Vista may slip again - so what?

Looks like the G-men are projecting that Microsoft is going to slip Vista another couple of months. Here's the Reuters story.

I want to be very clear on this. I don't care when Vista ships and neither should you. Anyone that is building a security architecture around Vista is nuts. Who knows when it's finally going to arrive? Best case volume shipments won't be in the market until midway through Q1 2007. We all know that you never never never never never deploy a 1.0 release from Microsoft, so you are looking at probably Q3 2007 for Vista SP1, right?

I'm no mathematician folks, but that's over a year away. A lot of bad stuff can and will happen in the next year. So if I were you, I'd be focusing on what needs to be done today. Is your perimeter in good shape? Does some stuff need to be refreshed? Are you looking at NAC? What about identity management? Have you addressed some simple endpoint solutions, like application control? What about your data center? Are your web applications protected? Your databases?

See my point? There are lots of things you need to worry about and Vista isn't one of them. Unless you are a one person shop, you are not going to snap your fingers and be 100% Vista on day 1 and expect that all your problems will be gone. It's just not going to happen.

So do me a favor and think about security pragmatically. Figure out your future state (as I described in this AM's post on security ROI) and work on a plan to get there. It's OK to figure out how and where Vista and Longhorn (the server side of Vista) fit into the mix, but make sure you aren't planning on them for another 12-18 months.

And forget about all the media frenzy this week about whether Vista will be delayed some more. The media loves these kinds of projections - which generate a lot of page views. Let the pundits fight it out. Keep in mind that ultimately for you and me it doesn't matter when Vista ships.