eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Anything Microsoft can do to help computer security is welcome. But we wonder whether the latest initiative, dubbed Palladium, is designed to benefit mainly Microsoft or its customers.
The Palladium approach—which is only a concept now and years from full development—would create a trusted space in a computer where only trusted agents or applications could run. This would prevent from running certain malicious programs that could damage a computer—thats good—but Palladium falls short on other counts.
Computer security experts note that Palladium may prevent the execution of new malicious code but that it would not stop attackers from running existing code in such malicious ways as buffer overflows.
Users who want the benefits Palladium would provide must install the software on new hardware—provided, ostensibly, by Palladium partners Intel and AMD—that is designed to support it. Meanwhile, users will have to contend with worrying if Palladium will affect applications or peripherals that are not certified as compatible with the trusted software and hardware on the secure system. Users risk losing autonomy because they may not have complete control over what runs on their systems, and they may sacrifice anonymity as well because Palladium could enable digital rights watchdogs to track users activities.
Part of the problem with Palladium is Windows. How to secure something that is inherently insecure, which runs applications that tie into the operating system directly? Rather than rewrite Windows and build a secure or trusted operating system from scratch, as we have suggested, Palladium is yet another add-on solution that will be “integrated” into future versions of Windows. In short, Palladium fails to create the security we need and introduces new ways for Microsoft to control the ways we use computers.
Users want security but not in a form that yields control of IT assets to any vendor or other outside agency. Microsoft cant stay in the enterprise IT business without shedding its aura of laughable security and self-serving, short-lived remedies. Microsoft should consider making .Net the application interface to a bottom-up, brand-new operating system.