Home > Security

Computerworld - There are good reasons why expectations have run higher for Windows Server 2003 from a security standpoint than for any prior edition that Microsoft Corp. has released.
With its April launch, Windows Server 2003 became the first operating system to ship since Microsoft commenced its much-touted Trustworthy Computing initiative in earnest, after Chairman Bill Gates sent the company's employees a memo in January 2002 telling them that security would be the "highest priority."
Soon after Gates issued the memo, Microsoft shut down Windows production for 10 weeks to train engineers in writing secure code. The company delayed Windows Server 2003 for roughly a year, in part to allow more time for intensive source-code analysis, threat modeling, penetration testing, buffer overrun checks and security audits.
The natural question becomes this: Is Windows Server 2003 living up to its billing? Some say no. More say it's too early to tell.
Better Security by Default
Early adopters, analysts and consultants agree that Microsoft has made improvements -- most notably, disabling many features and functions in the default install to reduce the surface area available for hackers to attack. Internet Information Server 6.0, for instance, is turned off by default. And overall, Microsoft shut off or reduced privileges for more than 30 services in Windows Server 2003.
"You design the role of the server and turn on only things appropriate to the task at hand. That is the greatest security feature we've seen and taken advantage of in Windows Server 2003," says Scott Campbell, director of IT operations at First American Title Insurance Co. in Santa Ana, Calif. The company is currently certifying applications to run on Windows Server 2003 in preparation for a gradual rollout to 172 servers.
But early adopters have yet to reach a verdict when judging the new operating system from a vulnerability standpoint. Most have neither tested nor deployed Windows Server 2003 at large scale or in a wide enough range of scenarios to tell just how solid it is.

Jeremy Lehman, senior vice president at Thomson Financial

"We want to see at least two quarters' worth of data -- and I don't care about patches. I want to see the penetration test results," says Jeremy Lehman, a senior vice president who heads the technology group at New York-based Thomson Financial, which has migrated about 20 servers to Windows Server 2003.
Some security experts are already dubious. They point out that some of the vulnerabilities affecting older Windows operating systems also plague Windows Server 2003, as demonstrated through patches that