Microsoft: How big of a problem with security? (Part 2 of 2)

In the last newsletter, we looked at the problem of security vulnerabilities within Microsoft products. My conclusion is that while to a degree Microsoft gets picked on by hackers because they are the 800-pound gorilla, the folks in Redmond are ultimately responsibility for the majority of security vulnerabilities that hit their products. What should be done? Here are some of my observations:

The Windows 9x product needs to die, and Microsoft will need to be pushed to make this happen. There have been several occasions where the product end of the Windows 9x line has been predicted, even positioned by MS executives as a stepping stone to Windows NT. Yet it has outlived even many internal projections within Microsoft, for the simple reason being that it is a cash cow. The momentum behind its huge legacy created a product that has by far outsold NT, with lower development costs. How do you financially justify shutting something like that down? This is something that has been argued long and hard internally within Microsoft, to the point that you would probably be safer sharing a cab with an NT and Linux developer than with an NT and Win98 developer. Chief information officers need to keep in mind that much of the future threats to their infrastructure will come from within, and there is no really safe place to use Windows 9x. If you need to run Windows, you need to run NT - and when it is proven, Windows 2000.

We need the walls put back in place between our operating systems and our applications. I believe it is a myth that we need applications such as browser components integrated into the operating system. This integration provides too many avenues for malicious code to be downloaded and executed on a system with little or no privilege restrictions. Users need a unified graphical user interface that minimizes the number of steps it takes to complete a task. Support personnel need systems they can break down into components to troubleshoot. None of this begs for integrated applications, just clear and open application programming interfaces.

Microsoft needs to make secure computing the cornerstone of the company, and the foundation of every product and service offering. For the end user right now, Microsoft practices "Are you sure?" security: "Are you sure" you want to run this macro, open that file? In fact users are often uncertain if the file they are about to open is going to work as advertised, or is going to wreak havoc on their system. If you look at the Security tab within Internet Explorer, you see different "zones" that you can define settings for: Internet, Intranet, Trusted Sites and Restricted Sites. Even if users could accurately index the world according to these categories, it is very crude and not very useful. Systems need to function under the principle of least privileges, and in a large intranet; for example, there could very definitely be one or two servers with malicious Trojan Horses. Microsoft's philosophy seems to be that there are some places we can assume to be safe, therefore we do not need to be concerned about security for all software. The marketing of Windows 98 even pushes it as a "home" system. Well, if you have a cable modem or digital subscriber line connection at home and/or are telecommuting, are you really safe at home?

Microsoft haters need to know Microsoft is not going away, and need to get over it. Industry giants die hard. Bill Gates likes to tell the story that when he first saw kit microprocessors, he thought IBM was toast. I remember the first 80386 processors being promoted as a mainframe on a chip, and again predictions were made that IBM was in deep trouble. What people did not realize was that as expensive as the big iron was, the investment in mainframe applications, Cobol code and business processes was infinitely greater. The point here is that Microsoft is not going away. Enterprises with a heavy investment in Microsoft desktops are not going to upgrade to Linux stations with KDE graphical front ends en masse any time soon. Linux, with its heritage as a Unix derivative and intense scrutiny by a million developers, is a strong competitive threat to the same hardware markets that Microsoft sells its own operating systems. While pushing Linux strongly on the desktop has not been a topic many CIOs have looked at closely, the operating system is growing strongly and in many cases displacing NT in the application and file server market. In several other venues I have predicted that Microsoft will someday adopt and find ways to absorb Linux, just like they have with several other technologies. It is in fact a real long-term threat to Windows, but not Microsoft. It is only a matter of time before Microsoft releases its own Linux distribution. Microsoft is not going anywhere and needs to be part of the security solution.

Microsoft needs to be held accountable for the security of its products before they are released, as well as after they are in production. There needs to be some independent review of Microsoft's code for security vulnerabilities. We can think of no better way to do this than for Microsoft to join the Open Source initiative, and, in effect, put its software in the public domain. This would be a radical departure for Microsoft, but no other single action in the industry could do so much to improve security.

To get back to our original question, How big of a problem does Microsoft have with security? It is a very big problem. The years of focus on user friendliness, leveraging operating system dominance against competitive applications and internal strife has built an insecure house of cards. We need to put the walls back between our applications and operating systems. We need third-party auditing and accountability for code, possibly through Open Source initiatives within Microsoft. Most of all, we need every CIO to demand that Microsoft reinvent itself around security, just as it reinvented itself around the Internet a few years ago.

Related links

Microsoft fixes bug in Mac version of Outlook Express
Network World, 12/23/99.

N+I: Intel, Microsoft step up network security
Network World, 09/15/99.

Security-seeking vendors find strength in numbers
Network World, 11/08/99.

Microsoft: Bad security, or bad press?
Network World, 09/27/99.

Jim Reavis, the founder of SecurityPortal.com, is an analyst with over 10 years' experience consulting with Fortune 500 organizations on networking and security-related technology projects. SecurityPortal.com is a Web site dedicated to providing IT professionals with comprehensive information about network security issues. Jim can be reached at jreavis@securityportal.com.

Microsoft fixes bug in Mac version of Outlook Express
Network World, 12/23/99.

N+I: Intel, Microsoft step up network security
Network World, 09/15/99.

Security-seeking vendors find strength in numbers
Network World, 11/08/99.

Microsoft: Bad security, or bad press?
Network World, 09/27/99.

Archive of Network World on Security newsletters

Network World Security Alert will keep you up to date on the latest security holes and patches, with daily updates from key vendors, security organizations and Network World reporters. See the latest dispatches from the security here.