DHS had little choice but to sign Microsoft deal, despite security flaws

Computerworld - The fact that the U.S. Department of Homeland Security awarded Microsoft Corp. a $90 million enterprise software deal two days after Bill Gates met with DHS Secretary Tom Ridge in Washington is more than sheer coincidence.
It's now a major security headache for a mammoth new agency that security experts say lacks the wherewithal to have considered alternative sources for its software.
On June 25, Gates met with Ridge and other leaders on Capitol Hill. And on June 27, the DHS signed a contract with the company for server and desktop software for approximately 140,000 users. The DHS described the contract as a critical step in the department's efforts to establish a common computing environment for its 22 formerly independent agencies.
But with the discovery last week of a critical security flaw affecting nearly every version of the Windows operating system -- including Windows Server 2003 (see story), the first product to be sold under Microsoft's so-called Trustworthy Computing initiative -- some security experts are warning that the DHS may have backed itself into a security quagmire.
Options Were Open
"They had a choice, but it would have been costly and time-consuming," said Roger Cressey, former chief of staff of the President's Critical Infrastructure Protection Board.
"The real alternative was to go open-source. But for 22 agencies, an overwhelming majority of which use nothing but Microsoft operating systems, to convert to another platform in an efficient and cost-effective manner would have been hard to accomplish," said Cressey. "DHS has neither the time, the money, nor the flexibility for that. Now it is held hostage to the imperfections of Microsoft code-writing."
DHS CIO Steve Cooper, who's leading the massive integration effort, didn't return Computerworld's calls seeking comment.
Microsoft spokesman Keith Hodson said no software has yet been shipped to the DHS under the recent contract, so the department will receive software with the necessary patches. Hodson also said that as recently as Friday, the DHS reaffirmed its confidence in Microsoft's ability to handle any security problems that arise.
A former senior Microsoft executive who spoke on condition of anonymity said he has "yet to find someone who's come up with a definitive, unbiased white paper on the pros and cons of relying on a single software vendor" for all or most of an organization's IT infrastructure.
Rafael Nunez, a former hacker now employed as a security expert at Scientech Inc. in Gaithersburg, Md., said that although standardizing on a single software platform makes it easier for hackers to penetrate different partsof an enterprise, the DHS would have been far less secure had it deployed open-source software.
"There's a reason the government doesn't buy open-source software," said Nunez. "They don't buy it because they know that every hacker and software cracker can study the code for exploits."

Read more about IT in Government in Computerworld's IT in Government Topic Center.