Hello All,
Here's an interesting scenario for you security buffs out there - I've been 
approached to think about the issues and return with some verdicts and would 
appreciate some intelligent ideas I'm sure you can conjure up...
Company A has its software installed on lots of customer Windows machines 
around the world. The software has effectively got 'root' access on the 
machine, and talks regularly to a central server to gain upgrades etc. If the 
software is tampered with, the computers could well cause disruption.
[ Yes, really bad idea. Microsoft should indeed be shot for allowing it. ]
The upgrades can be 'pushed' out at will to a subset of customers, or to all. 
The software, having full Administrator access, needs to be careful.
Or, more to the point, the procedure for releasing upgrades and changes to the 
software needs to be highly secure.
One idea that was my initial on the subject is as follows:
Six 'trusted' employees, six 'secure' servers. Employees are minor 
shareholders in the company. For an upgrade to be pushed out, a majority of 
the trusted employees must submit the same upgrade package to a majority of 
the servers, and the servers between them must agree that the upgrade is 
verified as coming from the claimed sources. Combined, they should check out. 
If any one employee, or one machine, were to raise a black flag, the process 
is aborted. In the event that a bad upgrade is indeed rolled out any two 
employees can activate a rollback procedure (which I can't think of 
procedurally right now).
Normally I would of course be thinking in terms of specialised identity and 
verificaton equipment, but Company A doesn't exactly have the resources of 
the CIA or NSA, so remote servers and a chain of trust is the closest they 
can get.
PGP keys all round I suspect.
A nightmare to secure, and is still open to attack, both internally and 
externally, however thats how I see it. I warn that I got almost three hours 
sleep last night due to "server issues" so if I make no sense thats probably 
why.
Comments/suggestions on completely different ideas/etc most welcomed. I don't 
have experience in this field.
Thanks all,
James