Microsoft talks up security at DC Vista launch
687485
Talking up the new release at a launch event Tuesday, a Microsoft VP said that during Vista's development, "Every single time we had a trade-off between application compatibility or security, we went with security."
52279
NEW YORK -- Microsoft Corp. took great pains to improve security in its newly released computer operating system, Windows Vista, redesigning it to reduce users' exposure to destructive programs from the Internet. Outside researchers commend the retooled approach -- yet they say the changes won't make online life much safer.
43197
Red tape vs Redmond...the never ending story The European Commission has hit back at suggestions it has got it in for Microsoft over security features built into the heavily-delayed Windows Vista.â¦
43593
(InfoWorld) - Microsoft Corp. released tools to help companies deploy Windows Vista, acknowledging that there are deployment and application-compatibility pains enterprise IT managers face when updating business desktops to the new OS. The company unveiled the new tools, Data Encryption Toolkit for Mobile PCs and Virtual Hard Drive (VHD) Test Drive, atÂ the TechEd 2007 conference in Orlando Tuesday. The first helps IT administrators set encryption policies for laptops in an enterprise using the encrypting file system and new Bitlocker features of Windows Vista, said Stella Chernyak, a Vista product manager at Microsoft. The second is a file that can be downloaded from the Internet that allows enterprises to run a virtual version of Vista on PCs for a 30-day evaluation period to see how it will interact with other applications in their systems. The VHD Test Drive is available online, and more information on the Data Encryption Toolkit can be found on Microsoft's Web site. Business adoption of Vista has been a big concern since the OS was released to business customers last November. Many companies said they would hold off on fully deploying the OS longer than they usually do mainly because of concerns about application compatibility. Indeed, Chernyak acknowledged Tuesday in an interview that lack of application compatibility is the biggest challenge enterprise customers face when they deploy Vista. She said this is why Microsoft released the Vista Application Compatibility Toolkit simultaneously with the general availability of the OS instead of some time after, which it has traditionally done. The VHD also gives enterprises a chance to see what applications will be affected by the new OS so they can make compatibility adjustments before investing in Vista. Three of Microsoft's large enterprise customers, Continental Airlines, Charter Communications and health-care company Cerna Corp. also will have major Vista deployments in their enterprise by the end of the year, Chernyak said. Microsoft claims most enterprises are on schedule to a full rollout of Vista 12 to 18 months after its release, which is about normal for a new Windows OS, she said. Still, not everyone is rushing to deploy Vista, and smaller companies in particular are wary of adopting the OS until making certain it will work with everything in their systems. TechEd attendee Ryan Engh, infrastructure manager at 130-person mutual funds company Wasatch Advisors in Salt Lake City, said his company is still about 12 months from beginning a Vista deployment, though two IT staff members are "playing with it" to see how it will interact with applications in the system. "We'd be more aggressive if it wasn't such a drastic change in the operating system," he said. Engh said he was not aware of the new deployment tools from Microsoft, but likely would not use them anyway because he is currently more concerned with application compatibility than actually deploying the OS. "I'm not so worried about the deployment, it's just if the application will actually work on the system," he said. "We're not even worried about [deploying Vista] yet." Microsoft also said at TechEd that it would make its previously announced Microsoft Desktop Optimization Pack (MDOP) available by July for Windows Vista with a new feature for monitoring desktop errors so IT managers can identify errors and send a fix across all enterprise desktops at once. MDOP, unveiled