But Antonopoulos and Blum both say Microsoft has improved with Vista and XP2.

"The problem is Microsoft has developed a bad reputation and it's hard to outlive that," Antonopoulos says. Microsoft has plenty of talented engineers with identity and trust expertise, but their ideas expressed during engineering conferences seldom seem to get adopted in Microsoft software."I think they must get overruled."

For some third-party security software providers that work closely with Microsoft, it's also been trying at times.

"It's been a roller coaster," says Phil Lieberman, president of Lieberman Software, which makes password and administrative management tools that work with Microsoft desktop and server products."The problem with Microsoft is it's not just one company; it's divergent ones on different paths fighting each other."

In some Microsoft units, such as those managing CRM or Office products, there's no effort to work with third-party applications for security while"the core operating system group is more open," Lieberman says.

But the most aggravating part of working with Microsoft -- which may be necessary to gain official Microsoft certification -- is that the company isn't keeping up on the technical documentation.

"A tremendous amount of the operating system is undocumented," Lieberman says."They're moving so fast and doing so many releases and updates, no one is keeping track of what they're doing. For instance, if Microsoft goes and changes something for Patch Tuesday, and a [Data Link Library] is changed, they don't bother to change the documentation, and your application stops working. We have to go research this and we find they've changed it."

While acknowledging Microsoft's poor track record, others are a tad more conciliatory.

Microsoft's efforts to improve have had a"positive impact," says Oliver Friedrichs, director of Symantec's Security Response division."We have to give Microsoft some credit for improving operating system security."

In the past few years there just haven't been the types of devastating worm attacks, such as Code Red, Blaster and Nimbda, that exploited holes in Microsoft products to wreck havoc around the world.

"Attackers today are focused on the third-party Web plug-ins," Friedrichs adds.

"It's easy to pick on Microsoft because they're ubiquitous and historically had a problem," says Jon Gossels of SystemExperts."But year after year, their products are getting better, and a lot of professionals out there are trying to find the bugs."

NAC: Is your firewall enough?

Network access control (NAC) isn't for everybody, but it can be a valuable tool for controlling the circumstances under which individuals gain network access.

That can be valuable for heavily regulated businesses. NAC can perform a comprehensive check of endpoints before they are allowed to get on to corporate networks, and that kind of check can help placate regulators that demand enforcement of policies about how legitimate endpoints must be configured.