Desktop platforms Toolkit

Trustworthy Computing: Two years on

Published: 16 Jan 2004 10:40 GMT

Two years after chairman Bill Gates called on Microsoft to redouble its efforts to secure its software, the company is beginning to make progress, according to customers -- but much work remains.

In January 2002, Gates launched a program called "Trustworthy Computing" that was designed to focus Microsoft employees on building better security into products and on improving customer response. The software maker halted production to review code, then delayed shipments and retooled its development process as a result.

Now, though Microsoft is touting the large number of changes it has made in its approach to security as a measure of its success, the most telling pieces of evidence may be the numbers.

Six months after the release of the Windows 2000 operating system, Microsoft had warned of system flaws in 32 security advisories; 21 vulnerabilities were gauged to be critical. Yet six months after Microsoft released Windows Server 2003, the successor to Windows 2000, after extensive code reviews, the number of flaws had shrunk to 14, with only 6 critical issues.

"Customers are better off today than they were a year ago, and they will be even better off in the future," said Kevin Kean, a group manager at Microsoft's Security Response Centre.

Some Microsoft customers that CNET News.com contacted agree that the latest products show signs of improvement. But they note that the changes haven't been fully extended to products that the software giant launched before the initiative, which make up the bulk of installations.

"The problem is, there is still a wide base of products," said Joe Peloquin, an information systems administrator for a large retail chain. "The new code is a step in the right direction... but I don't think they are doing enough to secure the stuff that is already out there."

Other customers agreed and said that since the initiative's launch, Microsoft has done a better job of providing the tools they need to keep their systems up and running. The initiative "has given us some tools that are more useful for software monitoring," said Joe Brunner, an MIS manager at Sleepeck Printing.

"Security has overshadowed things at the moment," Brunner said. "Microsoft continues to make that effort a priority. But this won't be solved in a week or with a single press announcement."