Microsoft’s top security honcho insists that Microsoft "is making progress on security using any reasonable metric."
By Gregg Keizer
TechWeb News
Microsoft’s top security honcho insisted Thursday that Microsoft "is making progress on security using any reasonable metric."
Mike Nash, the company’s chief security executive, made the comment during an online chat session just days after Microsoft rolled out its biggest bunch of Windows patches since April 2004.
Nash staunchly defended the Redmond, Wash.-based developer’s progress, and compared Windows’ flaws with those in open-source Linux operating systems from Red Hat and Novell’s SuSE.
"Even with the relatively large number of bulletins we released this week, we compare favorably," he said. "Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities."
Nash also said that the number of patches shouldn’t be the only criteria users apply to tell if Microsoft’s doing its job. "Note that this is just one measure, and doesn’t take into consideration all of the other progress we’re making, with security guidance for customers, improving security manageability and introducing innovative security solutions and technologies," he said.
When asked if Microsoft would consider refining its four-step severity rating system to give additional guidance to enterprises wrestling with deciding which of the 10 critical vulnerabilities of Tuesday to patch first, Nash said that for 2005, the rankings will remain as is.
Nash also took questions about this week’s acquisition of Sybari Software, a maker of enterprise-oriented anti-virus and anti-spam add-ons for messaging platforms such as Microsoft Exchange and Lotus Notes. In particular, he said that the anti-virus scanning engine acquired in 2003’s purchase of Romania-based GeCAD would be supported by Sybari’s products this year.
"One of the engines we will be supporting soon after the deal closes is the GeCAD engine," said Nash.
That move may put additional pressure on third-party vendors whose engines are currently supported by Sybari, which include those from Sophos, Computer Associates, and Kaspersky Labs.
And Nash talked up Microsoft’s work on a desktop anti-virus product.
Although he refused to get specific about when Microsoft will release desktop AV software, the company is "working hard on it." It will be based on the GeCAD technologies, he said, but with numerous enhancements.
"GeCAD was very solid when we acquired it . . . That said, there were some things we wanted to improve. We feel very good about the progress we have made [and] know we have to have great technology before we ship our own desktop AV solution."
The combination of the Sybari purchase and the looming entry of Microsoft into the desktop anti-virus market has investors in major security firms like Symantec and McAfee worried.
As well they should, wrote three Gartner analysts Wednesday. "The Sybari architecture will also enable Microsoft to plug in its own AV engine," Gartner analysts Neil MacDonald, Arabella Hallawell, and Maurene Caplan Grey wrote. "Gartner believes Microsoft AV engine, along with its signature service, will be the foundation of Microsoft’s forthcoming desktop offering."
The AV engine would be the one developed from GeCAD, the same that Sybari’s products will support when the acquisition closes sometime before the end of the second quarter.
"We have not announced the availability date of our desktop AV solution at this point," said Nash. "That said, we do expect to have the GeCAD engine available on the Sybari platform soon after the deal closes. I would certainly expect that to be this year."
Nash also repeatedly said that it would be important for Microsoft to tie its various security tools together in the enterprise. "We do think that there needs to be a management capability to allow enterprises to both control and monitor their security technologies like anti-spam and anti-virus," he said. "We’re currently working through specific requirements."
In a final note, Nash said that Windows AntiSpyware, the tool acquired during its December 2004, purchase of Giant Company Software, will go through at least one more beta version before it’s released. In related news, Microsoft’s anti-spyware product has been targeted by virus writers, in what experts believe is the beginning of what will be a salvo of malware attacks on Microsoft security products.
As other Microsoft executives have said in the past, Nash wouldn’t reveal whether AntiSpyware would continue to be offered free (as the beta is now), or whether fees would be charged. "We have not yet finalized the packaging/licensing, but will communicate that as soon as it’s determined, so stay tuned," he said.
