Get Secure, Stay Secure

With both the Code Red and Nimda worms hitting customers, and a senior Gartner analyst recommending that companies consider alternatives to Microsoft’s Internet Information Server (IIS), Microsoft once again has to address the security vulnerabilities of Windows. In the last week of September and the first week of Oct. 2001, the Windows Division held internal reviews of its security tools and programs, conducted conference calls with key customers around the world, and announced yet another security program. Though welcome, this escalation may still not address all of the problems.

Strategic Technology Protection Program

Microsoft’s new Strategic Technology Protection Program (STPP) is a wide-ranging effort to help administrators improve the security of Windows. The STPP is acknowledgment that, as an industry leader, Microsoft has a special obligation to help ensure the security of the Internet and customers’ data. This is in sharp contrast to Microsoft’s apparent previous position that it was merely a larger target, naturally leading to more successful attacks, and that it had no more obligation to enhance its security than any of its competitors. Now, while acknowledging that security vulnerabilities are a widespread problem among software vendors (see “OS and Web Server Vulnerabilities“), Microsoft also admits that it has more work to do. According to Brian Valentine, senior vice president of the Windows Division, “Effective immediately, we are stepping up our efforts with the singular focus of ensuring the security of our customers’ networks and businesses. We will not rest until all our customers have what they need to get secure and stay secure.”