Mark Litchfield wrote:
I have heard the comment "It's a huge conflict of interest" for one
company to provide both an operating platform and a security platform"
made by John Thompson (CEO Symantec) many times from many different
people. See article below.
http://www2.csoonline.com/blog_view.html?CID=32554
In my personal opinion, regardless of the vendor, if they create an
OS, why would it be a conflict of interest for them to want to protect
their own OS from attack. One would assume that this is a responsible
approach by the vendor, but one could also argue that their OS should
be coded securely in the first place. If this were to happen then the
need for the Symantec's, McAfee's of the world would some what diminsh.
Anyway I am just curious as to what other people think.
Thanks in advance
Mark
I think it's a conflict of interest for the OS vendor to become a
Security platform vendor for a couple of reasons.
First, if a vendor made security a priority in the SDLC for the OS and
wrote secure code, then the security platform market wouldn't exist.
It's good to see Microsoft making great strides in this area.
Second, since they develop the operating system, they have a more
detailed understanding of the potential vulnerabilities in their
product. Since they have this in-depth knowledge, they have to make a
decision about protection. Should they fix the problem with a free
OS-patch and release it as part of their normal patch cycle? Or, should
they include 'protection' for these vulnerabilities in their 'security
product' which is a premium add-on to their base OS product, and
includes maintenance/licensing costs?
If you're a conspiracy nut, or just a Microsoft-hater, you're more
likely to believe the latter. If you're a pro-Microsoft fan, then
you're likely to believe the former. Unfortunately, because Windows and
the Microsoft security products are black boxes, we, the security
community, have no way of knowing which choice they've made.
Third thought: If a company makes a security product, there's always the
question as to whether or not the vendor makes securing the OS or
improving the security product a priority.
Just the $0.02 of a raving lunatic.
Thanks
Jonathan
