Introduction

Since the introduction of its Trustworthy Computing initiative in Jan. 2002, Microsoft has focused substantial resources on addressing customers’ security concerns, as well as reliability and privacy issues with its products. Beginning with the Windows Division and moving to other product groups, internal reviews of Microsoft technologies, processes, and practices are having a measurable positive impact. However, the ultimate goal of Trustworthy Computing—a point where customers trust and rely on computers at the same level that they trust and rely on telephones—is still far from being realized. For Trustworthy Computing, to borrow a famous quote from Winston Churchill, “This is not the end. It is not even the beginning of the end. But it is, perhaps, the end of the beginning.”

Security Is the Cornerstone

Security—assuring that the confidentiality, integrity, and availability of data and systems are protected from attack—is the cornerstone of Trustworthy Computing. Unless security vulnerabilities are addressed first, reliability and privacy cannot be assured. For example, if security vulnerabilities bring a line-of-business server offline for repair, then reliability and privacy goals are hopelessly undermined. (See the sidebar “Consequences of Poor Computer Security“.)