Right out of the gate at the CIO Summit, Microsoft assumed the role of being their own worst critic. In light of the security concerns over the past year, this makes a lot of sense. I have an appreciation for the approach that they took in communicating about the security problems. If you don't critically analyze your performance in an area, it is impossible to learn and change behavior. Steve Ballmer's main point is that Microsoft must do a better job of helping customers to secure their IT infrastructures without slowing down technology innovation. To quote Steve, he said "we're not living up to your expectations, but we have less vulnerabilities than virtually any other system available." But no excuses were being made, and there was a real sense that Microsoft takes this problem very seriously. They also claim to recognize that they need to do more. Based on the talk, I think they're taking a balanced approach. They will continue to focus on new products but get better preventive measures in place for product engineering to mitigate the introduction of vulnerabilities into their software. Steve also talked about the issues with both new systems and "down-level systems". Microsoft is trying to continue to support older versions of Windows and to ensure that they can be secured, but there are real limits that actually affect customers. During the Q&A, one customer talked about upgrading a few hundred Windows NT workstations (by 2005!), and their concern about continued support to keep NT4 secure. It points out that much of the IT world simply cannot move at Microsoft's pace.

Ballmer had some other interesting comments, and as you would expect he made some provocative statements. He referenced Bill Joy's recent comments on monoculture, and said that that it was "hogwash". His reasoning is that even with multiple platforms the problem space for security doesn't really change that much, and that more platforms actually could increase the complexity of dealing with the problem. He also made reference to a discussion with a Homeland Security official, saying that security in the technology realm has a strong parallel with national security under the threat of terrorism. He said that "the bad guys only have to get it right one time, but the good guys have to get it right every time." Towards the end of the talk, Steve said "if i could write a check for a billion dollars and most of our customers would be secure overnight, I'd write the check and go explain it to the analysts." I believe him, but the problem is that fixing the problem won't be that cheap or that easy.