Gregarius » éléments par Christopher Budd

Canaux

108470 éléments (108470 non lus) dans 10 canaux

Actualités (48730 non lus)

• 01net. Actualités (48730 non lus)

Hoax (65 non lus)

• Top dix quotidien Sophos des canulars (65 non lus)

Logiciels (39066 non lus)

• BetaNews.Com (34382 non lus)
• Presence PC - Actualité Logiciels, jeux vidéos (3551 non lus)
• LeMondeInformatique.fr : Actualités Applications (1133 non lus)

Sécurité (1668 non lus)

• Actualités Sécurité Informatique (406 non lus)
• Les Nouvelles.net : sécurité informatique. (1262 non lus)

Referencement (18941 non lus)

• Secrets2moteurs (11793 non lus)
• Referencement Google WebRankInfo (2255 non lus)
• Abondance (4893 non lus)

éléments par Christopher Budd

BetaNews.Com

• 

  Apple's 'good enough' security response: why it’s not going to change, isn’t fair, but doesn’t matter anyway

  Publié: février 28, 2014, 10:46am CET par Christopher Budd

  

  Apple’s handling of the recent "goto fail" vulnerability has brought about another round of the usual criticisms that we’ve heard from the security research community for years. In this most recent episode, Apple’s decision to provide security updates for iOS devices while leaving the vulnerability unpatched on Mac OS X for four days and giving no clear sign of the company's intentions has revived the oft-repeated criticisms that Apple isn’t transparent in its security response, isn’t timely, and doesn’t engage with the researcher community positively. Often the criticism will point to Microsoft as an example of what Apple doesn’t do and should.

  I’m a ten year veteran of the Microsoft Security Response Center (MSRC), and I and my colleagues have said much the same things about Apple’s security response. In fact, one of my colleagues, Stephen Toulouse, made news in 2006 by calling on Apple to implement some of the many programs that Microsoft had put together. For us, it was always particularly frustrating to see Apple essentially get a pass on behavior that would lead to huge outcries if Microsoft did it. Think of the outcry if there was an SSL/TLS vulnerability that enables man-in-the-middle attacks affecting Microsoft Windows and Internet Explorer that’s unpatched for four days with no information from Microsoft. Now, compare that with what we saw with Apple. Forgive the pun but its Apples to oranges, really and Apple gets off easy every time.

  While it’s good and justified that the security research community continues to criticize Apple and encourage change, it’s my professional opinion now that it’s just not going to happen. It is patently unfair: Apple is being held by its customers and the community to a lesser standard than Microsoft, Adobe or Oracle. But it’s also my opinion that Apple not making changes increasingly doesn’t matter.

  Let me explain first why Apple isn’t going to change. I’ve worked with my colleagues at Apple on communications around joint security issues and can attest that its approach is very old school: it wants to keep the issues off the front page. And who can blame it? Microsoft never wanted to be as public as it is (Jim Allchin once famously accusing us of "trying to kill his product" when publicizing the first critical, potentially wormable vulnerability affecting Windows XP MS02-006). What drove Microsoft to change and isn’t driving Apple are customers. Bill Gates’ Trustworthy Computing Memo was driven chiefly by large customers making clear they were ready to dump everything with the word "Microsoft" if things didn’t change. When we look at Apple, as the saying goes, where’s the outrage? It’s only to be found in the security research community. Apple has correctly calculated that it can do the bare minimum and its customers won’t penalize it. If Apple hasn’t followed Microsoft’s lead around security response by now, there’s no reason to expect it to in the future. No, it’s not fair. But that’s just what it is.

