Feeds

What Billg's new security effort will cost

A lot, if he's serious

  • alert
  • submit to reddit

Secure remote control for conventional and virtual desktops

If Chairman Gates actually meant what he said in his recent memo calling for dramatically improved security in all MS products, then there are going to be some immense changes going on in Redmond. Changes in how software is created; changes in how features are integrated into them; changes in product development schedules; changes in disclosure practices. Indeed, we can determine just how serious Microsoft is by tracking the metamorphosis which a real shift towards security will necessitate.

We spoke recently with Counterpane Internet Security CTO Bruce Schneier, who has a pretty clear idea what a security-serious Microsoft would look like.

Schneier is cautiously optimistic, and for now would give MS the benefit of the doubt. Microsoft can do this, he says. But it will be difficult, and it will require an extraordinary shift in the Redmond culture.

For one thing, Schneier says, MS is simply going to have to open its protocols to evaluation and peer review. They simply won't succeed otherwise.

"I'm not talking about making it open source, but rather public source," he told us. "There is no way to achieve trustworthiness other than publication."

Next, the EULA (End User License Agreement), which absolves the company of all liability, "will simply have to go." Schneier reckons that a lot of what motivated Gates to take on security is the looming threat of liability litigation.

Now, Billg himself has said that product features will have to take a back seat to security for the company to earn the trust of consumers. But this will be exceptionally painful to MS software designers accustomed to working into their projects every slick bell and whistle they can think of.

"Putting security ahead of features is not easy," Schneier says. "Microsoft is going to have to say things like, 'We're going to put the entire .NET initiative on hold, probably for years, while we work the security problems out.' They're going to have to stop all development on operating system features while they go through their existing code, line by line, fixing vulnerabilities, eliminating insecure functionality, and adding security features."

Another mark of MS' commitment to security will be visible when the company ceases to treat vulnerabilities as a public relations problem, and deals with them openly and honestly.

Microsoft's most recent inclination has been to discourage vulnerability disclosure, and persuade customers to make use of auto-update, which patches the system behind their backs. The user never knows what was wrong, or whether the fix being applied is effective. This is obviously not a way to cultivate trust, and it will have to be abandoned if MS really wants a shiny new reputation suggestive of good security.

"When Netscape was serious about public scrutiny, they paid $1,000 for each security bug reported to them. Microsoft can no longer threaten, insult, or belittle independent researchers who find vulnerabilities in their products," Schneier observed.

This all sounds like a radically different Microsoft from the one we know and love, and that's just the point. The company quite simply cannot achieve the goals set forth in the Billg security declaration and remain unchanged.

It's undeniable that MS has the resources, both human and financial, to accomplish what it sets out to do. It's also undeniable that the company has an almost neo-Confucian tendency to substitute form for substance.

But as Schneier points out, there will be signs that can't be faked, and which will indicate just how serious the Beast is with its Trusted Computing initiative. The question remains, is this a PR stunt, or is it news?

We will see. ®

Related Stories

MS' highest priority must be security - Billg
Microsoft's crucial new hire
MS security memo a mere gesture

Providing a secure and efficient Helpdesk

More from The Register

next story
Microsoft on the Threshold of a new name for Windows next week
Rebranded OS reportedly set to be flung open by Redmond
Business is back, baby! Hasta la VISTA, Win 8... Oh, yeah, Windows 9
Forget touchscreen millennials, Microsoft goes for mouse crowd
SMASH the Bash bug! Apple and Red Hat scramble for patch batches
'Applying multiple security updates is extremely difficult'
Apple: SO sorry for the iOS 8.0.1 UPDATE BUNGLE HORROR
Apple kills 'upgrade'. Hey, Microsoft. You sure you want to be like these guys?
ARM gives Internet of Things a piece of its mind – the Cortex-M7
32-bit core packs some DSP for VIP IoT CPU LOL
Lotus Notes inventor Ozzie invents app to talk to people on your phone
Imagine that. Startup floats with voice collab app for Win iPhone
'Google is NOT the gatekeeper to the web, as some claim'
Plus: 'Pretty sure iOS 8.0.2 will just turn the iPhone into a fax machine'
prev story

Whitepapers

A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.