Microsoft s Trustworthy Computing Initiative | Design for Trustworthy Software: Tools, Techniques, and Methodology of Developing Robust Software

Microsoft's Trustworthy Computing Initiative

In October of 2002, Microsoft distributed a white paper titled "Trustworthy Computing" from a team headed by Craig Mundie, Senior Vice President and CTO, Advanced Strategies and Policy.^[1] In December 2002 the company distributed a major policy statement based on industry response to the October white paper; it was called "Building a Secure Platform for Trustworthy Computing."^[2] Review of these white papers was a major incentive for the authors' research leading to this book. We consider the Microsoft Trustworthy Computing Initiative to be a significant driver of the development of trustworthy enterprise business applications software. The initial white paper noted that not only must the industry learn to make software trustworthy, but because computers have already lost people's trust, "we will have to overcome a legacy of machines that fail, software that fails, and systems that fail."^[3] Hence, Microsoft's Trustworthy Computing Initiative is a label for a whole range of advances that must be made for users to be as comfortable using devices powered by computers and their software as they are using devices or appliances powered by electricity. One of the authors once lived in a house in Wheeling, West Virginia built just after the turn of the 20th century. Each light fixture in the house had two globesone powered by electricity and the other by gas illumination. When the newfangled electricity failed, you could always light the gas lamp and not be left in the dark. A hundred years ago, electricity was not as trustworthy as it is today, but it became trustworthy as the requisite infrastructure and quality developed. This too will happen with computing, as it has with all new technologies.

In January 2002 Bill Gates issued a call to action, challenging his employees to build a trustworthy computing environment for customers that would be as reliable as our electrical networks (which, by the way, are not perfect and do fail, sometimes catastrophically). The four goals of trustworthy computing are as follows:^[4]

Security: The customer can expect that systems are resilient to attack and that the confidentiality, integrity, and availability of the system and its data are protected.
Privacy: Customers can control data about themselves, and those who use this data faithfully adhere to fair information practices.
Reliability: The customer can depend on the product to fulfill its functions when required to do so.
Business integrity: A product's vendor behaves in a responsive and responsible manner.

At the same time, Microsoft created a framework to track and measure its progress in meeting the security goal. Because Microsoft was the leading vendor of desktop operating systems, its products were the primary targets of Internet attackers. We will present this framework and its objectives because they provide a good segue into this chapter's topic of measuring the software development process generally, from design through deployment, and, of course, the inevitable redesign.

The security goal can be factored into the software's being secure by design, secure by default, and secure in deployment, as well as communications. The goal of secure by design includes eliminating any security vulnerability at design time and adding any features needed to enhance security. The designer or architect has the best opportunity to eliminate both errors of commission and errors of omission at the very beginning of the development process by observing three practices:

Building a secure architecturethat is, designing function around security requirements
Adding security features, even if they are not necessarily demanded by end-user functionality
Reducing vulnerabilities in the code

Secure by default means shipping software at a basic or default functional level. In other words, features that probably would be used only by an advanced user are turned off as the default condition. This means that the user who eventually turns on an advanced feature will more likely take responsibility for managing its use in his or her environment.

Secure in deployment results from adding capability in the software to support users in five distinct but related activities:

Protecting systems by ensuring that data is accessible only to trusted users
Detecting attempted intrusions, security violations, and unexpected behavior
Defense by appropriate corrective action when an apparent security violation occurs
Recovery of systems that have been compromised or experienced unexpected failures
Managing the preceding activities by having appropriate policies and procedures in place to coordinate and manage these activities

Communications involves informing everyone in the user organization who uses the software of the appropriate policies and procedures. It also involves ensuring that the software vendor informs and trains users properly, releases patches promptly, and warns of new attacks, best practices, and changes in technology.^[5] Although technology and sound engineering underlie software security, much of the solution lies in improved social infrastructure, which is merely enabled by technology.