  Why It Doesn't Matter

  Which brings me to my second point: increasingly it doesn’t matter if Apple builds a Microsoft-like security response process. The world in which we built the "Patch Tuesday" process is ten years gone now. A regular update process like that made sense for desktops and servers. But is an ancient artifact when we talk about cloud and devices. Expectations around handling vulnerabilities in the cloud and device world are simpler and lower. Basically, security response for cloud and devices is send an update from the cloud to the device (or app on the device) or fix it on the back end as soon as possible. You don’t need to publicize it since the auto-update mechanisms cover that for you on the devices. From the point of view of cloud and device security response, all the major players are on an equal footing and no one really excels. I’ve said there are ways in which the best of the old server and desktop security response and cloud and device security response should be synthesized but no one is doing that right now and again, there’s not much call for it beyond the research community and again, there’s not much call for it beyond the research community. The big security response processes that companies like Microsoft have are losing their relevance much like desktops and servers are. They exist increasingly to fill a necessary but legacy function.

  In fact, when we talk about cloud and device security we also have to give Apple credit for decisions it made that keeps the iOS ecosystem relatively free of malware and high risk apps. Compare what Apple has done with what Google has done and you can see the good work by Apple. My company, Trend Micro, has catalogued 1.4 million malicious and high risk apps on Android with 1 million of those coming out in 2013 alone. To set context, it took Microsoft Windows 15 years to reach the one million pieces of malware mark. And when we’re talking addressing vulnerabilities on mobile platforms, Apple has a much better and stronger story than Google, due most of all to the fragmentation and poor ongoing support of Android on the part of the carriers and handset makers. In fact, Google’s Android head Sundar Pichai was just quoted as saying "We cannot guarantee that Android is designed to be safe… If I had a company dedicated to malware, I would also be addressing my attacks on Android". Unlike desktops and servers, this space is the space of the future and in this space I would argue Apple HAS made security a priority and leads its peers.

  But Apple isn’t just about iOS, it still has Mac OS X and will for some time. And we are seeing attacks against the Mac platform finally, like the Flashback Trojan. Don’t these mean that Apple’s lackluster security response process for the Mac matters? I argue that it doesn’t. The truth is that attacks against the Mac are still very rare: targeted attacks are more common than broad ones. All trends show that the money and interest for attackers is moving towards mobile, while keeping a healthy legacy Windows business going as well: like the Mac itself, Mac attacks are a niche business. And where there have been security issues Apple has at least gotten fixes out and issued cleaning tools at least enough to prevent a Microsoft-style PR disaster (and that’s Apple’s goal with security). Taken all together, what I’m saying is that at this point, Apple’s security response for its legacy Mac OS X is just good enough and it doesn’t matter if it never gets any better. The company has done better work where it matters: on iOS.

  Is it fair? No. Is it putting customer security first? No, certainly not on Mac OS X. But is it going to change? No. And as the years pass it’s going to matter less and less.

  It does mean, however, that people who run Mac OS X should understand this reality and take steps to increase their protections by running a security package on their Mac OS X systems.

  In the end, the nature of Apple’s security response process reflects Apple’s culture (closed and authoritarian) and its customer base (loyal to a fault, focused on it "just going", and not asking for much). These are things that are unique to Apple in the industry. And that gives Apple a unique pass when it comes to security response. There is no other company that could maintain this approach to security. But there’s also no other company that could have pioneered digital music by standing up to the record companies or dictated terms to wireless carriers either. Some companies (like people) do seem to live a charmed life.

  Photo Credit: Raywoo/Shutterstock

  Christopher Budd is a communications manager at Trend Micro. He is a 10-year veteran of Microsoft, where he oversaw and managed communications around online security and privacy incidents. He left the company in December 2010. Today uses his experience in the areas of threats to online security and privacy, crisis communications, and social media to help people better protect themselves.

  
• 

  Microsoft's experience shows us what to expect from Oracle's Java 'security push'

  Publié: juillet 2, 2013, 4:01pm CEST par Christopher Budd

  

  It has been a very rough year for Java from a security point of view.

  Two-thousand thirteen started with a number of zero-day attacks targeting Java, including those that resulted in breaches at Microsoft, Facebook, Apple and Twitter. As the year went on, the Department of Homeland Security and others recommended disabling or even uninstalling Java. Apple went so far as to effectively block the Java 7 web plugins twice in one month on OS X. As the security situation around Java seemed to deteriorate, the criticism of and frustration with Oracle continued to increase.

