Mundie talks about Trustworthy Computing one year on

MOUNTAIN VIEW, Calif. -- A year ago last week, Microsoft Corp.'s chief technical officer, Craig Mundie, gave a presentation at the company's Silicon Valley campus that served as the public unveiling of a widespread initiative to improve the security and reliability of Microsoft's products.

Mundie returned to the same stage yesterday to give an update on how well the company is achieving its goals one year on. His conclusion: A world of Trustworthy Computing, as the effort is called, is still a long way off.

Hackers and security holes are getting ever more sophisticated, networks are becoming always-on and more pervasive. At the root of the problem, Microsoft laments, is that both consumers and business users are stuck in Microsoft's past, running operating systems that date back to earlier days of the Internet.

"We're dragging around behind us a giant tail of systems that were, of course, built and deployed a long time ago," Mundie said, referring to research data from IDC that shows that most of its customers have yet to adopt Microsoft's more recent and better-fortified operating systems, Windows 2000 and Windows XP.

"In practice, it's impossible for us to remediate the threats that are possible in systems that were built in 1991, deployed in 1995 and still in use today," said Mundie, speaking at one of the company's monthly speaker series events here.

The same advice that Mundie offered here last year during his presentation at the Trustworthy Computing Conference is, upgrade, upgrade, and upgrade.

In the past year, Microsoft has enacted a new business licensing plan that aims to get companies to follow its advice (see story). The Software Assurance plan requires companies to pay software licensing fees each year in order to receive all of Microsoft's latest software and security updates. The plan is that customers will always run the current operating system, ensuring that they are always as secure as can be. The company has also pushed its Windows Update technology on consumers and businesses, which allows Microsoft to automatically deploy security patches and feature updates to customers when they become available.

Microsoft's fear is that customers could lose faith in computers due to the host of security breaches that gain public attention. That fear led to a widely circulated memo from Bill Gates, the company's chairman and chief software architect, about Trustworthy Computing, as well as a tab of $100 million and growing to cover security training for Microsoft developers and to rearchitect its operating systems.

"The concern that has emerged is, will this stop ... consumer adoption, or make it not happen at the rate we think it will happen," Mundie said. "If people don't trust these computer systems or don't trust Microsoft, then they won't buy it.

"This was a really significant event for our company," he said, referring to the realization that security fears could inhibit wider adoption of computing.

Besides keeping customers current with software and security fixes, Microsoft is beginning to implement a new chapter in its efforts to improve security -- phasing out its past. The company has signaled lately that it will no longer support older operating systems if it can't ensure that applications will run on them securely. Microsoft announced late last month that the next version of its Office productivity suite, Office 11, will support only computers running Windows XP or Windows 2000 with the most recent service pack installed.

"Even if it means that we're going to break some of your applications, it's going to make things more secure," Mundie said.

Looking ahead, during the next five to 10 years Microsoft will invest more money and technology in its security effort. A software and hardware platform under development that will provide better security, called Palladium, will play a significant part of future products (see story). Digital rights management software will also become integral to its operating system and applications.

"When all these things become invisible, that is when we will have succeeded," Mundie said.

Copyright © 2002 IDG Communications, Inc.

Shop Tech Products at Amazon