Will Microsoft ever get security right?

When it comes to security, can Microsoft get any respect?

Even Bill Gates has humbled himself at times to explain why Microsoft has fumbled the ball so often on security. In his last public appearance at the RSA 2007 Conference, on stage with Craig Mundie, to whom he handed the baton to direct product security going forward, the two offered a mea culpa explanation on why Microsoft's software has fallen short.

"Humans are humans and they make mistakes," said Mundie, with the duo later indicating that the inadequate security plaguing Microsoft software in the past can be traced to a naïveté in the early years based on the perception few controls were needed because"everybody was really good" and the data center seemed carefully tucked away.

This decades-old baggage remains a burden for Microsoft, says Andreas Antonopoulos, senior vice president and founding partner at Nemertes Research.

"Even today, the fundamental design decisions made 25 years ago still haunt Microsoft," Antonopoulos says."Windows Vista is not a new operating system; there are a lot of the older operating systems under the cover, which carries with it the baggage of the last 20 years to ensure backward compatibility of applications."

Microsoft is caught in a conundrum, Antonopoulos asserts. If the company really decides to make a fresh start on software, it would likely have to sacrifice financial advantages."That's not likely to happen," he says.

Burton Group analyst Dan Blum expresses a similar opinion, saying,"They are compromised in that sense. They have the constraints of backward compatibility in mind."

A few years ago, Microsoft sought to make a break with the past in what was called the Next-Generation Secure Computing Base (NGSCB) project, but"they killed it," Blum says.

According to Blum, Microsoft remains driven along a path of"convenience and flexibility and backwards compatibility," which gives them the best advantage in the marketplace. Blum muses if he were Bill Gates, he would have tried a"parallel approach" to develop a next-generation trusted operating system, even if it broke with existing applications.

In other respects, Microsoft has produced a viable identity strategy overall, Blum says, but it's been hobbled by its Windows-centric approach."They never put a stamp on any platform that's different," he says. Microsoft's lack of support for the SAML standard, for instance,"is a big mistake and not in the best interests of the industry."

Linux, Unix and Macintosh operating systems ship with better"secure by design postures" than those from Microsoft, Antonopoulos contends.

But Antonopoulos and Blum both say Microsoft has improved with Vista and XP2.

"The problem is Microsoft has developed a bad reputation and it's hard to outlive that," Antonopoulos says. Microsoft has plenty of talented engineers with identity and trust expertise, but their ideas expressed during engineering conferences seldom seem to get adopted in Microsoft software."I think they must get overruled."

For some third-party security software providers that work closely with Microsoft, it's also been trying at times.

"It's been a roller coaster," says Phil Lieberman, president of Lieberman Software, which makes password and administrative management tools that work with Microsoft desktop and server products."The problem with Microsoft is it's not just one company; it's divergent ones on different paths fighting each other."

In some Microsoft units, such as those managing CRM or Office products, there's no effort to work with third-party applications for security while"the core operating system group is more open," Lieberman says.

But the most aggravating part of working with Microsoft — which may be necessary to gain official Microsoft certification — is that the company isn't keeping up on the technical documentation.

"A tremendous amount of the operating system is undocumented," Lieberman says."They're moving so fast and doing so many releases and updates, no one is keeping track of what they're doing. For instance, if Microsoft goes and changes something for Patch Tuesday, and a [Data Link Library] is changed, they don't bother to change the documentation, and your application stops working. We have to go research this and we find they've changed it."

While acknowledging Microsoft's poor track record, others are a tad more conciliatory.

Microsoft's efforts to improve have had a"positive impact," says Oliver Friedrichs, director of Symantec's Security Response division."We have to give Microsoft some credit for improving operating system security."

In the past few years there just haven't been the types of devastating worm attacks, such as Code Red, Blaster and Nimbda, that exploited holes in Microsoft products to wreck havoc around the world.

"Attackers today are focused on the third-party Web plug-ins," Friedrichs adds.

"It's easy to pick on Microsoft because they're ubiquitous and historically had a problem," says Jon Gossels of SystemExperts."But year after year, their products are getting better, and a lot of professionals out there are trying to find the bugs."