eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
As I see it, the biggest question in the security business this year is how well Windows Vista will hold up against what will be the most concerted attack in the industrys relatively short history.
The standards for a fair analysis of this question are more complicated than many would have you believe: Vista doesnt have to be perfect in order to hold up well. As even Microsoft will tell you, if you actually listen to what the company says, nothings perfect, and a big part of hardening a product against attack is to be prepared for when a failure occurs.
This is why you keep hearing from Microsoft about “Defense in Depth.” The idea is that a failure in one form of protection can be mitigated by other protections. And these protections dont stop with what is provided in Windows Vista. Any reasonable person, business or consumer, will add further security software to Windows Vista.
There is a widespread consensus in the security industry that Vista is a more secure Windows and, for what its worth, the most secure version of Windows ever. Of course, theyll tell you thats not enough, and of course theyre right.
But the situation is an uncomfortable one for security companies: even though its indisputable, as I just said above, that you need to get modern anti-virus/host intrusion detection and prevention software for a PC running Vista, to the extent that Vista has better defenses in other regards, it could diminish demand for their products. We know that people let their licenses lapse and that they respond to things going badly. If things do turn out generally smoother with Vista, then people will let licenses lapse—and they will be more likely to get away with it.
Another variable is that Microsoft included Windows Defender, an anti-spyware program and updates for it, with Vista. Even if its a bad anti-spyware program, as competitors generally claim (wow, whod have thought theyd say that?) youre better off with it than with no malware protection.
Security vendors are obviously irritated at Microsofts entry into the business. You can buy desktop and server security products and services directly from the company. I havent tested either, but while the independent test results Ive seen for Microsofts consumer solution, Windows Live OneCare, dont look impressive, its enterprise solution, Forefront, (which uses multiple scanning engines) fares much better. The established security biggies feel threatened.
Of course, Microsoft was unable for legal reasons (or was the company just unwilling?) to include OneCare or a similar product with Vista itself, and OEMs control all the real promotion of add-on security products.
Next page: Microsofts real claims.
Microsofts Real Claims
If you want a good perspective on what Microsoft really says about security for Vista read the Windows Vista Security Blog. Youll find claims there to be a lot more conservative and restrained than youd expect from a lot of the reporting on the matter.
The most prominent example of this phenomenon is what happened to poor Jim Allchin when he discussed, at a time before Vistas release when no release-level anti-virus protection was available from anyone, how his own 7-year-old sons system had no anti-virus protection. Allchin had locked down the system in so many other ways (using parental controls, user access control, and lack of access to e-mail and instant messaging) that he was comfortable allowing his son to run without anti-virus.
Competitors and knee-jerk critics turned this into a “claim of invulnerability” by Microsoft, as if Allchin had said that Vista didnt need anti-virus protection. No doubt when the first threat to Vista that can addressed by anti-virus comes along these same people will point back to this claim Microsoft never made and the failure it supposedly represents.
But dig past the misrepresentations and you see in the core of Allchins statement that Microsoft understands the fragility of every individual security feature, and that the security of the system is defined by all of them acting together. Consider the recent revelation of a vulnerability affecting Vista and other versions of Windows. As detailed in a recent Symantec Security Response blog, the bug is very hard to exploit on Vista. And it goes beyond that. A well-administered system would have other protections against the introduction of this exploit, including e-mail blocks on executable attachments, warnings against unsigned code, even anti-virus software. Vulnerabilities in a secure system dont automatically translate into exploits.
So a year from now how will we be able to judge if Vista has met reasonable expectations for security? One obvious answer is that if enough significant vulnerabilities are revealed—really critical ones as opposed to the moderate one above—Such developments would undermine Microsofts claims for its security development life cycle.
Another measure will be whether significant numbers of Vista users become compromised. This could be tough to judge, at least for business, since there may not be significant enough numbers of users by years end.
But I think that well all have a good sense of things by then anyway. IT managers will know whether their Vista systems are more resilient and trustworthy than their Windows XP systems or, for that matter, Linux and Mac boxes. All kinds of things are possible. And if a consensus emerges about that by the end of the year, that will be the big story of 2007.
Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983. He can be reached at [email protected].
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at Ryan Naraines eWEEK Security Watch blog.