Jesper's Blog https://docs.microsoft.com/archive/blogs/jesper_johansson/feed.xml Obligatory file photo: I am a Senior Security Strategist in the Security Technology Unit at Microsoft. My job is to explain to our customers how to run Microsoft products securely, and to the extent that it is needed, help the product groups figu Wed, 17 Apr 2019 03:33:58 GMT en-US hourly 1 Last Post https://docs.microsoft.com/archive/blogs/jesper_johansson/last-post Thu, 31 Aug 2006 21:51:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/08/31/last-post/ Today was my last "normal" day at Microsoft. (That's with a grain of salt - an exceptional company has few normal days). Tomorrow I just have the exit interview early and then I will be unemployed for a few days. I wonder when I am officially not an employee any more?

In case you had not seen it, I got a new blog a while ago. The plan is to continue what I have been doing on this one over there. Right now, there are only a few posts in it, but that will change soon.

Leaving Microsoft, and particularly the great people I have worked with here will be hard. These have been great years and the company has made huge strides. I am really looking forward to Windows Vista. There are so many important behind-the-scenes security features and the changes to the development process are unlike anything the software industry has ever done; certainly unlike anything Microsoft was doing when I started.

Go forth and do good, and I will see you on the new blog, and maybe at some event in the future.

Thanks!

]]> Yet another change of plan - TechEd Japan https://docs.microsoft.com/archive/blogs/jesper_johansson/yet-another-change-of-plan-teched-japan Wed, 16 Aug 2006 14:02:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/08/16/yet-another-change-of-plan-teched-japan/ Today the plans for what I am doing before I leave changed, again, but not as drastically as last time. It turns out that I am going to TechEd Japan after all. I will be delivering the "Is That App Really Safe" and "Baking Security Into The Development Lifecycle" presentations.

I am really looking forward to getting to do one last event as a Microsoft employee. Let's make sure this is a good one!

]]> I Got A New Blog! https://docs.microsoft.com/archive/blogs/jesper_johansson/i-got-a-new-blog Sun, 13 Aug 2006 01:41:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/08/13/i-got-a-new-blog/ Some of Microsoft's amazing Most Valuable Professionals (MVP) made me a blog on a new site they call msinfluentials.com. I can't thank Susan, Nick, Vlad, Chad, and Wayne enough. You guys are truly special and exemplify all the best things about the MVP program.

Until I leave Microsoft on September 1 content generation on the new blog will probably be a bit light, and I have not quite finished configuring everything yet. You can still contact me through that blog though, now and after I leave, and I will write there as circumstances allow.

]]> Yes, it is unfortunately true https://docs.microsoft.com/archive/blogs/jesper_johansson/yes-it-is-unfortunately-true Sat, 12 Aug 2006 21:08:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/08/12/yes-it-is-unfortunately-true/ I have unfortunately been prevented from speaking at TechEd in New Zealand, Australia, and Japan; the final events I was planning to speak at before I leave Microsoft on September 1. I cannot express how terrible I feel about this. The hope was that these events were supposed to be an opportunity to celebrate the past and the future before I move on. The only thing I can say is that I hope to see everyone at some other event in the future.

Sorry.

]]> Intel Centrino Driver Vulnerability https://docs.microsoft.com/archive/blogs/jesper_johansson/intel-centrino-driver-vulnerability Fri, 04 Aug 2006 14:41:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/08/04/intel-centrino-driver-vulnerability/ Last week a new security problem was announced in the Intel Centrino wireless drivers. It appears to affect the 2200BG and 2915ABG wireless hardware. These are extremely common components that are shipped in many laptops. You would do well to check whether yours or the ones you support have this hardware. The easiest way to check is to double-click the wireless icon in the system tray and then click Properties.

There is information on the web site for how to identify the drivers as well. Systems with these drivers would have entries under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ with the name of the driver. That could be used to search large numbers of systems.

Updated drivers are available from the Intel page that announces the problem: https://support.intel.com/support/wireless/wlan/sb/CS-023065.htm.

]]> Free Windows Software https://docs.microsoft.com/archive/blogs/jesper_johansson/free-windows-software Fri, 04 Aug 2006 14:12:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/08/04/free-windows-software/ Blake Handler sent me a link to his blog post about free Windows software a couple of days ago. It is a very cool list that shows a lot of free things published by Microsoft. Check it out at: https://bhandler.spaces.live.com/blog/cns!70F64BC910C9F7F3!1231.entry?_c=BlogPart.

Note that for some reason the Live blogs put you at the bottom of the post instead of the top when you click it. Scroll to the top to see the list.