in January, consists of software from Microsoft's purchases of Softricity, AssetMetrix, Winternals Software, and DesktopStandard. It rolls up virtualization software from Softricity, asset-management software from AssetMetrix, group policy-management software from DesktopSoftware, and diagnostic and recovery tools from Winternals into a product designed to help companies manage desktops in an enterprise. The Softricity and Winternals components of the pack are already available for Windows XP, said Winni Verhoef, a senior product manager for Microsoft. All of the components of MDOP will be available for Vista in July except the Winternals diagnostic and recovery tools, which won't be available until next year. It is taking Microsoft a bit more time to port those tools to Vista because they had to be rewritten for the new architecture of the client OS, he said. MDOP costs about US$10 per desktop and is available only to Microsoft customers who have purchased its Software Assurance service. Â
592673
Microsoft urged Windows Vista users to download a new security tool that automatically disables suspicious or malicious "gadgets," the small applets that mimic the "widgets" popular on Mac OS X.Dubbed "Windows Sidebar Protection," the 1MB download was added to Windows Update on Tuesday and classified as a "high-priority" update. Microsoft customers running Vista RTM -- the initial version that launched in late 2006 to businesses and early 2007 to consumers -- saw the update on the list starting Tuesday. The update is optional, but depending on what settings have been selected in Windows' Automatic Updates, it may be downloaded and installed without any additional user interaction.Windows Sidebar is a Vista-only panel that holds the miniature applications known as gadgets -- small single-purpose tools that, for instance, display the time and date or RSS feeds. The Windows gadgets are composed of HTML and various scripts.And there's the rub, said Microsoft."Vista treats gadgets like it treats all executable code," said the advisory that accompanied the update. "Gadgets are written using HTML and script, but this HTML is not located on an arbitrary remote server as Web pages are. HTML content in the gadget is downloaded first as part of a package of resources and configuration files and then executed from the local computer."In other words, gadgets could be dangerous, even malicious. The small applications are crafted not only by Microsoft but also by third-party developers and users; Microsoft distributes gadgets on its Web site, but it doesn't vet them."The update gives us a mechanism to prevent a malicious gadget from being installed first of all, and if it's installed, to block the gadget [from running]," said Austin Wilson, a director in the Windows client product management group. "We're being proactive here. We looked at the [security] landscape and wanted this in place in case a problem arises in the future."There are no known vulnerabilities in any existing gadgets, Wilson claimed, stressing that Microsoft knows of no purposefully malicious gadgets, either.When it detects a flawed, suspicious or malicious gadget, Microsoft will create a "kill bit" file that it will then push to users through Windows Update on the regular once-a-month patch day, said Wilson. Yesterday's update included no kill bit, stressed Wilson, but instead is the tool that generates a unique ID for each gadget, accepts the list from Windows Update and then blocks existing gadgets from running or newly-downloaded gadgets from installing.After a gadget has been identified as bad, its icon gets swapped out with one labeled "Bad Gadget." The icon also can't be dragged, and the tool tip shows it as a security risk.The Sidebar security update is already integrated in the bits that were distributed as Vista Service Pack 1's release candidate last month, said Wilson, and it will be included in the final when that launches in the coming weeks.Microsoft has posted a pair of documents on its support site that go into more detail: KB943411 includes the download links to the 32- and 64-bit versions of the tool; KB941411 walks users through the various dialog boxes they will see when the tool tries to bar or block a gadget.
