Microsoft: Security comes under scrutiny

Jim Allchin, Microsoft's vice-president for platforms, took the stand at the remedy hearing in its antitrust case yesterday to...

Jim Allchin, Microsoft's vice-president for platforms, took the stand at the remedy hearing in its antitrust case yesterday to give evidence about the company's focus on providing users with computer security.

Kevin Hodges, an attorney for the states suing Microsoft, asked Allchin whether Microsoft intended to use a clause in the proposed remedies that said the company could withhold its Windows protocols and application programming interfaces (APIs) from third-party developers if it felt the security of the operating system could be compromised.

Hodges wanted to know if that clause was supposed to be interpreted narrowly. Allchin said it would force Microsoft to "fulfil our obligation, we'd have to prove that [disclosing an API or protocol] would compromise security".

When asked if the proposed security exemption was broader than it needed to be in order to protect the security of Windows, Allchin answered no.

Hodges showed the prehearing interview of a Microsoft security expert, who said all that Microsoft would need to withhold are Windows' cryptographic keys and their locations in order to ensure the security of the OS.

Allchin said he disagreed. He gave the example of the Windows message queuing protocol that contains a mistake and, if left unfixed, "would compromise a company using it". He added that if Microsoft were forced to disclose that protocol before a fix is distributed, Windows would be vulnerable to security breaches.

A Microsoft spokesman confirmed that the protocol flaw exists and a fix has not yet been distributed.

Hodges asked Alchin how many APIs and protocols - in addition to those related to cryptographic keys, their locations, and message queuing - that Microsoft would have to withhold to protect Windows' security.

Microsoft is still in the process of determining that number, Allchin said. "I do feel quite strongly that I have to look after our customers," he added.

Allchin did say, however, that Microsoft has already decided it would not invoke the security carve out in the proposed remedies to withhold its extensions to the Kerberos security specification from disclosure.

Read more on IT risk management

SearchCIO
SearchSecurity
SearchNetworking
SearchDataCenter
SearchDataManagement
Close