Feeds

Microsoft's crucial new hire

Incoming Security Czar will make or break credibility

  • alert
  • submit to reddit

High performance access to file storage

Bill Gates' recent

company-wide memo

outlining Microsoft's vision for Trustworthy Computing has generated lots of attention, both good and bad.



To some, it is more Microsoft rhetoric wrapped inside a public relations campaign designed to postpone accountability for producing secure products until they can get .NET out the door. For others, they see it as a long awaited public asseveration that Microsoft has finally put security above all else, and that they are embracing the responsibility of securing today's (and tomorrow's) Internet.

It should come as no surprise to you that I number myself among the latter group.

I can't help but notice that when Bill Gates makes a decree that speaks directly to securing his products, people consider it nothing but PR. But when Larry Ellison embarks on a blatant PR campaign of misinformation, people say he is raising the bar for security. Go figure.

Regardless, the memo comes at a good time. As the sun sets on Howard Schmidt's days as Microsoft's chief security officer, and he prepares for his new role as the number two man at the United States' Critical Infrastructure Protection Board, Microsoft CTO Craig Mundie is already looping in key Microsoft employees in his search for a replacement. Word on the street is that Mundue may even create additional positions in order for Microsoft to fully leverage the opportunity they have at this pivotal time in the company's history.

Schmidt's egress is fortuitous. Though he was instrumental in the formation of Microsoft's "trustworthy computing initiative," and the accompanying powerhouse team of security experts -- including people like Eric Schultze, David LeBlanc, and Jesper Johansson -- he was not exactly a Braveheart when it came to firing up the troops for battle.

And that is just what Microsoft needs.

I have long said that in order for Microsoft to truly change the way its products are produced, it would take mandate from the top. Individual groups and departments, no matter how separately committed they are, can't impact the direction of the company if the corporate executives are not doing the steering.

This is the perfect occasion for Microsoft to illustrate their commitment to security and to solidify their new priorities of security before functionality. Gates flat-out said that the entire company must put security first, and there is no way for him to back out of it now.

Microsoft has spoken much of security lately, and has rolled out programs like the CTI and the Strategic Technology Protection Program. Brian Valentine has also promised a complete code-level review as the basis for Win2k's Service Pack 3. Now they need to get someone in as chief security officer who can act as a catalyst to bring the fragments of the company together into a unified force to finally take security as seriously as they need to.

Of course, even with management reforms, Microsoft still has a challenge ahead in putting the "Trustworthy" into "Trustworthy Computing."

If every programmer on staff were to build security directly into the development model and the company was to produce a robust and secure platform in .NET, Microsoft's new chief security officer will still have the job of earning the world's trust and getting the public to buy into the concept. Frankly, I don't know which job will be harder.

I was thinking about making some predictions on who they might seek out in order to fill this crucial position, but I'm having a hard time coming up with any viable candidates. This person is going to be in the capacity of literally changing the face of global security, and will have a massive responsibility on their shoulders.

It can't really be someone from the inside, as logic would dictate that it was the current management that got them into trouble in the first place. It's got to be someone who has the intelligence to see what the right thing to do is, and who has the confidence to get it done.

In some bizarre world in a parallel universe, I actually see someone like Bruce Schneier in that position. Someone in his capacity could make a world of difference -- someone who would fight for security instead of playing the cover-your-rear game all day. You know, someone who would stand up for what they thought was right and not be intimidated by Bill.

I don't know who it will end up being; I just hope that Bill and Steve, along with Craig and the rest of the big-wigs at Microsoft, see this as the critical decision that it is. We are all watching, and this will tell us exactly how serious Microsoft is about our security. I hope they get it right.

© 2001 SecurityFocus.com, all rights reserved.

Timothy Mullen is CIO and Chief Software Architect for AnchorIS.Com, a developer of secure, enterprise-based accounting software.

Related Stories

MS' highest priority must be security - Billg
MS security memo a mere gesture

Combat fraud and increase customer satisfaction

More from The Register

next story
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Oh no, Joe: WinPhone users already griping over 8.1 mega-update
Hang on. Which bit of Developer Preview don't you understand?
Microsoft lobs pre-release Windows Phone 8.1 at devs who dare
App makers can load it before anyone else, but if they do they're stuck with it
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Internet-of-stuff startup dumps NoSQL for ... SQL?
NoSQL taste great at first but lacks proper nutrients, says startup cloud whiz
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
New Facebook phone app allows you to stalk your mates
Nearby Friends feature goes live in a few weeks
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
prev story

Whitepapers

SANS - Survey on application security programs
In this whitepaper learn about the state of application security programs and practices of 488 surveyed respondents, and discover how mature and effective these programs are.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.