319294
(InfoWorld) - Top executives from the security firm McAfeeÂ went on the offensive Monday against Microsoft, saying Vista will be even less secure for customers than previous versions of Windows. The day after McAfee took out a full-page advertisement in the Financial Times to publicly air its grievances over the security of Vista, McAfee Chairman and Chief Executive Officer (CEO) George Samenuk, Vice President and Chief Scientist George Heron and Chief Security Architect John Viega delivered the same message in person in New York. "We are disturbed by the fact that with Vista, end customers will be less secure," Samenuk said. "Customers trust us ... To erode that trust would hurt all Internet users, all PC users. I don't think Microsoft wants that, nor does McAfee want that." Two security elements in Vista fare chief among McAfee's concerns, executives said. In Vista, Microsoft is locking down the kernel of the OS through a feature called PatchGuard on 64-bit versions. Microsoft's argument is that this will keep miscreants out of the OS and prevent the incidence of attacks, and it is something for which customers have been asking. "Fooling around with the kernel while it's running is like changing the sparkplugs on your car when the engine is running," said Stephen Toulouse, a senior product manager at Microsoft. "It's never been a good thing for users." But McAfee said since PatchGuard also prevents third-party security companies from getting inside the OS, they can't activate crucial security measures in their software to protect the OS from intruders. PatchGuard is not new in Vista, said Bruce McCorkendale, a distinguished engineer with McAfee competitor Symantec Corp., which shares McAfee's consternation over the feature. He said Symantec has been petitioning for Microsoft to change the feature since the company introduced it in its 64-bit version of Windows XP, but the company will not budge. "If you ask any security vendor that offers advanced protection, you'd get the same answer [about PatchGuard]," McCorkendale said. "It's just inhibiting the way security vendors do their jobs." However, according to Jupiter Research, only 5 percent of companies with 100 employees or more are running Windows XP in its 64-bit version, and that adoption is not supposed to ramp up significantly anytime soon, said analyst Joe Wilcox. "If this new [feature] affects 64-bit only and nobody is using 64-bit, what's the problem?" he said. The other big concern with Vista for McAfee lies in a new security interface called Windows Security Center (WSC). Microsoft will not allow this interface to be turned off, so McAfee and other third-party users can't install their own security-management consoles on Vista machines, executives said. McAfee's argument is that third-party security products can better detect potential or existing security problems that Vista inherently can, and unless those can be surfaced through the interface, users will not be alerted to them, Viega said. Some believe security vendors are crying foul over Vista because Microsoft's ability to control security features of the OS is a threat to their livelihood. Companies such as McAfee and Symantec have all but built their businesses on the fact that Windows is inherently insecure, and add-on security software is needed to protect it from intrusion. "Historically, when Microsoft has gotten into a market, the number of competitors goes down," Wilcox said. However, he said there is a legitimate concern, supported by precedence, that not only will vendors be pushed out of the market, but there will be less innovation in Windows security products and more problems will arise. Wilcox cited Internet Explorer as an example of an area in which Microsoft beat competitors, but then did not innovate on the product until it faced competition once again. "Microsoft won the browser war and for years abandoned the territory," Wilcox said. If Microsoft successfully reduces the number of competitors by building security into Windows, it might also become lackadaisical about security improvements, thus opening the OS up to more attacks.
551541
Ben Fathi, now the chief of development in the Windows core operating system group, would like Vista to have half the first-year security flaws of its predecessor, XP. Security analysts offer their thoughts.
354687
Competitors say they should be able replace a Windows feature that tells people about the security status of their PC.
78617
Microsoft Corp's  upcoming Windows Vista computer operating system will include technology that is designed to prevent pirated copies from fully functioning, the software giant said.
332636
In a Knowledgebase advisory to developers today, Microsoft is urging developers for Windows Vista who intend for their programs to run under Service Pack 1 not to assume the default search protocol being used by the system is Microsoft's.
383208
New technology in Windows Vista can bring down access management barriers, according to Microsoft.
268137
What was not supposed to happen in Windows Vista apparently has: Despite a layer of protection that was supposed to prevent against processes elevating their own privileges, Microsoft now says someone found a way to do it.
418922
Malware blocking credentials questioned Windows Vista has only just left the starting blocks but security watchers have wasted no time in challenging claims that it provides improved security defences.â¦
646228
Microsoft releases details on number and severity of vulnerabilities for Vista, saying it compares favorably to XP in its early days as well as to current competitors.
597355
While Gates closes up on Â£ for $ pricing Two controversial aspects of Microsoft's Vista were conspicuous by their absence at yesterday's launch event - neither digital rights management nor the way Microsoft will shut down or reduce the functionality of software it considers to be an illegal copy were mentioned.â¦
618526
Windows Vista was hit by significantly fewer publicly disclosed security flaws in its first year than Windows XP and open source rivals were, the software giant says.
292352
In a story for the Associated Press this afternoon, one of the directors of Microsoft's Windows Client Product Planning team is quoted as saying that a Black Hat security conference demonstration last August scared Microsoft to the point where the company seriously considered removing virtualization capability from Vista entirely.