Microsoft: Code is better, not perfect

Toulouse: I think a lot of people confuse an attack vector with a product that has vulnerability. There’s a challenge on what is a vector and what is the vulnerability, and that’s just a matter of opinion in a way. To the extent that people talk about unsafe features being a vulnerability -- what do you do when you adhere to a specification and that specification turns out to be unsafe? They have their opinion on it, we have our opinion on it. We certainly respect the guys over at Secunia. It doesn’t mean that we won’t go back and take a look at that. There are times when we will look at functionality when it gets co-opted by attackers and we’ll make a modification. That’s always on the table.

IDGNS: Microsoft has made some changes to its security teams. The Security Technology Unit (STU) is now part of the Trustworthy Computing (TWC) team? How is that going to change Microsoft’s tact on security?

Toulouse: Everything is still a little bit up in the air because as reorganizations go the complexity often is what drives the time. But the current situation is such that the STU and TWC groups, which have mutually complementary goals for driving secure code, will merge. What does that get called in the end? I don’t think that’s been decided yet. Function-wise and roll-wise I think you are going to see the exact same thing. We committed to this as a company. We’ve got to have this group that sits away from everybody and provides security expertise and review. That’s critical to ingraining security as a culture.

IDGNS: How would you describe the relationship between Microsoft and the independent vulnerability hunters?

Toulouse: It depends. The security researcher community is incredibly diverse. All of them have different viewpoints, different philosophies. Our relationships with security researchers are probably better than they ever have been. We’re certainly seeing more security researchers working with us, but we’re also seeing researchers who go public [with vulnerabilities before informing Microsoft]. When we actually sit down with these guys and ask “Why do you go public?” the answer surprised us. They said, “To protect customers.” Now unfortunately from our perspective is that the attacker can take it and go use it. We engage in a dialogue with them [security researchers]. We may disagree on method from time to time.