REDMOND, WA – Microsoft has confirmed that the National Security Agency (NSA) aided the software company with respect to security for its new Windows Vista operating system, acknowledging that the NSA’s Information Assurance Directorate reviewed the Windows Vista Security Guide and provided comments included in the published version of the guide.According to Microsoft, The U.S. Department of Commerce’s National Institute of Standards and Technology (NIST) assisted in a similar capacity.
“Feedback from these agencies as well as enterprise customers informed Microsoft’s development of a security configuration guide to aid governments and other large organizations in deploying and configuring Windows Vista to meet their specific security and privacy needs,” a Microsoft representative said in an e-mailed statement Tuesday, according to CNET/News.com.
Don Armstrong, a senior program manager for Microsoft’s Government Security Program told CNET that the agencies did not have any special role in the development of Vista, but were free to provide feedback during the beta testing process just like any other beta tester.
Armstrong said the agencies “did not participate in the code development of Vista, they just had input in the security guide,” adding that nine agencies from five countries provided such input.
Tuesday, the Washington Post reported that the NSA had performed testing on Vista’s security using a “red team/blue team” exercise. The red team, positioned as a “determined, technically competent adversary” attempted to find and exploit vulnerabilities in Vista, while the blue team helped system administrators from the Defense Department to configure Vista and secure it against the red team’s attacks.
Tony W. Sager, the NSA’s chief of vulnerability analysis and operations group who described the NSA’s testing to the Post, said the NSA’s “intention is to help everyone with security.”
“It’s partly a recognition that this is a commercial world,” Sager said, according to the Post, noting that hundreds of thousands of Defense Department employees use Microsoft software.
“Our customers have spoken,” said Sager.
Microsoft also confirmed that this is not the first time that it has sought input and assistance from the NSA. According to the Post, Microsoft has consulted the NSA and had the agency review its operating systems for about the last four years.
Microsoft isn’t alone in having sought the help of government agencies in securing its software.
Apple spokesman Anuj Nayar stated in an email to thePost that the company works with “a number of U.S. government agencies on Mac OS X security and collaborated with the NSA on the Mac OS X security configuration guide.”
