Conclusion

In the first two years on the road to Trustworthy Computing, Microsoft has focused substantial resources, including both manpower and dollars, on security, reliability, and privacy and has begun to make improvements. Beginning with the Windows Division and moving to other product groups, the review of processes and practices is having a positive impact, but it also highlights the biggest downfall to this point-a lack of consistency in addressing Trustworthy Computing across the many product divisions within the company.

One of Microsoft’s strengths, the autonomy of individual product teams, led to rapid innovation in its early days. But when Microsoft tries to act like a mature company that can address a companywide problem in a timely manner, this autonomy is a weakness-it prevents consistently addressing design and development problems that allow vulnerabilities into products in the first place. Worse, it requires customers to adapt to and work around the multitude of different ways in which Microsoft disseminates information about security and vulnerabilities, creates and distributes patches, and even in how patches themselves are applied and detected post-installation. The lack of consistency exacts such a high price on customers in terms of effort, continued exposure to vulnerabilities, and maintenance costs that some analysts have begun to suggest customers not use Microsoft products that have been shown to be particularly vulnerable.