A Matter of Choice

It was a chance comment that set me thinking. A well-placed friend of mine in the information security business remarked that once Microsoft started to rollout its own anti-virus solutions, the line of new anti-trust litigants would bring Washington traffic to a standstill.

You’ll remember that Microsoft bought the Romanian anti-virus vendor, GeCAD in the summer as part of its continued Trustworthy Computing drive. At the time, there were quiet murmurs of concern from some voices but the industry mostly pulled together and supported the move. The principal anti-virus shops appeared unruffled and talked bravely about value-add services and how no single vendor, including Microsoft had a universal solution to the information security problem that faces us today.

So the big picture, rather like the presence of a modest firewall in Windows XP, seems to be one where Microsoft delivers software which is, as the mantra goes, is ‘Secure by design, secure by default and secure by deployment’. It then stirs in a basic firewall and offers anti-virus, rather like MSN, by subscription to those who want it, making sure that any offer is equivalent in price to that being offered by everyone else happily involved in making billions of dollars from the insecurity business.

You see, I rather suspect that Microsoft might simply prefer to build fundamental security and anti-virus capability into the Windows Operating System or even give it away in the shape of add-ons, ensuring that security, like fresh air, is available to anyone who might want it. This is not a concession or an admission that Windows is any better or worse than any other platform, simply a recognition that in a vulnerable environment, every effort has to be made to protect the customer.

But Microsoft is still not out of the shadow of the Netscape anti-trust case, where it was revealed that it gave away Internet Explorer as a deliberate spoiling strategy and consequently destroyed the market for Netscape’s Navigator. You see, today if Microsoft in a grand gesture suddenly declared that in the customer’s interest universal anti-virus would be free or incredibly cheap, there would be a howl of outrage from every company profiting from the unhappy state of information security in a largely Microsoft world. This is roughly measured in terms of $50 per seat, per year for every Internet-connected Personal Computer on the face of the planet that chooses some form of anti-virus protection of which many still don’t because of the costs.

Think about it for a moment. Microsoft might possibly want to put the past behind it and play the responsible citizen, pouring billions into the fight against computer crime. I might not hear cheering but I do see some nods of approval, after all, better late than never and if the growth of a ballooning Infosec budget can be reversed even a little, then even better for business.

What I think might happen in 2004 is that Microsoft is going to find itself having to compete in the information security business, not because it might wish to but because the law says it has to. This is rather like one large drugs company wishing to deliver a cheap generic cure for a disease and rival companies going to court and having such a measure declared anti-competitive and illegal.

The future then for everyone else might be one where we continue to pay more for basic information security as a value-added benefit, in addition to the high cost of any Windows license, because a court might decide that we have to, in the interests of fair competition in the computer industry. Does that seem right?


Popular posts from this blog

Civilisational Data Mining

The Nature of Nurture?