Microsoft's top three Vista security features
548753
(InfoWorld) - MicrosoftÂ finally rolled itsÂ Vista operating system out the door Tuesday, billing it as its most secure operating system ever, but what are the security features that will really matter to enterprise users? To answer this question, IDG News Service asked Russ Humphries, a senior program manager with the Vista security team, to list the three Vista features that will have the biggest effect. Here's his list: 1) UAC (user account control) Before Vista, Windows automatically gave users too much power over their systems, Microsoft has said. With UAC, Windows will require a few extra steps before the user can do things such as install new programs. The feature will make it much easier for corporate administrators to lock down desktops and prevent users, or malicious programs, from messing around with the system or installing unauthorized software. UAC has been one of Vista's most controversial features with early testers complaining that they were overwhelmed with pop-up messages warning them about every little change they made to the system. But these warnings will not slow down most enterprise users because they won't be installing device drivers or software, Humphries said. "Most corporate users are going to get a corporate image that will have all their applications already installed on the image," he said. 2) Windows Defender With Vista, Microsoft has built a defense against pop-up ads and unwanted spyware right into the operating system. AlthoughÂ Defender has been criticized for not being as effective as commercial products, the fact that it will be so widely deployed is bound to improve things. "Adware is a huge annoyance, a security risk, and a bit of a machine hog, " Humphries said. "This has benefits for home users, small and medium-sized enterprises, and even large organizations." 3) BitLocker There have been more than 100 million U.S. victims of data breaches over the past two years, according to Privacy Rights Clearinghouse. BitLocker aims to prevent the next 100 million from getting hit quite so quickly by giving corporate users a way to encrypt and password-protect their data. With BitLocker encrypting Vista's data, a stolen PC doesn't turn into a front-page data breach story,Â as was the case with the U.S. Department of Veterans Affairs last year. BitLocker can also ensure that the operating system hasn't been tampered with at boot-up time, but customers seem to particularly appreciate the fact that it will help keep their companies out of the newspapers every time a laptop is lost. "I've had a lot of thank-yous from our customers," Humphries said.
662461
A Windows Vista feature designed to simplify computing for disabled users has security implications, according to a McAfee researcher.
405119
The keyboards, mice, Webcams and headsets sport features for the upcoming Vista operating system.
254458
Microsoft is taking security risks with its forthcoming Vista operating system, says software firm McAfee.
82092
"Patch Tuesday," when Microsoft Corp. releases repairs for problems in its software, came and went this week with six critical fixes &#151; including the first one that touches Vista, the new operating system billed as the most secure Windows version yet.
103983
BBC Click investigates free security software and finds out who will protect PCs when Microsoft launches Vista.
490322
Microsoft has included new security-related APIs in soon-to-be-released service packs for Windows Vista and XP to expand the use of Data Execution Prevention, an anti-exploit technology.
45525
The software giant addresses three vulnerabilities within the Windows operating system.
178790
Considered important vulnerabilities that leave users open to attack in Microsoft&#39;s (Nasdaq: MSFT) Windows for desktop and server installations, the Redmond
420940
(InfoWorld) - As Windows VistaÂ appeared in computer stores worldwide, Microsoft said Tuesday that part of the design of the new operating system is the work of the European Commission. "Following discussions with European Commission, Microsoft committed to make a number of changes to the Windows Vista operating system prior to release," the software maker said in a statement, pointing to three functions of the operating system: security, search, and fixed document formats. Windows Security Center (WSC), which looks like a dashboard, gives the user an overview of what security software is running on the system and the status of checks and upgrades of firewalls and antispyware protection. Rival security software firms and the Commission suspected this could give WSC an unfair advantage. Microsoft said it agreed to develop a new set of APIsÂ for release in the first service pack, scheduled for later this year, which can be invoked by third-party security programs to turn off the alerts presented by WSC. Similarly, PatchGuard -- software that protects against the modification of the kernel of the operating system -- has been added to Vista. Some security vendors have in the past made modifications to the kernel as part of the implementation of their security software. PatchGuard prevents such modifications in the 64-bit version. Microsoft is now working with vendors to develop new kernel-level APIs that will provide programmatic access to the kernel to address this issue, Microsoft said. The APIs will be available in Windows Vista 64 with the first service pack, scheduled for later this year. Regarding search, Microsoft has changed the way default settings are made for Internet search within both Windows Vista and Internet Explorer 7 (IE7). "These changes now ensure for users that they are able -- through a series of windows and options -- to make a clear, conscious, and open decision on their default search provider. Furthermore, users