing your job in promoting trustworthy computing? There's really a couple of things that are changing my job. I mean, originally, as I said, we were focused on security, which meant heavily reducing vulnerabilities in products, building defense in depth, and mitigating specific threats.
But as we moved to the cloud, a lot of concerns about both the security and the reliability of systems relate to operational controls. So in the old days, we would build box products, and we worked to make them more secure, but you would hand them to the customer. And the customer would be responsible for deploying and maintaining those systems. But in the cloud world, it is the cloud enterprises, and Microsoft is a big cloud provider, that now assumes that operational responsibility as well.
So one big difference is we have to think not just about the security of the box products, but how we manage the cloud. And then in the privacy space, one of the things about this increased network usage, this notion that it's all about devices and services, is that there'll be a proliferation of devices, a lot of new services. And there'll be a lot of both user-generated content and network-generated content, like GPS data. And so we've seen recently, for example, in the media, concerns about location data and how it's collected and stored and who has access to it.
So it changes my job because in the security space, we have to think, still have to think about box products security, but also operational security. And in privacy, we need to think about all this data-rich environment and what that means for how we protect privacy. And then in the reliability space, when the cloud is down, now the social fabric of life, if the cloud is down, it means you don't have access not just to mail like in the old days, but to your social networking sites and your tweeting capability. And for a host of reasons now, we have a renewed focus on reliability.
Let's talk about responsibility a bit. Let's divide the world into vendors, users, and individuals. Where do the responsibilities for security and privacy lie with those three parties? You know, it has always been a shared responsibility between vendors and users, and that remains true.
But I think over the last eight or nine years, we have come to appreciate that the balance may not quite be right, and let me be more specific. It is true that end users have a huge role to play in their own security, but we've also learned that many users do not want to become IT and security experts. And it's very challenging if you put too much burden on the end user. And so we have to figure out how to make technology more secure and private by design so there's less burden on the end user to protect themselves.
It's also very interesting in the privacy space. You know, fair information principles have been around since at least 1980 with the OECD guidelines on privacy. And those guidelines really focused on notice and choice, which is you gave users notice about what information you were going to collect and how it was going to be used, and by them reading that notice and accepting the service, they either opted in or could opt out of certain uses. But in this data-rich environment where the web is a mashup of services, putting all that burden on the user is not working well at all.
So you can go to a website, and they'll have a privacy notice, and they may link to many other privacy notices from many of their partners, whether they're ad providers, data analytics, or others. And to expect users to read privacy notice after privacy notice and figure out how they all interrelate before they can engage in web-based activity isn't very practical. And so the regulators in Europe and the U.S. are starting to look at different models where notice and choice and transparency is still important, but certain uses of data should probably be pre-approved and we should be more limited in when we ask the user to make decisions in real time about their network activity.
Obviously, this is an issue that's been discussed this week in Congress. Do you have a solution for this? Well, I don't think we have a solution per se. I mean, we're clearly part of the dialogue.
Some of the approaches that are coming out seem to make more sense. So, for example, the European Union and the FTC have talked about certain expected uses of data. So, for example, if I go to a website to buy a pair of shoes and ask them to mail it to me at my home, should I really have to consent to the use of my address so they can ship the product? I just bought the shoes and I asked them to send it to my house.
Isn't that good enough? The FTC even went so far as to say if you buy a product from a company, it should be expected that you would get mail from them promoting other products. Yes, maybe you may want to opt out of that, but it's not unreasonable for the default state to say, well, we now have a relationship with this vendor. People are engaged in that dialogue.
The other key aspect of the dialogue is about potentially using binding corporate rules and principles of accountability to provide more clarity in this space. So, in the old model, of course, users who complained about misuse of data could complain to regulators who could try and investigate. But that only focuses really on two parties, the end user data subject and the regulator. In a web that's so data rich, it's just not practical for the regulators to investigate every potential incident of data misuse.
And so they've started to talk about having an accountability principle where companies would have to do certain things, train their employees on data usage, have clear statements and the like. And then rather than trying to just look at misuse, you could see whether or not organizations are accountable for implementing the things that they said they were going to implement. So there's a lot of interesting work going on in this space, and we're part of the dialogue, but it's not an easy problem. In your address at the RSA Security Conference a few months back, I was struck by your analogy to smoking cigarettes and cybersecurity.
As you said, most people initially felt it was an individual's choice, knowing the dangers of tobacco to smoke or not to smoke. But when evidence showed that secondhand smoke endangered others, smoking was banned from almost everywhere. Can you explain how that thinking applies to cybersecurity? And does it fit into something that you characterize as collective defense?
It does. So the way it fits into cybersecurity is we have been telling end users for a very long time that they have to engage in certain basic hygiene to remain safe. You should be turning on a firewall. You should be running antivirus, anti-malware products.
