Sanity Check: Total Cost of Omissions

by Bill Carico
September 25, 2008

Software from Microsoft is the largest carrier of digital disease (i.e., viruses, worms, and other malicious software) on the planet. Despite decades of rewrites, overhauls and security patches, Microsoft has yet to provide adequate security and error recovery frameworks within its operating system code base. The shameful reality of Bill Gates’ legacy is that he has overseen the creation of a software world where the rogue rules.

Vendors are clearly at fault when they omit security features, and the resulting exposures in their products allow customer systems to be compromised. Shameful is an appropriate adjective because the world of Wintel viruses could have been avoided. Microsoft could have provided a security framework, similar to what has kept mainframes virus-free for almost five decades, by leveraging hardware security features provided by Intel’s chips to prevent its system code from being compromised. Such omissions have allowed digital disease to thrive at the expense of its customers.

Mainframe protection begins with hardware detection of software program exceptions, which renders rogue programs dead on arrival. This level of hardware intelligence enables the z/OS authorized program facility and supplemental layers of sophisticated access control software to make the system impenetrable. This tightly integrated security framework even keeps mixed workloads isolated from each other. Add a mountain of recovery code, and you have the formula for a bulletproof z/OS that also delivers 99.999 percent availability. By the way, don’t expect IBM to publicize the fact mainframes are virus-free; why challenge the creators of digital disease to attempt to prove otherwise?

At long last, Microsoft has begun work on a new non-Windows operating system. Code-named Midori, the plan is to start from scratch since key parts have been missing all along.

Microsoft has been criticized for more than three decades for its shoddy development practices and poor security design choices, as evidenced by superfluity of development methods, Remote Procedure Calls, and service exits in system code (and let’s not forget Easter eggs).

Linux on Intel is younger, yet has better security than the Wintel Petri dish environment. How can this be? Before the PC came out in 1981, Bill Gates needed an operating system and he didn’t have one. So, he acquired QDOS from Seattle Computing. QDOS, which stood for Quick and Dirty Operating System, primarily consisted of a set of assembly language utilities written a year earlier by an individual in only two months’ time. Microsoft hurriedly expanded it and released it as MS-DOS (sans security), and as soon as PCs were networked, they became sitting ducks for rogue programs.

In 1976, I had been in the industry for only three years when I went to work at MRI Systems, a database software vendor. One day I asked Jim Collins, a senior developer, why development took so long. Jim explained, “To write commercial software to perform a task is usually pretty easy, but it’s only about 10 percent of what’s needed. Ninety percent of the effort is taking care of all the things that can go wrong.” This means that when the approach is quick and dirty, the casualties are security and recovery features. Trying to retrofit security and recovery as addons is like building a house without plumbing or HVAC, then spending years trying to insert water pipes and HVAC ductwork into a hardened slab and finished walls.