Redmond’s new focus on security is paying off, but the company still has a long way to regain its customers' trust, says Microsoft security programme manager Jesper Johansson.

Johansson — a Ph.D who left academia in search of more hands-on tasks — discovered security holes in Windows and warned Microsoft, and eventually got offered a job in Redmond. He is the author of several documents with practical tips on how to avoid security gaffes and tips on hardening Windows installations, and spoke to Computerworld while attending the Tech Ed developers conference in Auckland last week.

Some of the work he is involved in at Microsoft includes building security into the “design lifecycle” of applications. “We train developers to write better code and build threat models that show how an attack could happen,” he says.

A fan of OpenBSD, the open source operating system that emphasises security over everything, Johansson says Microsoft too vets its code for holes. “Automated tools check code for known security issues, and we have an internal penetration testing team plus use third-party consultants for this,” he adds.

Although Johansson has said that “system cannot ever be completely secure — at least not if you’re planning on using it” and that “the best security tool is a wire-cutter” (for snipping the network connection to the system), he maintains that despite this, it is possible to achieve a workable level of security.

“Security is a process that changes constantly” he says, when asked to explain his statements. The conflict lies in usability — the best-working IT solution is the one that is transparent to users — which hurts security as it increases the attack surface, according to Johansson.

Usability and security can marry, but it’s not cheap due to the greater amount of effort required, he says. Does management understand this? “Not quite,” Johansson says. "They are beginning to understand, but we are still seeing the ‘stare so hard at a tree that you don’t see the whole forest’ syndrome with customers.”

Johansson admits that Microsoft “has lost a lot of trust” due to the way it traded off security for usability and features in the past, and says it will be a “gradual change before users discover that our products are safe.”

He held up the small number of security advisories for Windows Server 2003 as an example of the emphasis on safe computing is working and what customers should consider. “We have halved the number of security advisories for Windows Server 2003 compared to Windows 2000,” Johansson says. However, he adds there is room for improvement because “we’re not proud that there have been 25 advisories for Windows Server 2003.”

The real success security success story is the latest version of Microsoft's web server, IIS 6, he says. There has only been one security advisory for IIS 6, and that was for an obscure hole that would be difficult to exploit, according to Johansson.