To: kemble s. matter who wrote (172837 ) 5/27/2003 8:34:47 PM From: William F. Wager, Jr. Respond to of 176387 Dell To Sell PCs With Windows Made More Secure By RIVA RICHMOND Of DOW JONES NEWSWIRES NEW YORK -- Dell Computer Corp. (DELL) is preparing to sell PCs with Microsoft Corp.'s (MSFT) operating system in a mode that will provide more security to users. At a workshop on technologies for protecting personal information hosted by the Federal Trade Commission on May 14, a Dell official said the company would begin offering customers the option of ordering PCs with Windows 2000 - a version of Microsoft's operating system used mainly by corporations - configured to settings recommended by the Center for Internet Security. "We expect to offer a more secure configuration option later this year," Dell spokesman Dean Kline confirmed. "A number of customers, particularly in government, education and health care, are interested in an option that meets CIS benchmarks." CIS is a Hershey, Pa.-based nonprofit association of public- and private-sector technology users. The move could prove a boon to customers, who are challenged by the complexities of keeping labyrinthine computer systems safe from damaging hacker attacks and computer viruses. Security experts say many attacks succeed because computer systems are misconfigured or configured imprudently. The difficulty of the task, even for large corporations, means technology companies need to make security easier to accomplish, they say. Dell's move echoes Microsoft's own effort to improve product security through safer configurations, which it dubs "secure by default." This key objective of the software giant's broader "Trustworthy Computing" initiative calls for delivering new products with more secure default settings at installation, with recent efforts focused on the new Windows 2003 Server product. For example, Microsoft has turned off less widely used features to reduce the "surface area" for attacks that exploit programming flaws. In widely used older programs like Windows 2000, Microsoft has sought to tackle the same issues by providing written guidelines on product settings for users. On its Web site for technology professionals, TechNet, Microsoft provides a guide for "hardening" Windows 2000 and a number of other products. Microsoft's guides still require customers to do all the work, though. Dell is proposing to take some of this burden off the customer. "The better path is to have the technology fix baked into the products and services that they use," said Toby Levin, an FTC attorney involved in the May 14 workshop. Software makers and computer manufacturers "have been delivering systems to users with all of the security settings turned off," said CIS President and Chief Executive Clint Kreitner. "It's like having the seatbelts and the antilock breaks in the trunk and you have to install them." Dell is a big win for CIS. The group, whose members include companies like Visa and government agencies like the Department of Defense and the National Security Agency, has been trying to get technology companies to use the practical and detailed security standards it has established for a number of technology products. "Dell is at the head of the pack," Kreitner said. "Hopefully other vendors will follow Dell's example." According to an NSA study published in fall 2002, 95.5% of known vulnerabilities in Windows 2000 Professional edition were eliminated by using CIS's security settings for the product, which included installing Microsoft's free service pack three update and its cumulative patches for Windows Explorer and Media Player. Recommendations also include things like turning off features that aren't being used and setting passwords that can't be guessed easily. Microsoft, which works cooperatively with CIS, supports the group's efforts, said Jeff Jones, senior director of marketing for its Security Business Unit. However, he called the company's own hardening guide more up-to-date and better suited for the broad array of customers. The CIS benchmarks, having been influenced by the needs of agencies like the NSA, recommends settings that may be overly conservative for some businesses, he said. Jones said Microsoft hasn't been working with Dell on the PC makers' plan to deliver machines with more secure Windows 2000 default settings. -Riva Richmond, Dow Jones Newswires; 201-938-5670; riva.richmond@dowjones.com Updated May 27, 2003 6:23 p.m.