Defeating a web site attack by spending a few hours patching and testing may give you the feeling of winning—but only until you stop and think of how many such grueling exercises youve been through and how many more you will have to endure.
Is there a way to end this cycle of futility? That is the question facing enterprise sites running Microsofts Web software. The Microsoft-Intel platform is attractively priced compared with many competitors platforms, but return on investment is not a one-day—or even a 90-day—affair. Upkeep costs can accumulate to daunting levels.
IT buyers deserve better than recurrent déjà vu. Consider a Microsoft announcement of forthcoming product features to “make complex security issues easier for users to understand, while giving network administrators better management tools to control security policy within their company.” That language comes from June 1997 and describes Internet Explorer 4.0. But do enterprise IT users understand security issues today? Do system administrators feel theyre in control at the level of policies, rather than patches? Its been four years.
Where would we be if, at any time during this period, Microsoft had rebuilt IIS along the lines of “trusted system” products such as Entercept Web Server Edition, which protects even if intruders gain system-level access to the machine? When eWeek Labs examined six ways of fortifying IIS, as reported in this weeks story on Page 61, our analysts found that any of several approaches could have blocked the Net-wide plagues of Code Red, Code Red II and Nimda.
Entercept demonstrates that an e-business platform can confine would-be attackers without straitjacketing ITs owners. Protection, flexibility and manageability are not mutually exclusive. The fact is, a safer IIS has long been feasible.
When a brick-and-mortar store undergoes remodeling, the proprietors ask customers to “Pardon our dust” so the improved facility can meet future needs for years. E-business builders need to do likewise—because years, rather than months or weeks, have become the proper time scale for making e-biz decisions.
A Web site can go dark on a preannounced date, giving its operators the chance they need to make it safe for—yes, we mean it—years—or that site can embroil its owners, sooner or later, in an embarrassing security breach when the patch du jour arrives too late.
Rather than sending out patch after patch, Microsoft must pay the price to make its Web platform secure—or users are justified in the time and trouble of switching—a small price to pay when the security of their e-business is on the line.