By Thomas Claburn
January 23, 2008
Windows Vista gets high marks for security, from Microsoft at least.
"I think that it's fair to say that Windows Vista is proving to be the
most secure version of the Windows to date," said Austin Wilson,
director in Microsoft's Windows client group, in a blog post on
Wednesday. "Our investments in the SDL [Security Development Lifecycle]
and our defense in depth approach to building Windows Vista seem to be
Windows Vista also exhibited fewer vulnerabilities than other operating
systems over a one year period, according to a report published by Jeff
Jones, security strategy director in Microsoft's Trustworthy Computing
group. The report claims that there were 36 vulnerabilities fixed in
Windows Vista during its first year, compared to 65 in Windows XP, 360
in Red Hat RHEL4 reduced, 224 in Ubuntu 6.06 LTS reduced, and 116 in Mac
OS X 10.4, also known as Tiger.
"My analysis found that researchers found and disclosed significantly
fewer vulnerabilities in Windows Vista than either it predecessor
product, Windows XP, or other operating systems such as Red Hat
Enterprise Linux, Ubuntu, and Apple Mac OS X 10.4," said Jones in his
Eric Schultze, chief technology officer of St. Paul, Minn.-based Shavlik
Technologies, considers such metrics to be apples-to-oranges
comparisons. "When you start counting vulnerabilities, it's a matter of
defining vulnerabilities," he said. "For example, if a bulletin is
released for Internet Explorer, that's one patch for IE. Microsoft may
have broken it out to say there are five distinct issues fixed in this
patch. Is that five vulnerabilities or is that one vulnerability because
it's one patch?"
Setting aside questionable comparisons to other operating systems,
Vista's superiority to its Windows ancestors may not seem particularly
surprising or noteworthy. But Wilson makes the case that Vista's
security features like User Account Control and Internet Explorer
Protected Mode reduce the risk and severity of security vulnerabilities
and give companies more time to deploy patches.
Wilson points out that Windows Vista makes it easier to run standard
user accounts rather than administrative accounts, which are more
dangerous when compromised. This, he says, diminishes the impact of
"Of the 23 security bulletins that have been released for Windows Vista
through January 2008, 12 specifically call out a lower impact for those
running without administrative privileges: MS07-033, 034, 040, 042, 045,
047, 048, 050, 057, 064, 068, and 069," explained Wilson. "This is a
great illustration of the importance of User Account Control and why we
included it in the product. It's also the reason I personally run as a
standard user on every machine I use."
Wilson also singles out Internet Explorer Protected Mode as a reason
that Vista is more secure than XP. Protected Mode in Vista prevents
Internet Explorer 7 from altering user or system files, and various
settings, without consent from the user. This diminishes the
effectiveness of malicious Web sites, if the user is paying attention.
As evidence of the impact of Protected Mode, Wilson cites the MS07-056
security bulletin from October 2007. It was rated "Important" on Windows
Vista and "Critical" on Windows XP. He also notes that IE 7 and Vista
are blocking almost 1 million phishing attempts every week. One metric
where Vista seems to shine is in terms of patch days.
"During Windows XP's first year, updates were released on 26 separate
days," said Wilson. "Through a combination of the move to a predictable
monthly release schedule, and decreased vulnerabilities, Windows Vista
had updates released on just nine days in its first year. To the average
security professional, this is one of the most relevant metrics: how
many times did I have to activate my internal patch management process
due to vendor update releases over the course of a year?"
Schulze remains skeptical about Wilson's claims. "What he states is
accurate, but he's only presenting the numbers that come out in a
favorable light," he said. "He's not presenting the numbers that come
out in an unfavorable light. For example, he claims that there are a
certain number of vulnerabilities for which, on Vista, there was lower
severity than on Windows XP. But he's not telling you about the number
of patches which were more critical on Vista than on Windows XP."
Dave Marcus, security research and communications manager of McAfee
Avert Labs, gives Wilson credit for some good points but believes it's
still too early to declare victory for Vista. "Wilson put forth a very
good argument," he said. "His stats are valid, but I think he fails to
take into account that most businesses have not deployed Vista, nor have
Marcus said that while Vista was superior to Microsoft's previous
operating systems from a security standpoint, many of the security
features were only available in 64-bit versions of the operating system
and many organizations would be disinclined to purchase new hardware to
use those features.
Once Microsoft officially deploys Vista SP1, Marcus expects more
corporate Vista deployments and a clearer picture of Vista's security
profile. Like other security vendors, McAfee has predicted a surge in
malware in 2008 for Vista as more people install the new operating
"We think 2008 will be the year that Vista finally joins the malware
party," said Marcus.
In a phone interview, Wilson countered that Windows Vista already is
widely deployed, noting that Microsoft has already shipped 100 million
copies of the software. And he expressed skepticism about a surge in
malware, given that security researchers have been looking for holes in
Vista since the Black Hat Conference in 2006, when Microsoft distributed
beta copies of the operating system to help identify security flaws.
"It's safe to say that the security research community has had a strong
focus on Windows Vista," said Wilson.
But that focus has yet to offer much clarity. "This is a matter of
Microsoft bending the statistics for their own purposes," said Schulze.
"We could just as easily create the same number of statistics that puts
Windows Vista security in a negative light."
Copyright 2007 CMP Media LLC
Subscribe to InfoSec News