Meanwhile, job one is to bolster the security of existing versions of Windows. In early October, just as the security problems were beginning to hurt Microsoft's top line, CEO Steve Ballmer unveiled the company's latest ideas: once-a-month software updates and shield-the-perimeter technologies. "Customers and [partners] have been pounding us, pounding us, pounding us for better patch-automation solutions," Ballmer said. The update schedule kicked in last month, while some of the new shielding technologies will be manifest in the Windows XP and Windows Server 2003 service packs due in the first and second halves of next year, respectively.
Gates, in a Nov. 17 interview with InformationWeek, said those changes, in combination with Microsoft's just-released Systems Management Server 2003, should result in a vastly improved security picture by the middle of next year: "I think even our critics [will] say, 'Wow, they really turned this patching thing around.'"
SMS 2003 features new software-vulnerability-identification and -assessment capabilities, a wizard that simplifies patch distribution, and improved integration with Microsoft's Software Update Services. Two other products due next year should also help: Software Update Services 2.0, which will automate the distribution of patches beyond Windows to include SQL Server, Office, Exchange, and other Microsoft software; and Internet Security and Acceleration Server 2004, an application-layer firewall that's designed to fight the latest worms and network attacks and create more secure VPN connections.
Some business-technology managers like what they hear but say it's premature to judge Microsoft's progress. "I look at it from the standpoint of bottom-line results. It's much too early to declare victory," says Al Schmidt, CIO and VP of technology with Arch Chemicals Inc., a specialty chemicals company with dozens of servers and hundreds of PCs that are slated for upgrades from Windows NT to newer Windows versions next year.
Schmidt agrees with Gates on one point: If Arch Chemicals can reduce the time and effort devoted to infrastructure security, the freed-up resources will go into new business-technology projects. "There's a ton of things we can begin to deploy," Schmidt says. "Every time we have to do a patch, it cuts into our ability to make these things happen. As the [patch] automation becomes available, I'll jump on it as quickly as I can."