Microsoft has adopted a comprehensive approach to security for Windows Vista, due for release to the consumer market early next year, says Russel Humphries, senior product manager Windows Vista security.
The move is in response to the beating Windows has taken in recent times over vulnerabilities in earlier versions of its operating system, as well as the increased sophistication of attacks and the growing emphasis on data security, particularly in the business world.
In addition to aiming for a securely designed platform, as many of its competitors have claimed to have done, Microsoft has concentrated development efforts on enabling secure access, protecting against malware and intrusions, and protecting data from unauthorised viewing.
Fundamentals
"The development process has not just been about adding new features, but also about building a platform that is fundamentally more secure in the way it is built," said Humphries at an EMEA reviewers` forum held in London last week.
To achieve security by design, Microsoft has introduced the security development lifecycle (SDL) process to the operating system for the first time in Vista.
Humphries says the process includes periodic mandatory security training for developers, assigning security advisors for all components, using threat modelling, regular and improved security reviews and testing, and specific security metrics for product teams.
Authentication
Humphries says the SDL has resulted in a number of changes, starting with the way Vista handles authentication of users.
Microsoft has replaced the traditional username and password authentication model with a more flexible system that allows multiple authentication factors and strong authentication by using biometric credentials and smart cards, as well as passwords.
Another change in Vista is the way in which user accounts are managed to get away from the current situation where most users run with full administrator privileges all the time, raising the risk from malware.
Humphries says Vista makes it easier to run as a standard user because administrator privileges are no longer necessary to do things like change time zones and power settings. Also, higher application compatibility ensures most games can be run under standard user settings.
Vista runs with lower privileges than Windows XP by default, requiring password authentication to elevate privileges when necessary. Users are also warned when applications attempt to make changes such as turning off the firewall.
Malware protection
To illustrate the kinds of changes that have been made to ensure greater protection of users` computers, Humphries detailed some of the features Microsoft has added to the newest version of its Web browser, which in the past has been the greatest point of vulnerability for many users.
"Internet Explorer now offers different security settings in version 7 depending on whether the PC is connected to home, office or public network and will also warn users to turn on the new anti-phishing filter when necessary," he said.
IE 7 has been broken up into various different components to allow the core component to operate in an extremely limited permissions environment, explained Humphries to support claims that IE 7 is "significantly different" from its predecessors.
Data protection
Protection of data is another area of security that Humphries says has received special attention.
"In addition to enhanced rights management services (RMS) and an encrypted file system (EFS), Vista adds hardware-enabled data protection and full volume encryption with new BitLocker technology," says Humphries.
New to Vista is the ability to use EFS keys on a smart card, encryption of USB flash drives, and an integrated rights management client.
"BitLocker prevents the use of an operating system viewing the contents of a drive that has been taken from another machine. This is achieved by using a trusted platform module that is part of the original machine`s motherboard and necessary to release the encryption key," explains Humphries.
Summarising the security strategy of Vista, Humphries told attendees of the reviewers` forum that the newest version of the Window operating system offered enhanced information recovery and protection, identity and access control, and threat and vulnerability mitigation all layered upon a fundamentally secure platform.
Related stories:
Vista aimed at 'new user experiences`
Vista targets hearts and minds
Share
