Feeds

Microsoft's crucial new hire

Incoming Security Czar will make or break credibility

  • alert
  • submit to reddit

Choosing a cloud hosting partner with confidence

Bill Gates' recent

company-wide memo

outlining Microsoft's vision for Trustworthy Computing has generated lots of attention, both good and bad.



To some, it is more Microsoft rhetoric wrapped inside a public relations campaign designed to postpone accountability for producing secure products until they can get .NET out the door. For others, they see it as a long awaited public asseveration that Microsoft has finally put security above all else, and that they are embracing the responsibility of securing today's (and tomorrow's) Internet.

It should come as no surprise to you that I number myself among the latter group.

I can't help but notice that when Bill Gates makes a decree that speaks directly to securing his products, people consider it nothing but PR. But when Larry Ellison embarks on a blatant PR campaign of misinformation, people say he is raising the bar for security. Go figure.

Regardless, the memo comes at a good time. As the sun sets on Howard Schmidt's days as Microsoft's chief security officer, and he prepares for his new role as the number two man at the United States' Critical Infrastructure Protection Board, Microsoft CTO Craig Mundie is already looping in key Microsoft employees in his search for a replacement. Word on the street is that Mundue may even create additional positions in order for Microsoft to fully leverage the opportunity they have at this pivotal time in the company's history.

Schmidt's egress is fortuitous. Though he was instrumental in the formation of Microsoft's "trustworthy computing initiative," and the accompanying powerhouse team of security experts -- including people like Eric Schultze, David LeBlanc, and Jesper Johansson -- he was not exactly a Braveheart when it came to firing up the troops for battle.

And that is just what Microsoft needs.

I have long said that in order for Microsoft to truly change the way its products are produced, it would take mandate from the top. Individual groups and departments, no matter how separately committed they are, can't impact the direction of the company if the corporate executives are not doing the steering.

This is the perfect occasion for Microsoft to illustrate their commitment to security and to solidify their new priorities of security before functionality. Gates flat-out said that the entire company must put security first, and there is no way for him to back out of it now.

Microsoft has spoken much of security lately, and has rolled out programs like the CTI and the Strategic Technology Protection Program. Brian Valentine has also promised a complete code-level review as the basis for Win2k's Service Pack 3. Now they need to get someone in as chief security officer who can act as a catalyst to bring the fragments of the company together into a unified force to finally take security as seriously as they need to.

Of course, even with management reforms, Microsoft still has a challenge ahead in putting the "Trustworthy" into "Trustworthy Computing."

If every programmer on staff were to build security directly into the development model and the company was to produce a robust and secure platform in .NET, Microsoft's new chief security officer will still have the job of earning the world's trust and getting the public to buy into the concept. Frankly, I don't know which job will be harder.

I was thinking about making some predictions on who they might seek out in order to fill this crucial position, but I'm having a hard time coming up with any viable candidates. This person is going to be in the capacity of literally changing the face of global security, and will have a massive responsibility on their shoulders.

It can't really be someone from the inside, as logic would dictate that it was the current management that got them into trouble in the first place. It's got to be someone who has the intelligence to see what the right thing to do is, and who has the confidence to get it done.

In some bizarre world in a parallel universe, I actually see someone like Bruce Schneier in that position. Someone in his capacity could make a world of difference -- someone who would fight for security instead of playing the cover-your-rear game all day. You know, someone who would stand up for what they thought was right and not be intimidated by Bill.

I don't know who it will end up being; I just hope that Bill and Steve, along with Craig and the rest of the big-wigs at Microsoft, see this as the critical decision that it is. We are all watching, and this will tell us exactly how serious Microsoft is about our security. I hope they get it right.

© 2001 SecurityFocus.com, all rights reserved.

Timothy Mullen is CIO and Chief Software Architect for AnchorIS.Com, a developer of secure, enterprise-based accounting software.

Related Stories

MS' highest priority must be security - Billg
MS security memo a mere gesture

Secure remote control for conventional and virtual desktops

More from The Register

next story
Netscape Navigator - the browser that started it all - turns 20
It was 20 years ago today, Marc Andreeesen taught the band to play
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Sign off my IT project or I’ll PHONE your MUM
Honestly, it’s a piece of piss
Return of the Jedi – Apache reclaims web server crown
.london, .hamburg and .公司 - that's .com in Chinese - storm the web server charts
Chrome 38's new HTML tag support makes fatties FIT and SKINNIER
First browser to protect networks' bandwith using official spec
Admins! Never mind POODLE, there're NEW OpenSSL bugs to splat
Four new patches for open-source crypto libraries
Torvalds CONFESSES: 'I'm pretty good at alienating devs'
Admits to 'a metric ****load' of mistakes during work with Linux collaborators
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.