  Then in April, Mark Reinhold posted on his blog that Java 8 would be delayed while Oracle redeployed development resources to secure the current versions of Java. And then at the end of May, Nandini Ramani posted a number of improvements that Oracle will make not only in the technology but also processes and procedures.

  At the height of the worry about Java, some people were saying that it is the new Internet Explorer. Whether or not that's a fair characterization, one thing is certain: Oracle is definitely taking pages out of Microsoft's playbook -- right after the Trustworthy Computing Memo came out in early 2002. In contemplating the tenth anniversary of that memo, I wrote that for the next 10 years that memo's significance may be in how others follow its example. With Oracle engaged now in what amounts to a "security push" for Java, we have the first clear example of someone following Microsoft's example. Oracle deserves credit here for doing the right thing.

  In looking at this situation, as someone who was at Microsoft during those times, I think it's instructive to go back and look at how this played out so that we can better understand what may lie on the road ahead for Oracle and everyone who cares about Java. Because one thing that we learned on our path at Microsoft: it's a long, hard road to achieving better security after announcing a new focus on it.

  Things will Get Worse Before They Get Better

  To set the stage, it's helpful to look at the timeline around the Trustworthy Computing Memo and actions it set in motion that ultimately resulted in major improvements in Windows (and Internet Explorer). The security push began with cofounder Bill Gates' January 2002 memo. The "security push" (also sometimes called a "stand-down") was a halt to active development while the entire Windows development organization was sent to security training. This was mandatory training for all developers, testers and program managers. This push also saw a major reprioritization of resources off of the next version of Windows onto service packs for the then-current version, Windows XP. This prioritization would culminate in the release of Windows XP Service Pack 2 in August 2004, two-and-a-half years after the push was announced.

  Between 2002 and 2004 lies 2003, probably the worst year in the history of Microsoft security. January 2003 saw the return of crippling worm attacks in the form of Slammer, which targeted a vulnerability that had been patched in July 2002 with MS02-039 (a case that I handled). It was the first major worm attack since NIMDA in September 2001 and the first since the Trustworthy Computing Memo. Then, in August 2003, Blaster came through crippling networks that had barely recovered from Slammer.

  These attacks drove Microsoft's security push to be increasingly aggressive. Windows XP SP2 was code-named “Sledgehammer” in a sign of how it was meant to crush these bugs with extreme prejudice.

  Windows XP SP2 was a success in that regard and really marked a turning point. After Windows XP SP2 shipped it wouldn't be until Conficker in 2008-2009 that we would see another large scale network worm affecting Windows. And, touch wood, we haven't seen any since then.

  But the fact that Slammer and Blaster came after the security push was well underway highlights the lesson that we typically see an increase in attacks in that window after a security push is announced but before its results are released. This is due to two things:

  • First, you still have the same product out there that you had before announcing the push. Attackers continue their work that led to the announcement in the first place: they're not stopping.
  • Second, not only are they not stopping, but announcing a security push amounts to "last call": attackers know that the party will be over soon and so they're going to maximize their return on investment in their research to find exploitable vulnerabilities.

  Microsoft also saw similar spikes in attacks after announcing coming changes to Microsoft Office file formats meant to halt attacks. While Adobe didn't do a full scale security push, the company did also announce security improvements and saw similar increases in attacks after that.

  Based on this, we can expect that there's a good chance for increased attacks against Java until the improved Java code is out there and widely deployed.

  Get Ready for Things to Break

  The next important lesson comes from the Windows XP SP2 experience. The service pack introduced major improvements. But we have to remember at the time it came out, the cost was high. Microsoft disabled features by default and turned security features that could be intrusive on for the first time. For example, the Windows Internet Connection Firewall shipped in Windows XP at launch, but was turned off by default. Windows XP SP2 turned it on by default. It was the right decision and was a major factor in eliminating Blaster and Slammer-type worms. But it caused applications to break and was costly for customers to deploy.

