DHS had little choice but to sign Microsoft deal, despite security flaws
Lack of money, time and flexibility may have been factors in the decision
July 21, 2003 12:00 PM ETComputerworld -
The fact that the U.S. Department of Homeland Security awarded Microsoft Corp. a $90 million enterprise software deal two days after Bill Gates met with DHS Secretary Tom Ridge in Washington is more than sheer coincidence.
It's now a major security headache for a mammoth new agency that security experts say lacks the wherewithal to have considered alternative sources for its software.
On June 25, Gates met with Ridge and other leaders on Capitol Hill. And on June 27, the DHS signed a contract with the company for server and desktop software for approximately 140,000 users. The DHS described the contract as a critical step in the department's efforts to establish a common computing environment for its 22 formerly independent agencies.
But with the discovery last week of a critical security flaw affecting nearly every version of the Windows operating system -- including Windows Server 2003 (see story), the first product to be sold under Microsoft's so-called Trustworthy Computing initiative -- some security experts are warning that the DHS may have backed itself into a security quagmire.
Options Were Open
"They had a choice, but it would have been costly and time-consuming," said Roger Cressey, former chief of staff of the President's Critical Infrastructure Protection Board.
"The real alternative was to go open-source. But for 22 agencies, an overwhelming majority of which use nothing but Microsoft operating systems, to convert to another platform in an efficient and cost-effective manner would have been hard to accomplish," said Cressey. "DHS has neither the time, the money, nor the flexibility for that. Now it is held hostage to the imperfections of Microsoft code-writing."
DHS CIO Steve Cooper, who's leading the massive integration effort, didn't return Computerworld's calls seeking comment.
Microsoft spokesman Keith Hodson said no software has yet been shipped to the DHS under the recent contract, so the department will receive software with the necessary patches. Hodson also said that as recently as Friday, the DHS reaffirmed its confidence in Microsoft's ability to handle any security problems that arise.
A former senior Microsoft executive who spoke on condition of anonymity said he has "yet to find someone who's come up with a definitive, unbiased white paper on the pros and cons of relying on a single software vendor" for all or most of an organization's IT infrastructure.
Rafael Nunez, a former hacker now employed as a security expert at Scientech Inc. in Gaithersburg, Md., said that although standardizing on a single software platform makes it easier for hackers to penetrate different partsof an enterprise, the DHS would have been far less secure had it deployed open-source software.
"There's a reason the government doesn't buy open-source software," said Nunez. "They don't buy it because they know that every hacker and software cracker can study the code for exploits."
Government
Additional Resources



White Papers & Webcasts
Data Manager Report Excerpt: File System Inventory
Cut storage costs and boost operational efficiencies.
IT Governance Podcast: IT Provider Forecasts $10 Million in Savings
In this podcast, learn how OTS was able to prioritize, then deliver, on the mission-critical demands and, in the process, project $10 million...
Reducing Storage Costs with F5 ARX
Save money- deploy ARX Solutions.
Key Strategies for Managing Data Growth
What are you storage challenges?
Southern Company
Download Now
Extending Client Refresh - 11 Steps to Maximize Savings
Register Now!
Defending Against the Storm
Download Now
Lower the Cost and Complexity of a Mobile Workforce through Automation
Download This Resource Now!
Share our Strength
Download Now
Managing Mobility: Improve Data Security, Compliance and Manageability
Download This Resource Now!
