Microsoft does make patches available more quickly than in previous years, said Mitchell Rubin, president of Lynx Consulting Group, which specialises in Windows-based systems. But the process needs to be streamlined. "It's still difficult to figure out which patch to download, and you have to go to multiple places to do updates for Windows and Office," he said. Microsoft has said it is working on a revamped patch management system, which is expected to debut in the spring.
In addition, the company is planning extensive security modifications to Windows XP as part of the second service pack that Microsoft plans to release for the operating system by summer this year.
Microsoft milestone
Rubin said that overall, the Trustworthy Computing push has been a milestone for Microsoft. "They have improved a lot, especially in the last year. They launched the initiative two years ago but took six-to-nine months to sort things out. In some senses, Microsoft has too many products, so that makes it harder."
As a result of the initiative, Microsoft has also changed how it handles security advisories, which it issues to alert customers about security problems and the severity of these.
Rather than releasing advisories every two or three weeks, the company now publishes the notifications once a month. It has also turned up the pressure on the underground programmers that create worms and viruses by offering a bounty on the people or groups who released the Sobig.F virus and the MSBlast worm.
Moreover, some of the bug finders that have been the bane of Microsoft's public image for years are starting to take a softer stance toward the company, encouraged by greater cooperation from the company's security groups.
"They are acting more responsibly," said Thor Larholm, a senior security researcher for security firm PivX Solutions and a frequent finder of bugs in Microsoft's products. "The have lived up to the spirit of Trustworthy Computing, even if they still have problems."
Yet some security experts wonder if Microsoft's flurry of activity actually indicates progress.
