Posted
27th September 2001
Abandon Microsoft's IIS?
by David Coursey, Executive Editor,
AnchorDesk, Intro by Alan Marston
Intro
To live in hope of a virus/worm/cracker free world is
to live in a fools paradise, a place of real danger.
One has to accept the world as it is before stepping
out into it. The article below is starting to talk seriously
about the implications of size and power, a large shadow,
which attracts people who live in the dark. Microsoft
is huge and seemingly all powerful, seemingly. In reality
living with MS has its costs and dangers, and though
a move is always stressful, sometimes it is necessary.
IIS (Internet Information Server, Microsoft's webserver
software) has been chronically plagued by hackers, with
last week's attack by the Nimda virus/worm just the
latest example. Yes, Microsoft does put out fixes, and
if you stay current with them, you can avoid many troubles.
But this takes time and energy. Some corporate IS types
say they have better things to do than worry about who's
hacking their Web servers. And Gartner, a research and
advisory firm, agrees with them.
I
see three ways of looking at this, and I will warn you
up front that each may be equally valid. Some solutions
are more viable to apply, depending on the circumstances.
1.
Just do it. There are good reasons to dump IIS. Suppose
you get the most current patches and miss the bullet
this time? You can be certain that if you let your guard
down the next time--and there will be a next time--you
could be in trouble. So if people want to heed Gartner's
advice, it's certainly understandable. Of course, switching
to a different solution is expensive, and there may
be things that are important to you that just don't
move easily (or at all).
Want
to open your Exchange mailbox and calendar from the
Web? Like those Active Server Web pages you've created?
Want to run SharePoint as a collaboration server? All
these and a number of other Microsoft technologies are
IIS-dependent. That speaks well for opening these standards,
but it won't help right now. One fairly open IIS technology
is the extensions for FrontPage-based Web sites. For
example, I have an Apache server running atop Linux
that works with FrontPage quite nicely.
My
mail server is on a similar machine, and while I miss
the shared calendar that Exchange provides, I have learned
to live without it. But there is a downside, at least
in the broad view: Dumping IIS makes the people who
created these worms very happy. This is what they want
you to do. Then they can go on to another Microsoft
product and try to make you dump that, too.
2.
Stop whining: The real problem is sloppy sysadmins.
This is the school of thought that says keeping up with
patches is just part of the job. And if you stay current,
your potential losses are limited. Most of the people
who think this are, presumably, not sloppy system administrators.
But they make the point that you can protect yourself
and go about life fairly normally without letting the
cyber terrorists decide your strategy for you. There
are people who say the real problem is Microsoft's code.
They say Microsoft could solve these problems if it
wanted to.
I
am not really qualified to judge the quality of Microsoft's
code, so I don't know how much of this Microsoft brings
upon itself through sloppy coding, vs. how much is simply
a reflection of the number of enemies Microsoft has
and how much their combined effort is directed at the
company. Some analysts say MS code isn't worse that
anyone else's and I tend to agree, but I can't comment
from experience. If the bad guys wanted to kill Apache
as much as they want to do in Microsoft, I suspect Gartner
would be telling people to abandon it, too.
3. My, what a great day to be outsourcing! Let someone
else worry about security for all of us. This is actually
my favorite of the three options, because it leaves
the problems, presumably, to the experts and lets the
rest of us get on with life. This doesn't mean Web service
providers won't have trouble, but it means they are
the ones who get fired for them and not you, dear reader.
Seriously,
this isn't a panacea. There isn't one here. A mass migration
off IIS is more than many companies can bear--even if
they want to do it. Microsoft is working to plug the
leaks in IIS, but a determined assailant can still find
more. Microsoft does, however, react quite quickly.
Hackers seem to be a permanent issue, especially for
Microsoft customers. So the ultimate questions may be:
How much protection is reasonable? ......