The Microsoft That Cried Wolf

Microsoft faces a serious strategic quandary in the wake of last week's Blaster attack, Monday's Blaster fix-it worm and the Tuesday-Wednesday-Thursday SoBig e-mail virus. It's unfair to place the entire blame for these virus outbreaks on Microsoft. Internet worms or e-mail viruses are not dependent on Microsoft software to spread--or they weren't in these three examples.

On the other hand, patch management is too much a hassle, particularly when Microsoft reissues patches or does not provide adequate patches, as was seen with Blaster and at least one of the three security flaws warned of yesterday. It's bad enough that network administrators must battle a torrent of patches, let alone have to reinstall a "revised" patch because the original issue didn't adequately protect against the flaw.

A bigger problem is the shear number of patches consumers or businesses must contend with. Since May 21, when I set up the computer I am using right now (Compaq Presario 8000 with 3GHz Pentium 4 processor, 120GB hard drive and 1GB of SDRAM), Windows update has pulled down and installed 29 security fixes or critical updates; two more security updates still need to be applied. Grand total: 43 updates installed over three months. I spoke with a buddy this morning who works at a Macintosh news site. Coincidentally, he was updating his Windows test machine. Seventeen critical updates, he said.

"I’m afraid to start up the e-mail," he quipped. "What do Windows users do? I mean, aren’t they afraid?"

Apparently not, because Microsoft seems to have a hard time convincing businesses or consumers to update Windows. As I blogged previously, Blaster is a good example. About a week after Microsoft’s July 16 warning, the U.S. Dept. of Homeland Security issued a separate warning about the Windows security hole eventually exploited by Blaster.

Maybe the sheer number of patches contributes to this indifference. Like the boy who cried, "wolf!" Maybe Microsoft warns of so many potential security problems, people don’t take them seriously. Then a Blaster comes along, issues a temporary wake up call, but eventually Windows users return to their indifferent slumber. Certainly, Microsoft can’t be blamed for people refusing to install security patches; that is their responsibility, not Microsoft’s.

That said, I would strongly recommend Microsoft to take another long, cold look at its security strategy. The week’s worth of virus attacks has raised security awareness and concern. As Windows is so widely used, in some ways, the onus is on Microsoft to fix the problem. I know that the company has talked about turning on Windows XP’s firewall by default. But responses like that, while worthwhile, deal more with symptoms than causes.

Microsoft may want to take another look at how it architects software, and, particularly its cross-integration strategy the company calls "integrated innovation." The architectural approach may make sense from a customer convenience perspective, but maybe not from the making-software-more-secure viewpoint. Last I heard, Chairman Bill Gates issued a mandate that Microsoft must put security ahead of features--and so, I’m assuming, customer convenience through increased integration of different types of software products.

Posted by Joe Wilcox at August 21, 2003 01:31 PM