will retain at all times the ability to change this and all further defaults in the operating system at will," Microsoft said. Microsoft's own fixed document format software is known as XPS. "In response to the Commission's concerns, the company has made fundamental changes to the licensing structure of the XPS fixed-format technology and has committed to submit the technology to an international standards body for adoption as an open industry standard," Microsoft said. The XPS standard will be made available under licensing terms that do not exclude any industry or licensing model including the GPL (general public license), it said. "In response to Commissioner Kroes' letter of March 2006, Microsoft created a singleÂ API so that independent software developers can create applications to allow users to save documents in XPS or other formats, such as Adobe's PDF," Microsoft said. Microsoft said it has also disclosed through a licensing program the relevant information to enable the implementation of XPS technology on competing client and server operating systems. Microsoft has also responded to a further Commission demand to submit XPS (as well as future extensions) to a standards-setting body. Microsoft will submit XPS to the Ecma International. Microsoft said it will also enable the implementation of XPS under an open-source business model (GPL) through use of a covenant not to sue -- a model that Microsoft has applied to Web services and open XMLÂ  document formats and that has, it said, "been welcomed by the open-source community." European customers and OEMs will be able to buy a version of Vista that has Microsoft's Media Player stripped out. This unbundled version of the operating system complies with the 2004 European antitrust ruling, which ordered the company to offer two separate versions of both the home and professional versions of the operating system. "In compliance with the European Commission's decision of March 2004, home and professional editions of Windows Vista without Media Player functionality will be released in Europe on the same schedule as the Windows Vista general availability launch," Microsoft said. These are called the 'N' versions -- denoting "no media player," the company said.
166796
Microsoft Corp. on Tuesday released 12 security fixes for its Windows operating system and Office business software.
190490
Microsoft issues patches for holes that could allow remote attackers to gain control of your PC. Microsoft this week released 10 software security patches for its products, including seven it deemed critical
411146
Six high priority updates, in all Microsoft is to issue four critical security fixes for this month's Patch Tuesday. Three of these affect either Windows Vista or Internet Explorer 7, which the software maker holds out as a paragon of its conversion to secure computing. In all, Microsoft will push six high-priority updates this Tuesday, the company announced today.â¦
416302
(InfoWorld) - Symantec published a series of four research reports on Feb 28 that critique various security elements of Microsoft's new Windows Vista operating system, including the software's ability to ward off existing malware threats. Unsurprisingly, the security software maker, which still derives the bulk of its revenues from the estimated $3.6 billion market for technologies used to defend Windows computers, found a fair number of shortcomings in the latest iteration of Microsoft's dominant OS. One of the biggest problems is that Vista remains vulnerable to existing malware attacks designed to take advantage of flaws in earlier versions of the OS, according to the reports. However, the Cupertino, Calif.-based antivirus market leader also highlighted a number of features built into the product that it said will advance end-user security. An area where Symantec researchers said Microsoft has greatly improved security is related to the mitigation of virus attacks aimed at code-level vulnerabilities. Previous versions of Windows have been shipped with scads of coding errors that allowed hackers to deliver malware threats, but work on the part of Microsoft -- such as through its Security Development Lifecycle program -- has helped lower the volume of available vulnerabilities, according to the reports. The immediate benefit to Vista users will be the reduction of threats that use common infection techniques like buffer overflows and heap manipulations to deliver their payloads, Symantec predicted. Another area where Symantec recognizes security improvement on the part of Microsoft is in the use of its reduced user privilege model in Vista, which is aimed at preventing virus attacks from upping the administrative status of infected PCs to boost malware proliferation and related damage. While arguing that there may be the ability for hackers to disable Vista's new User Access Control, which is designed to keep users abreast of any changes attempted on their PCs by unknown software programs, Symantec concedes that the security tool should help fight malware attacks, including worm viruses. Despite the praise and its submission that Vista thus far appears to be the safest operating system ever produced by Microsoft, the Symantec reports levels a great deal of criticism at many other aspects of the OS. Vista is a more secure product than previous versions of Windows, but there is still plenty of need for users to buy the layered security defense products the security company markets, said Ollie Whitehouse, a researcher with Symantec's Security Response team. "Vista is a security evolution, but not a revolution," Whitehouse said. "Microsoft did invest a lot of time and resources into the development of Windows XP SP2, and Vista is a continuation of that, and they addressed a number of core issues, such as buffer overflows, but it