Yes, But Is Microsoft Trustworthy?

Joe Wilcox News Analysis: Microsoft finally dropped its big RSA Conference announcement: A call for trust.

I'm not at RSA, where Craig Mundie, Microsoft's chief research and strategy officer, unveiled the company's "End-to-End Trust" vision. (Microsoft doesn't use hyphens; I added them.) Microsoft's objectives are troubling and shouldn't be misunderstood. While issuing a call to the industry and for vendor neutrality, Microsoft's proposal mainly benefits its own platforms.

As is typical of this kind of announcement, Microsoft's goals are broad and nebulous. Microsoft wants to:

• Create a so-called "trusted stack" for authentication from the operating system.
• Develop an identity system facilitating online "authentication, authorization, access and audit." (I will simply die if Microsoft uses AAAA as the acronym.) I got that from Microsoft's press release, which should have referred to I4A (identity claims, authentication, authorization, access, and auditing).
• Align technological, "social, political and economic forces."

Microsoft's first step will be integration of Credentia's U-Prove technology, which was acquired last month. U-Prove's security approach is trendsetting, based on a concept sometimes referred to as "minimal disclosure."

In a short blog post, Craig Wittenberg, a Microsoft identity and access technical strategy architect, explained: "Microsoft's vision of end-to-end trust will require strong authentication across hardware, software, people and data (when desired). We refer to this as a 'trusted stack.'"

In two-page summary titled "Creating a More Trusted Internet," which Microsoft published today, Scott Charney, corporate vice president of the Trustworthy Computing group, added little concrete to the nebulous goals:

"We believe there are three key pieces to creating greater trust on the Internet. The first is creation of a trusted stack where security is rooted in hardware and where each element in the stack (hardware, software, data and people) can be authenticated in appropriate circumstances. The second piece involves managing claims relating to identity attributes. We need to create a system that allows people to pass identity claims (sometimes a full name perhaps, but at other times just an attribute such as proof of age or citizenship).

"This system must also address the issues of authentication, authorization, access and audit. Finally we need a good alignment of technological, social, political and economic forces so that we make real progress. The goal is to put users in control of their computing environments, increasing security and privacy, and preserving other values that we cherish such as anonymity and freedom of speech."

Charney's 23-page whitepaper "Establishing End to End Trust"—also published today—is a pretty good read. He identifies real online privacy and security problems (overstating some of them) and lays out broad principles for improving trust.

The last section, "The Obvious Challenges," identifies those nebulous "forces" that must come into alignment. Charney makes the tough observation that social and economic values often aren't in alignment with one another or with broader privacy and security safeguard objectives. For the social, he rightly observes: "An anonymous world cannot be the ultimate objective, either, particularly in a world marked by identity theft." He correctly concludes that "economic forces can drive certain behaviors...even when those decisions do not serve security well."

It's the technological goals that bug me. Maybe my years of covering Microsoft have made me cynical. The use of "stack" and "operating system" means Windows to me. Then there is Microsoft's press release subtitle about "broad collaboration to extend Trustworthy Computing to the Internet." Doesn't that mean the extension of Microsoft security technologies?

What does Trustworthy Computing really mean? I've heard Microsoft use the term for years in constantly changing contexts. At one time, Trustworthy Computing referred to Windows Vista's security platform. Then, poof! In fairness to Microsoft, the broader, nebulous concepts outlined in Mundie's October 2002 whitepaper haven't much changed. But the realization of those concepts in real products is more questionable, particularly Windows.

I commend Microsoft's leadership initiative but question its objectives. The security "stack" is supposed to be hardware-based at the core, which could mean platform independence. But Microsoft's inclusion of "operating system," presumably means Windows, whether desktop or mobile device. More importantly, I don't see enough in the proposal about the Internet cloud. On the contrary, Microsoft's call for end-to-end trust ignores the cloud, which should be one of the most—if not themost—important points.

Charney's paper rain dances all around the cloud, but doesn't make precipitation. The approach is hardware-and-software centric, even though trust is needed in online scenarios.

I do trust Microsoft to promote its platforms, which is what this so-called broad industry call is really about. Microsoft wants to use trust as differentiator for Windows and its other platforms. Considering how often Windows is hacked or patched, how trustworthy is that?

Create, Communicate, Collaborate with IT Professionals at Ziff Davis Enterprise IT Link.