Foreword

Writing Secure Code for Windows Vista is a very important book for everyone in the high-technology industry. The ideas expressed in this book represent the latest thinking in creating the trustworthy experience every user of technology expects.

Microsoft’s vision for the use of technology by all segments of society is based on the notion that Moore’s law will continue, creating ever more powerful, and ever less expensive, computers that can be applied in an increasing number of ways to meet the needs of all types of people. With the continued growth in broadband networks, including new wireless technologies, these devices will be connected to each other locally and across the world, giving people unprecedented access to information, media, and services with a level of convenience we are only starting to fathom. This vision is not only Microsoft’s; it is shared by many across the high-technology industry. No matter your commercial or technological allegiance, this vision spells out how our industry will grow, how we will generate commercial success for our businesses, and how we will all contribute to a world that is more convenient for everyone and that allows every person to reach his or her full potential. It is a wonderful vision–and none of us can wait to get there.

There is one important baseline requirement to fulfill this vision. If people of all walks of life are to join us in this wonderful, connected, digital world, they will need to trust the technology. People want to know that their privacy is guaranteed. People want to know that their critical information is safe from theft and vandalism. People want their experience to be reliable and simple. This is growing harder all the time.

At Microsoft, we track the activities of the hackers and criminals who work on Internet very closely. The environment is growing more complicated: offenders range from people who hack into systems for fun and fame to organized crime. It is estimated that Internet-based criminals caused billions of dollarsin losses across the world. That kind of money can fund a lot of engineering, and it means criminals are more persistent than ever in finding even the most obscure vulnerability in every kind of high-technology product. It is no longer feasible to assume that nobody will notice a vulnerability in a product. We have reached the age where if a vulnerability is present, it will get noticed and exploited.

As hacking for profit grows, the criminal community is becoming more organized in sharing information on vulnerabilities. We now live in an environment where criminals specialize in “weaponizing” vulnerability information, driving the time between the identification of a vulnerability and a profitable exploit of that vulnerability to zero. These specialized criminals are the arms dealers of organized crime on the Internet, and they sell their wares to the highest bidder.

Because of the evolution of the criminal hacker community, it is even more important for everyone producing high-technology products to use rigorous engineering standards, such as the Secure Development Lifecycle, to minimize the chance that there is a vulnerability in a product. Because high-technology products are made by human beings, there is no guarantee of zero vulnerabilities. However, we as an industry can band together and use our community to maximize our defenses.

As a software platform, Windows has a special role in helping software companies of all kinds make it as easy as possible to deliver software that is secure from vulnerabilities and exploits. Writing Secure Code for Windows Vista was written to aid anyone writing a Windows application to follow security best practices that are proven to deliver fundamentally more secure software products. Windows Vista was designed with features that give software writers platform tools that aid in making their software secure. These features represent Microsoft’s best understanding of what software applications need in the areas of authentication, data protection, and protection from exploits. By using the new security features of Windows Vista, applications become more secure and trustworthy in customers’ eyes.

The journey to create the connected digital vision is a long one, and there will be many fits and starts as the high-technology industry works together to deliver convenience and value to all types of people. One important requirement of success is creating technology products that people trust. Writing Secure Code for Windows Vista will help all of us deliver fundamentally more secure and trustworthy products to our customers.

Jon DeVaan
Senior Vice President of Engineering Excellence
Microsoft Corporation
February 2007