is still only an OS, not a security solution itself." Vista may help stop some traditional types of attacks, such as worms, but Symantec maintains that newly emerging threats, integration problems with third-party Windows applications, and a range of other issues will keep users in the market for additional security tools. One area that remains a sore spot from Symantec's perspective is Microsoft's use of new features to protect the Vista kernel against root kits and other attacks. In 2006, a major controversy broke out between the two firms and other security technology providers based on the fact that Vista's PatchGuard system, available only in 64-bit versions of the OS, prevents any programs -- including Symantec's security applications -- from patching the software's kernel memory. Symantec and rival McAfee, among others, argued at that time that not being allowed to access the kernel as they have in prior iterations of Windows would prevent their advanced behavior-based technologies from working properly. But Microsoft and the security firms claim to have solved the problem using a set of APIs. In the research reports, Symantec repeats its contention that PatchGuard may also be easily bypassed, defeating its very purpose and allowing kernel-altering attacks, including root kits, to live on. Labeling the combination of PatchGuard and two other Vista kernel protection technologies, known as Driver Signing and Code Integrity, as a mere "bump in the road" for attackers, Symantec said that a single researcher bypassed all three features in one week's time, further proving their vulnerability. "Microsoft has made good strides with kernel protection, but again, it's not perfect," Whitehouse said. "PatchGuard has and will be broken, and while it is obviously better than nothing, people who have an interest will find ways to get around these features." Another area where Symantec leveled criticism at Microsoft is in relation to Vista's ASLR (Address Space Layout Randomization) feature, which is designed to help obscure programs stored in the operating system's memory to make it harder for attackers to isolate vulnerabilities. Symantec said the feature has a flaw that prevents it from working properly. Here again, Symantec mixed praise and calls for concern in outlining its observations of ASLR. "When implemented correctly, this technology is extremely effective in mitigating the exploitation of memory corruption and memory manipulation vulnerabilities," reads the Symantec report. However, the research contends that Symantec has already found that one element of ASLR that means to randomize and hide software components does not work consistently, therein making it easier for attackers to guess where vulnerabilities may lie. Symantec said further that Microsoft has confirmed the issue and pledged to fix it when it issues a Windows Vista SP1 update. Both the PatchGuard and ASLR issues feed into another Vista problem cited in the Symantec research: integration with third-party products. In addition to the potential problems introduced by PatchGuard to its own products, Symantec said that the third-party drivers provided by Microsoft may be targeted as a means of gaining kernel-level access on compromised machines. ASLR has been highlighted by at least one other security company as a potential weak point in Vista. Just as Symantec maintains that many of Vista's security features won't help protect end-users unless third-party software makers can effectively integrate with the tools, penetration testing specialists Core Security, based in Boston, published a report on Feb. 6 that highlighted a well-known vulnerability existing in CA's BrightStor backup software that it said could still be exploited on machines running Vista. Because the CA software had not been updated to integrate with ASLR and other Vista security features -- although CA said it would soon have a new version of the product to market and Microsoft officials disputed the issue -- the operating systems' onboard defense features won't help protect such legacy systems, Core said. Symantec's report repeatedly highlights the third-party integration issue as a major weak point for Vista's security goals. Microsoft officials stuck to their long-standing defense that Vista goes a long way toward mitigating many common PC security issues and that the company will continue to bring new security features to bear on the OS and future products. Microsoft said it is further investigating several specific product flaws cited in the Symantec report, including the ASLR problem. "It is important to note that none of the security features in Windows Vista, either individually or collectively, are intended as a 'Silver Bullet' solution to the problem of computer security," said Russ Humphries, senior product manager, Windows Vista Security. "We believe Microsoft has developed the right balance and made the right decisions when evaluating the tradeoffs between usability and security," Humphries said. "[Symantec's] report does not properly address the fact that many of the Window Vista security technologies have numerous options that allow for a user to make their own judgments as to their need for security balanced against usability."
714146
According to security researchers, Windows Vista's speech-recognition feature is flawed and hackers could use it to remotely force a PC to execute commands.
250538
Now that Microsoft has released the Windows Vista operating system and the Office 2007 productivity suite, talk has shifted from months of launch-date speculation to concerns over specific safeguards needed to ensure that the new software is secure.
768081
Microsoft Corp. on Tuesday released several security fixes for its Windows operating system and Office software, and rereleased two previous patches.