First look at Windows Vista: Secure at last?

WindowSecurity.com - At the MVP global summit in Redmond, Wash., I had the opportunity to hear from a number of Microsoft insiders, the guys who actually wrote the code, about their goals and philosophy in creating the new operating system and included components such as Internet Explorer 7.0.
I was encouraged by what I heard. Defense in depth was a concept that kept coming up over and over again. Multilayered security is the only way to provide real protection, and Microsoft's commitment to making fundamental changes in the architecture to support that type of protection will give Vista a big security edge over older Windows operating systems.
Another philosophical position we're hearing a lot out of Microsoft employees has to do with "integration of the edge," or the idea that the Internet is the network. This goes along with the well-publicized "death of the DMZ" concept promulgated by Steve Riley, one of the senior program managers in Microsoft's Security Business Unit (you can download Steve's presentation on this topic from his Web site). This theme, in one form or another, ran throughout a number of the Microsoft presentations.
Taken together, these philosophies indicate a whole new way of looking at security, which incorporates strategies such as server and domain isolation and network access protection (NAP) enforcement. Another big focus is on identity authentication and management. We see this everywhere, from proposed antispam technologies such as Sender ID to enterprise/federation level products like MIIS. We also see it in Vista's improvements to such technologies as IPsec and better smart-card support.
Running with least privilege
A question that kept coming up at the summit was "Do you run as admin on your desktop?" From IT pros to Microsoft execs, most of those questioned answered (sometimes sheepishly) "yes." And there's a good reason for that - with pre-Vista operating systems, it's hard to get anything done if you don't log on as an admin. Vista addresses this in two ways:

• By making it easier for non-administrators to perform necessary tasks such as installing printers and application updates, setting up VPNs, etc. in specific contexts, and


• By running most applications with limited permissions even if you do log on as an admin.

For years, Windows has been compared unfavorably with Unix in relation to security. Unix, unlike Windows, was designed as a network operating system from the beginning and has long had common-sense security features such as running processes with least privilege. Microsoft introduces this same idea in Vista and calls it User Account Protection, or UAP. This feature is covered in depth in Derek Melber's article titled "Windows Vista and Principle of Least Privilege", so we won't go into the details of how it works here - but it's an important improvement to the RunAs capability in Windows XP.
More built-in protections
There are plenty of third-party products on the market designed to protect against specific threats (viruses, spyware, attacks). For enterprise customers, the ability to choose from among these products is an advantage. For home and small business users, however, it's an added expense that many of them feel they can't afford. They want the protection built into the operating system.
That resulted in a host-based firewall being included in XP/2003, and with Vista, Microsoft goes a step further and includes the ability to clean up many viruses and worms and a built-in anti-spyware component. To make management easier, these functions will be integrated into the Security Center interface.
Although the details of the version of antispyware that will end up in Vista are still under NDA, we know that it will be part of an overall threat mitigation strategy aimed at a three-pronged approach to protect the client, server and network. Microsoft's antispyware Beta 1, built on technology from Giant, has been an extremely popular download and already has millions of users. It's a good start, but major improvements are coming up in Beta 2.
Protecting the network
As part of that three-pronged approach mentioned earlier, Vista's developers weren't concerned exclusively with protecting the Vista computer from the network -- they were also concerned with protecting the network from the Vista computer. The Network Access Protection (NAP) component in Vista is comprised of an agent that reports the Vista client's health status to the NAP server (a component included in Longhorn server).
This gives administrators the ability to deny access to client computers that don't meet their standards (such as having current service packs and security updates applied, having anti-virus software enabled and up to date, and so forth).
NAP is similar to Windows Server 2003's Network Access Quarantine Control, but it's a different technology and it extends protection a step further. NAQC is used to enforce health policies on remote access and VPN clients, but NAP can do this and also enforce policies on computers directly connected to the LAN, including mobile computers that are plugged into the LAN periodically. As with NAQC, computers that aren't in compliance are isolated on a restricted network, where they can be automatically updated to meet your requirements.
Quarantine can be provided through a number of different network components (separately or in conjunction with each other):

• DHCP, in which the DHCP server (running a DHCP quarantine enforcement server component) enforces policies when clients lease or renew and IP address (IPv4 only).
1
2
3
Next »

Reprinted with permission from

For more security news visit WindowSecurity.com
Story copyright 2006 WindowSecurity.com. All rights reserved.