  That was the most dramatic example but there were plenty of others. The key point is that when a company's posture towards a product shifts from prioritizing features and functionality above all to including security as a priority, it requires a ratcheting down of the freedom that developers and users are used to with that product. For Java, we've already seen changes around how Java handles unsigned or self-signed applets that will impact applets that are already out there. We can view this as the beginning of an ongoing process of security enhancements having an impact on existing applets and applications. Some things that worked fine on Java before will quit working and require retooling.

  Not Everyone Will Be Made Safer

  This relates to the problem of app compatibility (i.e. things breaking): because of the dramatic nature of changes, not everyone will be able to use those newer versions with the security improvements. Legacy applications and applets that simply can't be updated and can't be discarded will force some organizations and people to stay on older, less secure and no longer serviced versions of Java. Unfortunately, these people will form a ready pool of potential victims for attackers. In many cases, these people will be subject to multiple attacks at various points in time. A look at malware infection rates on both sides of the Windows XP SP2 line show that people on Windows XP Gold and SP1 were subject to significantly more malware on their systems.

  The question of resistance to adoption was always a hard one at Microsoft. We know that the significant changes in Windows XP SP2 kept some people from upgrading. Piracy was another factor. User education and lack of awareness were still others.

  Java will face all of these factors (except maybe piracy) as barriers to adopting new, more secure versions. Java will also face a hurdle that Windows generally didn't: it may be impossible to upgrade Java in some places. Java's cross-platform openness is its Achilles Heel here: software embedded in systems and devices often has no upgrade or update capabilities. And even where that capability does exist, the user may have no clue how to update.

  All of this means that even with major improvements to Java, there will still be millions of systems and devices that will be left behind and so subject to attack.

  Attackers Will Move On to Something Else

  At the height of security problems at Microsoft, we always said that when security in Windows improved we would see the people attacking Windows move on to other targets. Within the industry we know well that attackers focus on the easy targets and move on as targets harden. It's the truth of the old saw "You don't have to be faster than the bear, just faster than the other guy". As Windows and IE became harder to attack, we saw attackers move to Office file formats. As those were hardened, they moved on to Adobe Acrobat and Flash.

  Part of what we've been seeing with Java is that it's the latest soft target in the cross hairs. It's not like Java security deteriorated suddenly: these problems have always been there, they just haven't been exploited. Attackers have moved to Java because other targets (notably Adobe Acrobat) have gotten harder to exploit. Java's cross-platform nature also makes it more attractive in this post-PC world (giving truth to the joke we use to make about Java of "write once, patch everywhere").

  In time as Oracle's improvements take root, Java will be less attractive and attackers will look for the next big thing. This is where the rest of the industry needs to pay attention, watch for early signs of the next target, and move quickly to meet those attacks. We can't know who will be next up, but it's a safe bet that attackers will continue to focus on multi-platform technologies in this post-PC world.

  Of course, the best defense is a good offense and the best thing that others can do is to follow Oracle and Microsoft's lead and do their own security push NOW before they become a target. Unfortunately that likely won't happen: we've seen that when a vendor is under the gun like this, the industry likes to criticize and watch with schadenfreude. But there's very little movement to recognize these issues as the latest manifestation of an industry problem and address it as an industry.

  For myself, until we start to see the results of Oracle's push, I've got Java disabled. But I fully expect and look forward to using it once again. Based on my experience with Microsoft, I have confidence that Java will join Windows as being one of the best things out there from a security point of view. I'm glad to see someone following Microsoft's lead and look forward to who chooses to follow next.

  Photo Credit: pryzmat/Shutterstock

  Christopher Budd is a communications manager at Trend Micro. He is a 10-year veteran of Microsoft, where he oversaw and managed communications around online security and privacy incidents. He left the company in December 2010. Today uses his experience in the areas of threats to online security and privacy, crisis communications, and social media to help people better protect themselves.

  
• 

  Do I really need anti-malware?

