Will Microsoft ever get security right?

When it comes to security, can Microsoft get any respect?

Even Bill Gates has humbled himself at times to explain why Microsoft has fumbled the ball so often on security. In his last public appearance at the RSA 2007 Conference, on stage with Craig Mundie, to whom he handed the baton to direct product security going forward, the two offered a mea culpa explanation on why Microsoft's software has fallen short.

"Humans are humans and they make mistakes," said Mundie, with the duo later indicating that the inadequate security plaguing Microsoft software in the past can be traced to a naivete in the early years based on the perception few controls were needed because"everybody was really good" and the data center seemed carefully tucked away.

This decades-old baggage remains a burden for Microsoft, says Andreas Antonopoulos, senior vice president and founding partner at Nemertes Research.

"Even today, the fundamental design decisions made 25 years ago still haunt Microsoft," Antonopoulos says."Windows Vista is not a new operating system; there are a lot of the older operating systems under the cover, which carries with it the baggage of the last 20 years to ensure backward compatibility of applications."

Microsoft is caught in a conundrum, Antonopoulos asserts. If the company really decides to make a fresh start on software, it would likely have to sacrifice financial advantages."That's not likely to happen," he says.

Burton Group analyst Dan Blum expresses a similar opinion, saying,"They are compromised in that sense. They have the constraints of backward compatibility in mind."

A few years ago, Microsoft sought to make a break with the past in what was called the Next-Generation Secure Computing Base (NGSCB) project, but"they killed it," Blum says.

According to Blum, Microsoft remains driven along a path of"convenience and flexibility and backwards compatibility," which gives them the best advantage in the marketplace. Blum muses if he were Bill Gates, he would have tried a"parallel approach" to develop a next-generation trusted operating system, even if it broke with existing applications.

In other respects, Microsoft has produced a viable identity strategy overall, Blum says, but it's been hobbled by its Windows-centric approach."They never put a stamp on any platform that's different," he says. Microsoft's lack of support for the SAML standard, for instance,"is a big mistake and not in the best interests of the industry."

Linux, Unix and Macintosh operating systems ship with better"secure by design postures" than those from Microsoft, Antonopoulos contends.