You should be patching your systems when the patches come out. And you should be backing up your data in case you have an incident. And we've given users that advice for a very long time, and we know that many users do not follow it. And going back to the smoking analogy, you could say, well, if a user chooses not to patch and chooses not to run anti-malware products, they're putting themselves at risk, but that's their choice.
But what's changed in the environment is that often when consumer machines are compromised by cybercriminals, they are not the only victim. So, yes, they may have a keystroke logger and they may lose their username and password and be subject to identity theft, but that's them accepting risk for themselves. But if their machine becomes part of a botnet, which is basically a number of machines that are controlled by a cybercriminal and then used to attack others, it means that your failure to do basic hygiene didn't just impact you, but now impacted those around you and impacted the ecosystem. So, like smoking, the failure to engage in safe behaviors is no longer just an issue for you.
It's an issue for everyone. And so we started thinking, if that's true, how do we raise the level of security in the ecosystem at large? And we started thinking about what we've done in public health, which is have systems in place so that when bad things are happening, they're identified quickly and can be remediated quickly. And so we have written a paper, which people can find on the Microsoft.com website, about applying public health models to the Internet.
You said that attribution, the ability to identify those who enter computer systems, is one of the biggest challenges we face. What's your assessment of the state of attribution today? And do you expect tools will be in place anytime soon to truly identify those who have entered IT systems denied the person, therefore the connection is denied. Talking to other people, you seem to think that this attribution problem is more complex than you're describing, at least the way I'm interpreting your description.
There's different types of attribution. It is more complex. So, for example, let's be clear, there are many threats to networks, everything from insider threats to remote connections. Today, the web allows a lot of remote and unauthenticated connections.
And as a result, you know, you can read about a lot of cases where unauthorized individuals are getting access to systems and getting access to data. It is not trivial to change that pattern. And even when you do it, even when you say, okay, machines now have to be authenticated and people have to be authenticated, that is great risk management, but it's not risk elimination. If you don't configure the server machines correctly to verify that attribution, it doesn't matter.
Greater attribution is very important because if we can do better attributions of both machines and people, you can manage the risk that unauthorized devices and people are accessing your data or control system. Having said that, it's not a panacea. One of the things we've learned in all sorts of areas is as we build in new protections, cybercriminals will be creative and adaptive. To the extent, for example, you make it harder to remotely access critical systems, criminal organizations may think about planting people in your company with access to your systems or bribing someone or social engineering someone to get out a username and password and other kinds of things.
It's about risk management, not risk elimination. And you have to remember, too, that some of the attacks we've seen, denial of service attacks, are against publicly facing webpages that are available to the public. And in that situation, you don't do strong attribution of machines or people because you don't care. It's accessible to everyone.
So as I said, it's not a panacea, but I think it's an important step in reducing risk. One final question in the subject area, but we're marking the second anniversary of President Obama's address in which he outlined the cybersecurity policy. But it wasn't until the past few months or weeks that we started seeing, at least publicly, the fruits of the policy. You mentioned the National Strategic Trust of Identities of Cyberspace Initiative, NSTIC, as well, but there's also been the comprehensive cybersecurity legislative package and international cyber policy.
Are you satisfied on how the Obama administration has approached cybersecurity and what do you think of those initiatives? The short answer is yes. There is some sense of urgency and you always want people to move as quickly as they can. Having said that, there are certain thematic points in their legislative strategy, in their NSTIC proposal, and their international strategy that are, I think, important to the future growth of the Internet.
The things I would highlight most is that the Obama administration is really taking a risk-based approach to security and they're really focused on outcomes. There have been in the past legislative proposals and others to deal with parts of the security problem, but not holistically. So, for example, an early version of the Lieberman-Collins bill, it's just been amended, but an early version focused on reducing vulnerabilities and while reducing vulnerabilities is very important, it's necessary but not sufficient because not all successful attacks exploit vulnerabilities. They exploit operational failures or engage in social engineering.
The approach the administration is taking is really about managing risk effectively and also focusing on outcomes. That is, are we getting better security as opposed to a checklist-like approach that says, here are the six or seven things you should do? Because the problem with identifying those six or seven things people should do is everyone will go do them and they may be able to check the box, but that doesn't mean you've really reduced the risk overall. That's been one of the complaints about Bismarck compliance, of course.
So I think philosophically, the government has done a good job on focusing on what's important. And I'd say the same thing about the international strategy, which is it's really focused on ensuring that there is adequate government-industry partnership in implementing the strategy. It recognizes the need for global interoperable standards, which is important. The challenge, of course, in the international strategy is implementation is hard in the international context because there are a lot of hard sovereign issues that are just hard to solve.
Thanks, Scott. Thank you. All right, this is Scott Charney, Microsoft Corporate Vice President for Trustworthy Computing, Engineering Excellence, and Environmental Sustainability for GovInfoSecurity.com and Information Security Media Group. I'm Eric Chabro.
Thanks for listening.