  Publié: avril 12, 2012, 6:29pm CEST par Christopher Budd

  

  In the realm of security, there are a number of discussions that never seem to be completely resolved and crop up again from time to time. One of these is the age old question: “Is antivirus really necessary”?

  To the average PC user, the idea that antivirus (or more accurately, anti-malware) isn’t necessary may seem as crazy and dangerous as suggesting we get rid of seatbelts in cars (let alone keep airbags, antilock brakes and other safety features). For years, PC users have been told to “protect your PC” by running antivirus and keeping it and the system constantly up-to-date. Microsoft made these steps the foundation for its guidance to customers in the wake of the Slammer and Blaster worms in 2003 and that advice took root, helping to better protect PC users since then.

  Now More Than Ever

  Anti-malware is such a key part of PC computing that Microsoft has integrated anti-malware support ever more deeply into the operating system over the past few years. The company started with the Windows Security Center in Windows Vista, which warned if you weren’t running up-to-date anti-malware. Since 2011, Microsoft has offered a free antivirus solution, Microsoft Security Essentials, to Windows users. And Microsoft has indicated that they plan to include anti-malware capability integrated into Windows 8.

  At this point, even if you wanted to run Windows on your PC without anti-malware, the hassle of disabling notifications and warnings plus the availability of a free solution with Microsoft Security Essentials makes downloading and running that the path of least resistance. You would be hard pressed to find someone completely anti-malware free on a modern version of Windows.

  But the world isn’t what it was and as more and more people connect to the Internet using something other than a PC running Windows, the age old question is coming up again: Do I really need anti-malware?

  As someone with a long history in security, I can say that the answer to this is not only “Yes”, but also “more than ever”.

  Two Arguments Against

  There are really just two arguments that people make against running anti-malware:

  • First, that malware is really only a problem with Windows and that’s because of Windows’ fundamental security design flaws.
  • Second, that malware is a fabricated problem, hyped by security companies who are trying to scare you and convince you to buy their products.

  In the interest of full disclosure, I have to say here that I was part of Microsoft’s Security group for about ten years. And now, as a consultant, I do work with other security companies in the industry. But my views are my own and it’s my view that facts on the ground refute both of these arguments.

  Flawed Windows argument. The argument that the presence of malware somehow indicates an inherently insecure platform and so shouldn’t be a problem on a properly secure one is a logical fallacy. It’s not helped that this point is sometimes made by platform vendors to talk up the security of their products (as Jim Allchin once infamously did regarding Windows Vista, claiming he didn’t need antivirus on his kid’s system).

  Any security person worth his or her salt will say that, ultimately, code is code. On any system that’s designed to be extensible (i.e. that you can load new programs and applications on), there’s an inherent risk for what we would call “malware” because code that is “bad” to us (hence “malware”) is neutral to the system that executes it.

  Where secure design does play an important role is in limiting and preventing “bad” code access to the system and limiting the scope of actions code can take as much as possible. At most, one can say that a more secure platform creates a higher barrier to attack that deters attackers and drives them elsewhere. Think of it as the “you don’t have to be faster than the bear, just faster than the other guy rule”.

  This hasn’t prevented vendors and advocates for other platforms in the past from pointing at the disparity in malware and attacks on Windows and other platforms as “proof” malware is a Windows problem due to poor design. But, the changing world is proving that stance wrong. With successful Mac-based botnets like Flashback, increasing numbers of malicious Android apps, and even some dual-platform Windows and Mac attacks it’s clear that the threat environment is responding to a more diverse world with more diverse targeting and attacks. There’s more than one bear now, and it doesn’t matter who runs faster.

  Hyped malware treatise. The argument that malware is a hyped problem is a more nuanced one. The argument got its strongest start back in the early days of 1988 with Rob Rosenberger’s "Computer Virus Myths treatise". Rosenberger made some valid points (and his “False Authority Syndrome” is still a good read). The pressures of the marketplace can and do encourage security firms to talk up threats sometimes to the point of hype. But a look at any week’s online security news shows that incidents like the Global Payments breach do happen with frightening regularity.

