This is a logical fallacy.
Microsoft's spotty record on security is not a result of poor security policy, but a result of two factors:
1.) Microsoft's codebase is massive, and the number of bugs in an application is directly proportional to the number of lines of code in that program.
2.) Microsoft's applications are under much more scrutiny than most other software companies. This means more people are trying to break the code, so more people *are* going to break the code.
Does this mean Microsoft has ideal security policies? No. Does it mean they're off the hook when they screw up? No. It simply means that to say that Microsoft shouldn't advise the government on software security because they have themselves fallen victim to hackers is bass ackwards.
They have a huge amount of experience in the matter. They have thousands of experts.
In addition, their security policies are almost always sound... it's the USERS that don't follow them. (Nearly all security expolits would be rendered impotent if people read and understood the Microsoft security best practices document: http://www.microsoft.com/technet/treeview/default.asp?url=/technet/security/bestprac/bpent/bpentsec.asp)
Has anybody here read "Writing Secure Code", a Microsoft Press book? I'm about 3/4 of the way through it, and it is excellent. Most people, even anti-MS people, agree it's the "bible" of code security.
Microsoft's security problems are not a result of poor policy (and therefore wouldn't lead to poor advice), they're a result of a lapse in *implementing* their own policies.
|