In un intervista Adrienne Hall, senior director delle strategie di Trustworthy Computing in Microsoft, parla degli sforzi compiuti rivolti alla sicurezza di Windows Vista.

Nell'intervista si citano Windows Defender, un tool anti spyware; il filtro anti-phishing di IE7; BitLocker Drive Encryption, un tool per la criptare dischi; User Account Control, per l'amministrazione dei privilegi degli utenti e Group Policy for Devices, per il controllo dei device rimovibili.

Q&A: Trustworthy Computing at Five Years

Adrienne Hall, senior director of Trustworthy Computing strategies at Microsoft, discusses the company’s sustained commitment to delivering secure, private and reliable computing experiences based on sound business practices.

REDMOND, Wash., Jan. 16, 2007 – In 2002, Microsoft Chairman Bill Gates launched a concerted effort to make providing a secure, private and reliable computing experience for everyone a top company priority. Five years later, Microsoft is seeing the benefits of this work. A host of products and services, including Windows Vista, are clearly reflecting the principles of Trustworthy Computing. PressPass recently spoke with Adrienne Hall, senior director of Trustworthy Computing strategies at Microsoft, to discuss the company’s Trustworthy Computing progress and plans as the nature of security and privacy threats continues to evolve.

PressPass: What is the status of Trustworthy Computing as it reaches its five-year mark?

Hall: Trustworthy Computing started five years ago as a vision. We wanted to make personal computing as secure and reliable as common utilities, such as the telephone. At the time, we talked about how almost anyone in the developed world could buy a new telephone and plug it into a phone jack without ever worrying whether or not it would work. People simply assumed they would get a dial tone and had a level of expectation about the quality of the experience they would have. Our goal was to develop that same type of trust in people’s computing experiences. The basic desire to improve the level of trust in computing has remained a constant, and will continue to be part of what we see as the long-term journey of Trustworthy Computing.

PressPass: How has this journey evolved over time?

Hall: Microsoft has transformed Trustworthy Computing from a startup initiative to a company tenet – a core principle that shapes everything we do and influences every aspect of our business. With that in mind, we expanded the concept of Trustworthy Computing into the areas that are integral to a trustworthy computing experience: security, privacy, reliability and business practices.

Over the past five years, we’ve also seen a cultural shift within the company and a heightened commitment to all the elements that comprise Trustworthy Computing. We regularly look at how much we invest in technology to provide the best customer experience possible, as well as how effectively we share knowledge, learn from others and collaborate with industry partners, government and academia to improve the overall computing experience. In addition, we regularly assess whether the guidance, training and tools we provide are timely, accurate and easy-to-understand.

PressPass: How does Windows Vista reflect Microsoft’s Trustworthy Computing efforts?

Hall: Windows Vista contains a number of new features and technologies that, taken together, are designed to make Windows-based PCs much more secure and reliable and online experiences safer. These improvements help individuals and organizations keep their PCs free from viruses, worms and spyware, and maintain the integrity of sensitive personal and corporate information.

In addition, companywide Trustworthy Computing policies and internal guidelines were followed throughout the development of Windows Vista. Our Security Development Lifecycle (SDL) requires mandatory developer training on writing secure software code and rigorous review and testing of code before it’s included in the product or service. This helps ensure that security is an intrinsic part of how Microsoft develops software. Likewise, our software development process follows Microsoft’s internal privacy guidelines, which reflect customer expectations and global privacy laws. In 2006 we released a public version of these privacy guidelines, so our best practices can be shared with other companies to help them develop more privacy-enhancing software and services. Similarly, Microsoft is committed to providing industry partners with fundamental tools and resources to help build more secure products via the SDL, including threat-modeling tools and developer training on writing secure code.

Throughout the development of Windows Vista, we extensively tested the product. For example, in addition to the tens of thousands of people who participated in the beta testing program, we also received more than 130,000 customer-feedback reports, and provided online services for independent software vendors and corporate developers that helped them assess the reliability and quality of their applications against the various builds of the operating system.

PressPass: Can you give us some examples of features in Windows Vista that demonstrate the company’s progress with Trustworthy Computing?

Hall: Many of the security- and privacy-enhancing features in Windows Vista benefit consumers, technology partners, business- and public-sector customers alike. For consumers, there’s Windows Defender, which helps protect computers against security and privacy threats, as well as performance issues related to spyware. The Phishing Filter in Internet Explorer 7 helps people browse more safely by advising them about suspicious or known phishing Web sites. And, Family Safety Settings help monitor and manage Web sites that children might visit and help keep them safe from online threats.

For businesses and organizations, BitLocker Drive Encryption provides enhanced data protection should laptops be lost or stolen. This protection is achieved by encrypting the entire Windows volume. According to a recent study by the Ponemon Institute LLC, 61 percent of survey respondents said that accidental data leaks occur "frequently" or "very frequently" because employees or contractors lack sufficient knowledge about preventative measures or because employees or contractors are careless. User Account Control reduces...