  The growth of the Internet over the past fifteen or so years has moved a lot of the targets of criminal activity and espionage (state and corporate) from the physical world to the online world. That’s fundamentally changed the malware game. Before, viruses were nuisances that destroyed data and created havoc on stand-alone and network-connected systems (mainly PCs). Today, malware seeks to gain data that is lucrative (either financially or in terms of intelligence) by attacking the point at which users connect to the global Internet (desktops, mobile phone, tablets). In a way, it’s hard to hype the nature of the threat environment these days: the facts themselves put the threat nearly at maximum.

  Rosenberger’s points are important: everyone should think for themselves and make their own decisions around threats. But the realities of the threats online today coupled with the way bad actors are responding to a more diverse client base with an equally diverse set of attacks means that no one is truly safe anymore (though it’s arguable if anyone ever really was).

  Anti-malware is an inherently reactive countermeasure, yes. And it’s not a silver bullet. But it is a critical layer in a multifaceted approach to meeting the threats that are out there. In a way, heeding the claims of those who say “you don’t need anti-malware on my platform” is falling victim to another type of “False Authority Syndrome”.

  Photo Credit: olly/Shutterstock

  Christopher Budd is a 10-year veteran of Microsoft, where he oversaw and managed communications around online security and privacy incidents. He left the company in December 2010. Today he is an independent consultant using his experience to help clients in the areas of crisis communications, online security and privacy incidents and social media.

  
• 

  10 years after Bill Gates' Trustworthy Computing memo: What it meant for Microsoft and why every tech company needs one

  Publié: janvier 16, 2012, 9:03pm CET par Christopher Budd

  I joined the Microsoft Security Response Center (MSRC) in April 2001 and left the company in December 2010. During that time I was involved in security and privacy at Microsoft, culminating in my role handling worldwide crisis communications for security and privacy incidents. I am one of a handful of people who knows what the security world was like at Microsoft before Chairman Bill Gates' Trustworthy Computing memo on Jan. 15, 2002. I was also part of the growth and transformation that memo brought about over the years.

  As Microsoft marks the tenth year anniversary of that memo, it seems a good time to share a former insider’s view of what it really meant and accomplished. As well, I'll share thoughts on why, in the next 10 years, it’s critical that other technology companies follow Gates’ lead.

  Before: Security as Low Priority

  My friend and colleague, Michael Howard, has given a view of what the world was like in 2001 - 2002 over in the Secure Windows Initiative (SWI) group. Michael was actually one of the people that interviewed me: I remember sitting with him in the Building 40 cafeteria as he asked me why I wanted to take on a job this hard. At that time, security response was such a low priority that the MSRC was part of the Windows Server marketing organization.

  However, the Windows Server marketing group saw the value of fixing reported vulnerabilities in their products when no one else at Microsoft did. For the greater good of the company, they agreed to have the MSRC handle vulnerabilities in all Microsoft products (a very rare gesture back in those days).

  That underscored the reality that getting vulnerabilities fixed at Microsoft back then could be a tough challenge. Resistance was so stiff sometimes that we had a list among ourselves of regular justifications we would hear for not fixing issues ("No one’s found it so far, no one’s going to find it", "It's just a theoretical issue"). One of the things that Michael warned me about that made the job so hard was the resistance from product groups within Microsoft. Sometimes we in the MSRC would find ourselves more in alignment with outside researchers than our ostensible colleagues in other groups because of it.

  It’s well known how 2001 was a hard security year for Microsoft. The Code Red and NIMDA worms pushed us in the MSRC to the breaking point. Those crises showed that the resourcing and prioritization that the company was giving to security simply didn’t match emerging threats.

  Windows XP had launched in the fall of 2001 and the vulnerability reports quickly followed with a critical, wormable vulnerability reported by eEye Digital Security within weeks (which was fixed just before Christmas as MS01-059). As the new year rolled around, we were truly concerned that an overwhelming tidal wave of vulnerabilities and attacks lay ahead. We were all committed to doing the right thing, but felt we couldn’t because of lacking resources and prioritization.

