Microsoft Internet Information server
As you learned in Chapter 3, Internet Information Server (IIS) is Microsoft’s Web server software. Microsoft supplies IIS with the versions of its Windows server operating systems that are suitable for use in operating electronic commerce web sites.
In august 2001, Microsoft faced an uncomfortable situation that many U.S. manufacturing companies have experienced with recalled, defective products. Microsoft executives stood by at a news conference while a U.S. government official announced to reporters that there was a serious flaw in a Microsoft product. The director of the FBI’s National Infrastructure Protection Center was warning reporters that the Code Red worm, which was spreading through the internet fr the third time in as many weeks, was a serious threat to the continued operation of the internet.
The code red worm exploits a vulnerability in the Microsoft IIS Web server software. When the worm was first identified, Microsoft quickly made a patch available on its Web site. Microsoft also announced that Web server installations that had kept current with all of the updates and patches that Microsoft had issued would not be subject to attack by the worm.
Many Microsoft customers were outraged by these statements, noting that Microsoft has issued more than 40 software patches in the first half of 2001 and 100 or more patches in each of several prior years. IIS users complained that keepimg the software current was virtually impossible and called for Microsoft to deliver software that was more secure when first installed.
Many IIS users began to consider switching to other Web server software. Gartner, Inc., a majot IT consulting firm, recommended to its clients that they seriously consider alternatives to IIS for their critical Web server installations. Many industry observers and software engineers agree that Microsoft was a victim of its own success. It had created a very popular and complex piece of software. It is extremely difficult to ensure that no bugs exist in complex software products, and the popularity of the software made it an attractive target for crackers-one worm could bring down many of the servers operating on the internet. These two factors, plus the likelihood that many IIS severs would not have all of the available security upgrades installed, combined to make it an irresistible target for a worm creator.
Microsoft has struggled to gain the confidence of large corporate IT departments. The company has worked hard to convince users that its operating system software is reliable and trustworthy. For example, when Microsoft introduced version 7 of IIS in 2008, it announced that its architecture had been changed so that users could install only the modules they needed to reduce to software’s “attack surface.”
The code Red worm attack on its Web server software was a major setback in its reputation-building effort. Since that attack, a number of security weaknesses have been identified in IIS and Patched by Microsoft. The news reports that inevitably accompany these patches have created a continuing public relations issue for the company. You can review the Microsoft Safety & Security Center through the Web Links to see how Microsoft deals with ongoing concerns that its software us secure in the face of attacks that are both regular and frequent.