Microsoft has offered free protection with Microsoft Security Essentials (MSE) for some time, and it recently expanded the availability of the antivirus protection for small businesses. A recent move to push out Microsoft Security Essentials to Windows systems that don't have any antivirus protection, however, has some rival security vendors up in arms. From Microsoft's perspective, though, it's a little "damned if you do, damned if you don't".
Security vendors like Trend Micro and Panda Security take exception to Microsoft pushing its free AV on Windows users. Trend Micro's complaint seems focused simply on the anti-competitive aspects, while Panda Security takes a slightly higher road with a more pragmatic assessment of the situation.
Panda Security's Pedro Bustamente explains in a blog post, "We agree with Microsoft; it's better to have some protection than not having any at all. However the way the guys in Redmond are executing the idea is risky from a security perspective and could very well make the malware situation much worse for Internet users."
Bustamente then goes on to detail his arguments -- not crying that Microsoft is using its operating system monopoly to squash competition, but making the case for why Microsoft's approach might cause more harm than good.
I have worked with Pedro, and I respect his opinion, but I must differ on a few points. First, Bustamente points out that MSE is only pushed to Windows systems that are validated as authentic licensed copies. However, an estimated 40 per cent of the Windows systems out there are not legally licensed, and malware infections are more prevalent on the pirated systems, so Microsoft is leaving a major segment of the Windows culture unprotected.
That is true, but so what? Even if Microsoft offered MSE for unlicensed copies of Windows, many would reject it out of fear that Microsoft would use to it detect and hunt down the illegal Windows systems -- possibly disabling them remotely. Panda and other third-party security vendors already offer free solutions that would work for that 40 per cent. The very fact that those 40 per cent aren't using the free tools that are available suggests they're simply not interested.
Pedro then explains how Microsoft pushing MSE to all unprotected systems creates an AV monoculture where all systems are running the same AV protection, and any attack that can exploit or circumvent that protection will spread -- unchallenged -- and cripple the entire Internet.
There are some valid points to the monoculture argument, but as a whole it is simply a myth. Take any two systems running Windows 7 and protected with MSE. There are still a thousand variables that make these systems different -- the software installed, the peripherals and drivers in place, the browser used, the existence (or not) of additional protection such as personal firewall software, or a network firewall.
The list goes on, and the fact is that even if Microsoft protected every Windows system not currently running a competing AV solution, there are still millions upon millions of Windows systems running the various other AV products available -- and vendors such as Symantec and McAfee may very well present a larger security monoculture environment than Microsoft.
Ultimately, Microsoft is in a catch-22. It is caught between those who feel that Microsoft is responsible for developing flawed software and should take responsibility for providing the protection it needs, and those who feel that any attempt on the part of Microsoft to implement new tools or security controls is somehow monopolistic and anti-competitive.
Bustamente asserts that Microsoft should save the time and effort dedicated to pushing free MSE to unprotected systems, and instead focus all of its resources on just developing more secure software in the first place so there wouldn't be a be a need for security software. However, if that Utopian vision were actually possible, security vendors like Panda and Trend Micro would be out of business.
Microsoft is routinely crucified by the media, and by rival companies for the weaknesses in its software, and the perception -- however misguided -- that Microsoft software is less secure than other products. Microsoft is in a position that makes it the most attractive target for malware developers, and it has the burden of protecting Windows users, and its own reputation.
Is MSE the best security protection available? Probably not. Is it adequate? Yes. Is it better than nothing? Without a doubt.
Microsoft should constantly be working on simply making more secure products in the first place. However, it is hard to fault Microsoft for also providing the protection that today's Windows systems need, and proactively pushing it to Windows users too naïve or ignorant to implement baseline security measures on their own.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.