I think that laying the blame at the feet of Microsoft is short sighted. Could their products be better - absolutely. Is it realistic to expect perfection - absolutely.

In simplistic terms, If 99% goodness costs $X, then 99.9% costs 10X, and 99.99% costs more than 100x and so forth.

So the question becomes, how much to you want to pay, and how long are you prepared to wait???

(Don't get me wrong, buffer overflow situations are simply a case of bad workmanship!)

My original exposure to real time processing was when I worked for the phone company. I provided 3rd level support for telephone switching systems. Systems that had an unbelievable amount of money sunk into code development. Where they perfect - no way! But, we had audits! An audit was a piece of software that would attempt to recover things when an inconsistancy was found. They came in all shapes and sizes, the one's you hoped never to see were the ones that would tie up the switch for many minutes..

I suspect that SQL server has more lines of code that were in that Switch.

The audits provided defense in depth! We know we are not perfect, so what can we do to limit the damage when something goes wrong. Interestingly enough, the cost of such an approach tends to be far more linear than trying to prevent all problems in the first place.

Defense in depth, hardened systems (all unused services turned off), Firewalls, Boundary Routers, NAT (where appropiate), keeping patch levels up to date etc etc etc...

I wonder if much of the outrage at the shortcoming within SLAMMER is an attempt to deflect the question of why SQL servers were visible to the internet on that particular port... Can someone enlighten me ??

These comnments are mine and mine alone...

Villy

[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/141/18092#18092