Steering Microsoft clear of hackers

Listening to you talk about the scope of the security challenges, it sounds as if Microsoft remains a moving target. In other words, that there's no way you're going to be ready to declare final victory on such and such a date, and that's that.
I think that it's a process. Absolutely.

But what's the overall strategy, as opposed to, "we're going to a perimeter initiative?" I hear "initiative, initiative, initiative," and then I hear "patch, patch, patch, patch, patch." There must be something grander.
At a higher level, we talk about trustworthy computing and DSI. (Dynamic Systems Initiative, a Microsoft strategy to make corporate data centre equipment better able to self-manage.) Both are umbrella programmes in which we're putting many efforts together.

Do they map into each other?
Sure they do. DSI is partly aimed at tracking all sorts of issues that are associated with managing systems -- including security vulnerabilities. DSI's core is to start with the development process, to look at the entire life cycle of an application, and to look at how to improve the communications of information and knowledge of each participant in the creation of that application. That does not exist today.

Can you give a practical example how this is going to play out?
Today's applications are multifaceted in the sense that they run on multiple computers and have very complex interactions. There's nothing that captures that in a standardised way that can be tacked on as knowledge. People have it in their heads. They may write it on a napkin or print something out, but they don't systematically capture that and pass it on. Well, that's a critical thing to make those operators more effective -- and that's part of what we're doing with DSI.

And here's the security component. The understanding of all the components and all the interactions between components is key to understanding the potential vulnerabilities that could exist within a secure system. If something happens to one component, you can replace it or perhaps create a wall between that component and keep the system operating.

Someone might say what Microsoft's doing is intuitive and that it should have already solved the problem. How is what you're doing more complicated than that?
This is our top priority for everything we're doing.