Microsoft grades Trustworthy Computing one year on

A year ago last week, Microsoft’s CTO, Craig Mundie, gave a presentation at its Silicon Valley campus here that served as the public unveiling of a widespread initiative to improve the security and reliability of Microsoft’s products.

Mundie returned to the same stage Wednesday to give an update on how well it is achieving its goals one year on. His conclusion was that a world of Trustworthy Computing, as the effort is called, is still a long way off.

Hackers and security holes are getting ever more sophisticated, networks are becoming always-on and more pervasive. At the root of the problem, Microsoft laments, is that both consumers and business users are stuck in Microsoft’s past, running operating systems that date back to earlier days of the Internet.

“We’re dragging around behind us a giant tail of systems that were of course built and deployed a long time ago,” Mundie said, referring to research data from IDC which shows that most of its customers have yet to adopt Microsoft’s more recent and better fortified operating systems, Windows 2000 and Windows XP.

“In practice, it’s impossible for us to remediate the threats that are possible in systems that were built in 1991, deployed in 1995 and still in use today,” said Mundie, speaking at one of the company’s monthly speaker series events here.

The same advice that Mundie offered here last year during his presentation at the Trustworthy Computing Conference is upgrade, upgrade and upgrade.

In the past year Microsoft has enacted a new business licensing plan which aims to get companies to follow its advice. The Software Assurance plan requires companies to pay software licensing fees each year in order to receive all of its latest software and security updates. The plan is that customers will always run the current operating system, ensuring that they are always as secure as can be. Microsoft has also pushed its Windows Update technology on consumers and businesses, which allows Microsoft to automatically deploy security patches and feature updates to customers when they become available.

Microsoft’s fear is that customers could lose faith in computers due to the host of security breaches that gain public attention. That fear led to a widely-circulated memo from Bill Gates, the company’s chairman and chief software architect, about Trustworthy Computing, as well as a tab of $100 million and growing to cover security training for its developers and to re-architect its operating systems.

“The concern that has emerged is, will this stop … consumer adoption, or make it not happen at the rate we think it will happen,” Mundie said Wednesday. “If people don’t trust these computer systems or don’t trust Microsoft, then they won’t buy it.

“This was a really significant event for our company,” he said, referring to its realization that security fears could inhibit the wider adoption computing.

Besides keeping customers current with software and security fixes, Microsoft is beginning to implement a new chapter in its efforts to improve security — phasing out its past. The company has signaled lately that it will no longer support older operating systems if it can’t ensure that applications will run on them securely. It announced in late October that the next version of its Office productivity suite, Office 11, will only support computers running Windows XP or Windows 2000 with the most recent service pack installed.

“Even if it means that we’re going to break some of your applications, it’s going to make things more secure,” Mundie said.

Looking ahead, over the next five to 10 years Microsoft will invest more money and technology in its security effort. A software and hardware platform under development that will provide better security, called Palladium, will play a significant part of future products. Digital rights management software will also become integral to its operating system and applications.

“When all these things become invisible, that is when we will have succeeded,” Mundie said.