Good Security is About Making Smart Choices

I’ve delayed for two days blogging on what I would consider a controversial report about Microsoft security. It’s a thorny subject, and one that tends to polarize people either for or against Microsoft’s approach to security; there’s not much room for middle ground. Except, the middle ground is exactly the position I find myself on Microsoft security, so I wanted to let the report pass without much comment. But, increased press coverage about the report makes it just too hard to ignore.

So…the way the Computer & Communications Industry Association, or CCIA, tells it, Microsoft’s Windows dominance is a threat to national security. The group, which is heavily backed by Microsoft competitors and viciously attacked the company during more than four years of antitrust proceedings, released on Wednesday the 25-page report making this claim. The report is available here.

CCIA couldn’t have released the report at a worse time for Microsoft. A series of recent, nasty viruses or security glitches are dogging Microsoft products. CCIA’s timing doesn’t necessarily make the organization right, and the distributor is somewhat questionable here. (It should be noted that principal author Daniel Geer, who was let go from @Stake following the report's release, said that CCIA did not commission the report. His comments can be found in this internetnews.com story.)

That said, the report’s authors make some very compelling arguments about Microsoft’s monopoly power and the impact of a virus rapidly spreading across a "monoculture" infrastructure. But, the arguments ignore fundamental market dynamics. Microsoft acquired its monopoly through competition, meaning consumers and businesses chose the company’s products. Sure, Microsoft uses technology and business means to ensure customers won’t easily switch to other products. But that’s something almost any competitor would do, too.

If people choose to use Microsoft products, it’s not necessarily the company’s fault many customers potentially have increased their security risk by mainly using one supplier’s software. As general good security practice, every business should minimize risk by using products from more than one developer, particularly on the server. Standardization doesn’t necessarily mean buying one kind of server software and putting it everywhere. Particularly as Web services standards expand what businesses can do around existing standards and protocols, there is plenty of opportunity to standardize back-end operations without using one single product. If companies like IBM or Microsoft are doing their development job right, any enterprise should be able to run Exchange Server for one site and Lotus Notes/Domino in another.

The same argument applies to the desktop, but granted, with greater difficulty. That’s because so many businesses run Windows. One Windows security breach can easily magnify across all operations. That said, businesses are choosing Windows. It’s not like Microsoft is forcing anyone to use the software. There are market and technological dynamics that may make Windows seem like the only choice, but there are alternatives. The increased interest in Linux or the availability of Mac OS X or Unix for desktop computers shows there are choices.

The report's authors argue that tight ties between Microsoft OS and desktop applications software create customer "lock-in." I would argue that Microsoft's integration approach really takes advantage of human foibles. Because switching to non-Mirosoft products can be difficult or costly, businesses simply don't do it. Integration might add to the complexity of switching--and so increase inertia to stay put---but it doesn't necessarily lock customers in.

As good security practice, it’s not a bad idea for businesses to spread different OSes around their desktops; the report's authors make a similar recommendation. The CCIA report makes a compelling argument, using potato farming as an example, about the spread of viruses along one crop or OS. Multiple OSes can help reduce security risks, but not necessarily eliminate them. That’s because some of the worst security holes have appeared around technology standards or protocols used by many operating systems. And Windows, by no means, is alone suffering repeated security glitches. Linux and other OSes have had their share of problems, too.

Still, Microsoft could do more to resolve its security problems. Because the company’s products are so widely used--so any breach’s impact is all the greater--Microsoft really needs to do more than any of its competitors. I’m by no means a software developer, but I still know enough to question whether Microsoft has a basic architectural problem. The company is doing a commendable job improving its coding and adopting better security practices.

Yet something about the effort, particularly the ongoing security patches that give some network administrators ulcers, seems futile. How many times must a building be patched with boards or shored up with poles before the owner recognizes the structure needs to be replaced? I would encourage Microsoft to seriously ask this question as it looks ahead to next-version-of-Windows Longhorn.

Posted by Joe Wilcox at September 26, 2003 09:19 AM