]]> All good things must come to an end https://docs.microsoft.com/archive/blogs/jesper_johansson/all-good-things-must-come-to-an-end Fri, 28 Jul 2006 23:32:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/07/28/all-good-things-must-come-to-an-end/ This is an excerpt from a mail I sent out internally today:

The sands of time seem finally to have run their course. On September 1 I will not only celebrate the 5-year anniversary of my time here at Microsoft but also my departure from the company. On September 5 I start a new job as Principal Security Program Manager at Amazon.com.

This was a very difficult decision for me and has taken a long time to make. All in all, I have had a great five years to look back at. So much has changed in security at the company since I came here. It has been a remarkable ride to see the turn-around and having been able to play part of if for this long. The hardest part of this transition will be not being part of this ride any longer and not being able to work with all the great people I have worked with here.

I will not be leaving Seattle, nor security. I will have a new blog by the time I leave. The exact location will be announced in here as well as on the Protect Your Windows Network site: https://www.protectyourwindowsnetwork.com once I get it set up.

]]> How LMCompatibilityLevel really works https://docs.microsoft.com/archive/blogs/jesper_johansson/how-lmcompatibilitylevel-really-works Wed, 26 Jul 2006 22:14:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/07/26/how-lmcompatibilitylevel-really-works/ A while ago I once again got frustrated by LMCompatibilityLevel and the amount of confusion that is out there about it. There was also an intriguing thing in the SAMBA documentation that they (incorrectly) called "NTLM2 Session Response" that needed figured out. The results are in the latest issue of TechNet Magazine.

One additional thing deserves mention. Roger Grimes contacted me after he saw the article and asked why the Cain tool shows an MD4 hash and an NT hash, when I claim the NT hash is actually an MD4 hash. He then proceeded to answer his own question because I couldn't think of why. What Cain calls an MD4 hash appears to be an MD4 hash of the entire string, including the NULL terminator. The NT hash that is used in Windows is, as I mention somewhat obscurely in the article, a hash of the Unicode password string (in fact, it is even called the UnicodePwd in Active Directory, as I pointed out in the book among other places), but it does not include the NULL terminator. It just never occurred to me that Cain might display an MD4 hash that does. Thanks Roger for figuring that out.

]]> Required Attributes of Security Solutions https://docs.microsoft.com/archive/blogs/jesper_johansson/required-attributes-of-security-solutions Wed, 19 Jul 2006 18:00:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/07/19/required-attributes-of-security-solutions/ I've been trying to come up with a list of attributes that a security solution needs to have to be complete and sufficient. The idea is to develop a set of attributes that can be used when analyzing security to see if it fulfills the needs of the situation. Obviously, risk management is the most important aspect of security analysis, but if we can distil a complex design into a small set of attributes that appropriate solutions generally would have then we could use that to analyze how good our solution is. This would be helpful when analyzing security solutions, be they security features in an operating system, an architectural design of a network, a physical security infrastructure, or any other type of security solution. The attributes also need to be a parsimonious set. Attributes of a solution need to be less complicated than the solution itself to be useful for analysis, otherwise why abstract the solution into its attributes?

I wrote these down a while ago and have been hoping I could refine them by doing what I always do - mull them over mentally for a while. However, I can't seem to come up with anything better, so I thought I would open up the thinking to the community and see if anyone else has any better ideas.

  1. Comprehensive - The solution needs to cover the security issues it purports to resolve. It does not need to cover all security problems, but in conjunction with all the other solutions it should contribute to solving the problem. If the solution leaves holes uncovered something else must be available to address those holes.
  2. Comprehensible - The person intended to use the feature or implement the solution should be able to understand how it works, how to implement it, and how to address common problems.
  3. Adaptable - The solution should be flexible enough to work in several environments with differing risk management strategies. A solution that is not appropriate for all environments should not be mandated for all environments. It should be adaptable for each environment.
  4. Centrally manageable - A solution should be manageable centrally. Essentially, all configuration, enforcement, and reporting, should be centralizable.
  5. Enforceable - A solution must be enforceable. A solution that can be turned off or disabled by those who should be protected by or against is unacceptable. If a solution is accidentally disabled in violation of a policy it needs to be turned back on automatically.
  6. Reportable - It should be possible to generate compliance reports about all aspects of a solution. At a minimum reports should contain the status of the solution in all places where it should be applied. Variance reports, showing out of compliance areas, are also important.
]]> Microsoft Purchases Winternals https://docs.microsoft.com/archive/blogs/jesper_johansson/microsoft-purchases-winternals Tue, 18 Jul 2006 13:17:00 GMT https://blogs.technet.microsoft.com/jesper_johansson/2006/07/18/microsoft-purchases-winternals/ In a very interesting twist Microsoft today announced the acquisition of Winternals and Sysinternals. This is really interesting news and I am glad to see Mark Russinovich and Bryce Cogswell getting to have more of an impact on the Windows product.

]]>