  After: Security as Aspirational Ideal

  And then the memo came out. I myself wasn’t involved in it; I was too deep in the trenches. So, Gates' memo came as a bit of a surprise to me and to some of my colleagues. It’s not an understatement that the memo felt, to me, like the arrival of Gandalf and Eomer at Helm’s Deep in the film "The Lord of the Rings: The Two Towers" at a moment of great despair; at last we were getting some relief and might survive.

  There was understandable skepticism outside Microsoft that the memo was just a publicity stunt to blunt the criticism the company was getting then. And yes, the memo did serve that purpose. But it was real. Memos from Gates were viewed as rare pronouncements from on high, and that was the case with this memo. In a single movement, Gates enshrined security, privacy and reliability as central, aspirational ideals. Like all ideals, there have been better and worse times in realizing them, but their central importance was never open to question. That memo eliminated the resistance that made our work so hard and gave us the power to do the right thing for customers.

  

  Of course, the memo didn’t fix things overnight. The next two years would see the Slammer and Blaster worms, even more damaging than the worms of 2001. At the same time, a huge buildup and mobilization was happening internally to meet those threats. It took a number of years, but that memo led to the MSRC of today: a group that provides the most comprehensive and efficient response to vulnerabilities and attacks in the industry (and works to share that capability and coordinate with others).

  Equally important, it led to the Security Development Lifecycle (SDL), which has made great strides in making Microsoft’s newer products some of the most secure in the industry. The mark of that memo’s success around security response: it’s actually become rather boring from the outside (though I assure you it’s still not boring on the inside).

  The Future: Not One Memo, but Many

  But as we look at the successes the memo has yielded after 10 years, I think it’s more important to look forward. Specifically, during the next 10 years, other companies in the industry should emulate the aspirational ideals around security and privacy put forth in the Trustworthy Computing memo, and make them centerpieces in their respective cultures.

  When the memo came out, the MSRC and SWI were responsible for protecting approximately 90 percent of the people on the global Internet. So, the improvements this memo put in motion helped improve the security and privacy of 90 percent of the world’s computers. The reality today is that no one company can do that much good for so many. In the era of mobile and cloud computing, the market is more fragmented. Overall, that’s good for everyone. However, because only one major player in this space has enshrined these ideals around security and privacy, it means real security and privacy for people is at risk in a way we haven’t seen since before 2002.

  In the rush-to-market frenzy today, we’re seeing the same bad decisions that Microsoft and others made in the late 1990s and early 2000s. Those who want to do the right thing for customers at other companies lack the leverage that their counterparts at Microsoft have in the form of that memo. While much of the great talent that Microsoft assembled over the years has moved on to these other companies, spreading the knowledge gained as they go, their jobs are harder because they have to fight the same battles that Gates’ memo put paid to in 2002. At Microsoft, there is no question that security is a part of the development process; there is no question that vulnerabilities will be addressed. Other companies can’t necessarily say the same thing.

  During my time at Microsoft, the Trustworthy Computing memo empowered us as we stood for the security and privacy of customers and stood toe-to-toe with those in the company whose primary concern was revenue and growth. It gave equal weight to both sides. In a way, it represents a statement of conscience for the company and we used it as such, with success. Now, the best thing for it, like all ideals, is to break free and work for the good of more than just the person or company who thought of it.

  Hopefully, 10 years from now, we will be talking not just about Bill Gates’ Trustworthy Computing memo, but also Jeff Bezos', Larry Page's, Mark Zuckerberg's, and others. At the end of the day, where security and privacy are concerned, many of us who were in the trenches at Microsoft weren't just protecting the company's customers. We were protecting people and we wanted, and still want, to do what's right for everyone.

  Photo and Chart Credits: Microsoft

  Christopher Budd is a 10-year veteran of Microsoft, where he oversaw and managed communications around online security and privacy incidents. He left the company in December 2010. Today he is an independent consultant using his experience to help clients in the areas of crisis communications, online security and privacy incidents and social media.