March 6, 2006

Mr. Jerry Liao
Columnist, Reality Bites
Technews Section, Manila Bulletin

Dear Mr. Liao,

We are writing in response to the article, Defense of the Realm, published in your column February 27, 2006 and posted on the February 27 - March 5, 2006 edition of your Infochat site.

First of all, thank you for recognizing the relevance of Microsoft in the software industry and citing that the company is acknowledge by other security vendors as a force to be reckoned with, given our recent foray in the field of security.  As the most-widely utilized software business product in the world today, our organization is dedicated to delivering solutions that benefits our users.  We take a leadership position in the technology industry toward minimizing the impact of malicious computer use.

At the same time, we believe that security is an industry-wide issue.  You made mention of Microsoft declaring war on companies who are actually more experienced and experts in the area of security as not being a good idea.  Our long record of cooperation and coordination with various individuals, teams and groups - including security companies - provides a single point of coordination and communications for Microsoft partners, government agencies, law enforcement, security vendors and researchers, and others.  With such a plethora of information, it is our responsibility to the industry to take the initiative to develop such products for the customer's protection.

In our continuing efforts for the Trustworthy Computing, Microsoft and its industry partners have made considerable progress on the security front with achievements such as greater customer awareness of the existence of spam, viruses, spyware and other security threats, as well as the availability of more effective and powerful software protections against software attacks and security breaches, which has resulted in improved security for Microsoft customers.  We have made headway:  according to the United States Computer Emergency Readiness Team (US-CERT) Cyber Security Bulletin, out of the 5,198 reported software vulnerabilities between January 2005 and December 2005, 812 were Windows operating system vulnerabilities.  The rest were Unix/Linux (2,328) and Multiple operating system vulnerabilities (2,058).

Microsoft plans to build on this momentum of success in Trustworthy Computing, with emphasis on security.  This will require continued investments in technology, educational outreach and work with industry partners to help increase customers' trust in computing.  Microsoft is committed and we count on your unrelenting support in your important role of providing information about and understanding of security and customer protection.

Yours Truly,

Jojo Ayson
Senior Product Manager
Business Marketing Organization
Microsoft Philippines

Thank you Jojo for sending me the email and for reiterating the commitment of Microsoft to fight and thwart the ever-growing cyber threats.  I did not include the fourth paragraph of Jojo's email since it only explains what Windows Defender and Windows OneCare Live has to offer.  I already enumerated them in my previous article.

Yes I agree that according to the US-CERT Cyber Security Bulletin, out of 5,198 reported vulnerabilities - Windows accounted for 812 (15%), 2,328 for Unix/Linux (45%) and 2,058 for multiple OS (40%).  But US-CERT also said that the report includes information published by outside sources, so the information should not be considered the result of US-CERT analysis.  Let me also state that the number Unix/Linux (2,328) got included vulnerabilities from Apple OSX, which cannot be considered part of Unix/Linux OS. 

Whether the report suggests that Windows is more secure than Linux is still debatable.  As much as Microsoft would want to claim that Windows is more secure, I am sure that open source advocates will also do the same - so let the user beware.  To me, the severity of vulnerabilities and the amount of time a fix was made available are the more important factors to consider in determining which OS is more secure.  I would also consider the number of attacks directed to a particular OS - how many were directed to Windows, how many were directed to Unix/Linux?  I would also consider the damage the attack created - how many were hit, how much money was lost, and how much time was consumed to remedy the problem?  All of these were not included in the US-CERT report.

With regards to my comment that Microsoft's entry to the security arena was not a good idea, it stemmed from the reactions and statements made by other security vendors after Microsoft announced their security offering.  I have to give it to Microsoft that they can offer security tools that are more tightly integrated with its desktops and servers but experience and credibility in security is something we cannot just set aside.  If the entry of Microsoft will result to the withdrawal of support from other security vendors, then it is not a good idea.  But if they will still cooperate, then well and good.  Fighting online threat is a team effort.  No one company can solve this alone.  So if Microsoft will not be supported by other security vendors obviously for business and market share reasons, then Microsoft is bound to fail.  One thing's for sure - competition will drive innovation and will be good for the users.

Whether Microsoft is serious about their security initiatives and if it will be successful in the security business will now depend on Vista since it is the next major OS product they will ship after announcing their renewed security strategy and offerings.  For the meantime, let us all work together to protect users from online threats.  Our role as reporters is to inform and educate our readers about the good and the bad aspects of I.T. and bring to I.T. companies the feedback shared to us by their users in the hope that it will help I.T. companies develop new and trusted products and provide quality service.

Am logging off.  Stay cool and God Bless us all!

**********

Announcement: Attend the Powertips 2006 "Security Secrets and Strategies" conference on March 16, 2006 at the Grand Ballroom of Dusit Hotel Nikko.  Tickets are available at all SM TicketNet outlets or call 911-5555.  You can also register online at www.infochat.com.ph.

For your questions, comments, suggestions, press releases and stories, please e-mail techtvhost@yahoo.com or visit www.infochat.com.ph for more articles.

**********