Microsoft's Security Chief Says Windows Safer Than Linux - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

03:56 PM

Microsoft's Security Chief Says Windows Safer Than Linux

Microsoft's top security honcho insists that Microsoft "is making progress on security using any reasonable metric."

Microsoft's top security honcho insisted Thursday that Microsoft "is making progress on security using any reasonable metric."

Mike Nash, the company's chief security executive, made the comment during an online chat session just days after Microsoft rolled out its biggest bunch of Windows patches since April 2004.

Nash staunchly defended the Redmond, Wash.-based developer's progress, and compared Windows' flaws with those in open-source Linux operating systems from Red Hat and Novell's SuSE.

"Even with the relatively large number of bulletins we released this week, we compare favorably," he said. "Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities."

Nash also said that the number of patches shouldn't be the only criteria users apply to tell if Microsoft's doing its job. "Note that this is just one measure, and doesn't take into consideration all of the other progress we're making, with security guidance for customers, improving security manageability and introducing innovative security solutions and technologies," he said.

When asked if Microsoft would consider refining its four-step severity rating system to give additional guidance to enterprises wrestling with deciding which of the 10 critical vulnerabilities of Tuesday to patch first, Nash said that for 2005, the rankings will remain as is.

Nash also took questions about this week's acquisition of Sybari Software, a maker of enterprise-oriented anti-virus and anti-spam add-ons for messaging platforms such as Microsoft Exchange and Lotus Notes. In particular, he said that the anti-virus scanning engine acquired in 2003's purchase of Romania-based GeCAD would be supported by Sybari's products this year.

"One of the engines we will be supporting soon after the deal closes is the GeCAD engine," said Nash.

That move may put additional pressure on third-party vendors whose engines are currently supported by Sybari, which include those from Sophos, Computer Associates, and Kaspersky Labs.

And Nash talked up Microsoft's work on a desktop anti-virus product.

Although he refused to get specific about when Microsoft will release desktop AV software, the company is "working hard on it." It will be based on the GeCAD technologies, he said, but with numerous enhancements.

"GeCAD was very solid when we acquired it . . . That said, there were some things we wanted to improve. We feel very good about the progress we have made [and] know we have to have great technology before we ship our own desktop AV solution."

The combination of the Sybari purchase and the looming entry of Microsoft into the desktop anti-virus market has investors in major security firms like Symantec and McAfee worried.

As well they should, wrote three Gartner analysts Wednesday. "The Sybari architecture will also enable Microsoft to plug in its own AV engine," Gartner analysts Neil MacDonald, Arabella Hallawell, and Maurene Caplan Grey wrote. "Gartner believes Microsoft AV engine, along with its signature service, will be the foundation of Microsoft's forthcoming desktop offering."

The AV engine would be the one developed from GeCAD, the same that Sybari's products will support when the acquisition closes sometime before the end of the second quarter.

"We have not announced the availability date of our desktop AV solution at this point," said Nash. "That said, we do expect to have the GeCAD engine available on the Sybari platform soon after the deal closes. I would certainly expect that to be this year."

Nash also repeatedly said that it would be important for Microsoft to tie its various security tools together in the enterprise. "We do think that there needs to be a management capability to allow enterprises to both control and monitor their security technologies like anti-spam and anti-virus," he said. "We're currently working through specific requirements."

In a final note, Nash said that Windows AntiSpyware, the tool acquired during its December 2004, purchase of Giant Company Software, will go through at least one more beta version before it's released. In related news, Microsoft's anti-spyware product has been targeted by virus writers, in what experts believe is the beginning of what will be a salvo of malware attacks on Microsoft security products.

As other Microsoft executives have said in the past, Nash wouldn't reveal whether AntiSpyware would continue to be offered free (as the beta is now), or whether fees would be charged. "We have not yet finalized the packaging/licensing, but will communicate that as soon as it's determined, so stay tuned," he said.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
2021 State of ITOps and SecOps Report
2021 State of ITOps and SecOps Report
This new report from InformationWeek explores what we've learned over the past year, critical trends around ITOps and SecOps, and where leaders are focusing their time and efforts to support a growing digital economy. Download it today!
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

Why IT Leaders Should Make Cloud Training a Top Priority
John Edwards, Technology Journalist & Author,  4/14/2021
10 Things Your Artificial Intelligence Initiative Needs to Succeed
Lisa Morgan, Freelance Writer,  4/20/2021
Lessons I've Learned From My Career in Technology
Guest Commentary, Guest Commentary,  5/4/2021
Register for InformationWeek Newsletters
Current Issue
Planning Your Digital Transformation Roadmap
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
White Papers
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll