Microsoft Staffers Debate "Worst Jobs In Science" Nomination

Working in the Microsoft Security Response Centre (MSRC) has been voted number six out of the ten worst jobs in science in 2007, however Microsoft staffers reckon there is nowhere else they can find an opportunity like the ones they meet every day.

Analysts also believe the hard work done in the MSRC is starting to pay off, and agree that the ranking is a hangover of past product vulnerabilities.

This month, US-based Popular Science magazine listed its annual top ten "Worst Jobs in Science" awards, with work in the MSRC pipping professions such as whale-faeces researcher, forensic entomologist, Olympic drug tester, gravity research subject for the middle-of-the-road ranking.

The top five professions as nominated by Popular Science magazine were coursework carcass preparer, the humble garbologist, an elephant vasectomist, oceanographer and finally hazmat diver.

The article said working as a Microsoft Security Grunt was "like wearing a big sign that reads 'Hack Me'" and called the work manning the secure@microsoft.com as tedious.

But work at the MSRC, however "tedious" it may already be, could be making practical advances in Microsoft's operating system security.

According to the recent Microsoft Security Intelligence Report, new vulnerability disclosures increased 41 percent in 2006.

In a blog post dated June 15, 2007, published on IDG's US CSO online Web site, Microsoft's Trustworthy Computing Group Security Strategy Director, Jeff Jones, perfomed an anlaysis on Windows Vista vulnerabilities since the six-month launch of the operating system, saying "it does seem like there are more researchers, better trained and with better tools and techniques than ever before ... creating an ecosystem better able to find and disclose security vulnerabilities".

A link to the blog and vulnerability report is available here

Jones added that during the first six months Windows Vista was available, Microsoft released four security bulletins and relevant updates addressing a total of 12 vulnerabilities affecting Windows Vista.

In the first six months of Windows XP's availability, according to Jones, Microsoft fixed a total of 36 vulnerabilities in the first six months (including three vulnerabilities in Internet Explorer disclosed and fixed three weeks prior).

23 of the Windows XP vulnerabilities were rated high by the US National Institute of Standards (NIST) in the National Vulnerability Database (NVD).

The study also compared vulnerabilities released in Red Hat Enterprise Linux 4 Workstation, Ubunutu 6.06 and Novell SUSE Linux Enterprise Desktop.

Page Break

"Windows Vista seems to have a better initial six months, with one-third as many vulnerabilities fixed and with Windows Vista having only one high severity issue outstanding at the end of the six-month period."

Windows XP was found to have two publicly disclosed vulnerabilities rated high in severity by NIST and one rated low six months after the product was released.

So does this mean that the work in Microsoft's Security Response Centre is paying off, and does the lower level of vulnerabilities mean Microsoft security researchers deserve the bum rap or even the accolade as number six in the top ten worst science jobs of 2007?

Not so, according to James Turner, IT industry analyst with local analyst firm IBRS.

Turner said in times past working in the Microsoft Security Response Centre would have been a nightmare but owing to a commitment to security over the last few years the only bad thing about the job is the long memory of Microsoft product users.

"While Jones's review of Vista does put security in that operating system in a favourable light we (IBRS) are still not advising enterprise firms on adopting Vista on the corporate level until SP1 for Vista comes out at least," Turner said.

"But the Microsoft Security Response Centre being one of the top ten worst science jobs in 2007, I don't know, a big thinker or security researcher is going to say: Bring it on — and the bigger the challenge is the faster they will run at it.

"Windows Vista SP1 (2008) will turn out to be a milestone of a turning point and I know in terms of security and security research that this is one of the best times to be working there."

Mark Griesi, security program manager at the Microsoft Security Response Centre does not consider he has one of the science world's ten worst jobs in 2007. Griesi said the job is tough, but also has its rewards.

"Only in the MSRC do you come to work knowing that what you did today can help protect hundreds of millions of people around the world from malicious attackers," Griesi said.

"I would definitely say a job in the Microsoft Security Response Centre is one of the toughest but most rewarding jobs to have. It gives me the opportunity to work with some of the most dedicated and brightest people in the security industry.

"Where else can you find an opportunity like that?"