http://www.informationweek.com/news/showArticle.jhtml?articleID 5917444 

By Thomas Claburn 
InformationWeek 
January 23, 2008 

Windows Vista gets high marks for security, from Microsoft at least.

"I think that it's fair to say that Windows Vista is proving to be the 
most secure version of the Windows to date," said Austin Wilson, 
director in Microsoft's Windows client group, in a blog post on 
Wednesday. "Our investments in the SDL [Security Development Lifecycle] 
and our defense in depth approach to building Windows Vista seem to be 
paying off."

Windows Vista also exhibited fewer vulnerabilities than other operating 
systems over a one year period, according to a report published by Jeff 
Jones, security strategy director in Microsoft's Trustworthy Computing 
group. The report claims that there were 36 vulnerabilities fixed in 
Windows Vista during its first year, compared to 65 in Windows XP, 360 
in Red Hat RHEL4 reduced, 224 in Ubuntu 6.06 LTS reduced, and 116 in Mac 
OS X 10.4, also known as Tiger.

"My analysis found that researchers found and disclosed significantly 
fewer vulnerabilities in Windows Vista than either it predecessor 
product, Windows XP, or other operating systems such as Red Hat 
Enterprise Linux, Ubuntu, and Apple Mac OS X 10.4," said Jones in his 
report.

Eric Schultze, chief technology officer of St. Paul, Minn.-based Shavlik 
Technologies, considers such metrics to be apples-to-oranges 
comparisons. "When you start counting vulnerabilities, it's a matter of 
defining vulnerabilities," he said. "For example, if a bulletin is 
released for Internet Explorer, that's one patch for IE. Microsoft may 
have broken it out to say there are five distinct issues fixed in this 
patch. Is that five vulnerabilities or is that one vulnerability because 
it's one patch?"

Setting aside questionable comparisons to other operating systems, 
Vista's superiority to its Windows ancestors may not seem particularly 
surprising or noteworthy. But Wilson makes the case that Vista's 
security features like User Account Control and Internet Explorer 
Protected Mode reduce the risk and severity of security vulnerabilities 
and give companies more time to deploy patches.

Wilson points out that Windows Vista makes it easier to run standard 
user accounts rather than administrative accounts, which are more 
dangerous when compromised. This, he says, diminishes the impact of 
vulnerabilities.

"Of the 23 security bulletins that have been released for Windows Vista 
through January 2008, 12 specifically call out a lower impact for those 
running without administrative privileges: MS07-033, 034, 040, 042, 045, 
047, 048, 050, 057, 064, 068, and 069," explained Wilson. "This is a 
great illustration of the importance of User Account Control and why we 
included it in the product. It's also the reason I personally run as a 
standard user on every machine I use."

Wilson also singles out Internet Explorer Protected Mode as a reason 
that Vista is more secure than XP. Protected Mode in Vista prevents 
Internet Explorer 7 from altering user or system files, and various 
settings, without consent from the user. This diminishes the 
effectiveness of malicious Web sites, if the user is paying attention.

As evidence of the impact of Protected Mode, Wilson cites the MS07-056 
security bulletin from October 2007. It was rated "Important" on Windows 
Vista and "Critical" on Windows XP. He also notes that IE 7 and Vista 
are blocking almost 1 million phishing attempts every week. One metric 
where Vista seems to shine is in terms of patch days.

"During Windows XP's first year, updates were released on 26 separate 
days," said Wilson. "Through a combination of the move to a predictable 
monthly release schedule, and decreased vulnerabilities, Windows Vista 
had updates released on just nine days in its first year. To the average 
security professional, this is one of the most relevant metrics: how 
many times did I have to activate my internal patch management process 
due to vendor update releases over the course of a year?"

Schulze remains skeptical about Wilson's claims. "What he states is 
accurate, but he's only presenting the numbers that come out in a 
favorable light," he said. "He's not presenting the numbers that come 
out in an unfavorable light. For example, he claims that there are a 
certain number of vulnerabilities for which, on Vista, there was lower 
severity than on Windows XP. But he's not telling you about the number 
of patches which were more critical on Vista than on Windows XP."

Dave Marcus, security research and communications manager of McAfee 
Avert Labs, gives Wilson credit for some good points but believes it's 
still too early to declare victory for Vista. "Wilson put forth a very 
good argument," he said. "His stats are valid, but I think he fails to 
take into account that most businesses have not deployed Vista, nor have 
most consumers."

Marcus said that while Vista was superior to Microsoft's previous 
operating systems from a security standpoint, many of the security 
features were only available in 64-bit versions of the operating system 
and many organizations would be disinclined to purchase new hardware to 
use those features.

Once Microsoft officially deploys Vista SP1, Marcus expects more 
corporate Vista deployments and a clearer picture of Vista's security 
profile. Like other security vendors, McAfee has predicted a surge in 
malware in 2008 for Vista as more people install the new operating 
system.

"We think 2008 will be the year that Vista finally joins the malware 
party," said Marcus.

In a phone interview, Wilson countered that Windows Vista already is 
widely deployed, noting that Microsoft has already shipped 100 million 
copies of the software. And he expressed skepticism about a surge in 
malware, given that security researchers have been looking for holes in 
Vista since the Black Hat Conference in 2006, when Microsoft distributed 
beta copies of the operating system to help identify security flaws.

"It's safe to say that the security research community has had a strong 
focus on Windows Vista," said Wilson.

But that focus has yet to offer much clarity. "This is a matter of 
Microsoft bending the statistics for their own purposes," said Schulze. 
"We could just as easily create the same number of statistics that puts 
Windows Vista security in a negative light."

Copyright 2007 CMP Media LLC


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn