Has Microsoft kept its Vista security promise?

According to Microsoft, it's the most secure operating system the company has ever produced. Five years in the making, Windows Vista promises to lock down the desktop and usher in the era of "trustworthy computing," in which PCs are more reliable, user experience is improved, and rampant malware is a thing of the past.

Just three months into the official commercial release of the OS, however, questions are flying. Anti-malware vendors, hackers, and security experts have raised doubts as to the efficacy of Microsoft's new security measures, with one -- blogger Joanna Rutkowska -- going so far as to suggest that Vista's security model might be merely "a big joke."

Microsoft is always an easy target, especially when it makes extravagant claims. The truth is that early testing suggests Vista is significantly more secure than previous versions of Windows.

That doesn't mean that the new OS signals an end to Windows security headaches. Some of the pain for IT administrators will subside, but weak spots and their work-arounds should be top of mind as always.

Administrator no more

One of Windows Vista's most lauded security enhancements is also one of the most criticized. UAC (User Account Control) aims to address a long-standing flaw in how Windows handles user permissions, but its detractors say it doesn't offer enough protection and that inadequate design undermines its effectiveness.

At issue is the role of the administrator account. Best practices dictate that a user should be assigned administrator privilege only when performing tasks that require it, such as installing device drivers or changing the registry. But part of the legacy of DOS is that older versions of Windows were essentially single-user systems. Even on Windows XP, which was Microsoft's first multiuser client OS, users would routinely log in as administrator by default, even for mundane tasks.

This practice made workstations easy to manage but was a security disaster. When a user is logged in as administrator, worms and Trojan horses have free rein to run amok. Worse, Microsoft's inattention to user permissions encouraged ISVs to use sloppy, insecure programming practices that compounded the problem. Many Windows applications simply would not work unless they were allowed to run with full administrator privilege -- that is, to run in the least secure way possible.

UAC attempts to correct these bad habits. Under UAC most software runs at reduced privilege by default. When an application attempts to do something that requires administrator privilege, UAC prompts the user with a dialog box asking for permission to "elevate" the application to the increased privilege level.

Unfortunately, UAC is not perfect. On her blog, Joanna Rutkowska details several flaws in Vista's UAC implementation that are potentially exploitable. For example, software installers are always allowed to run with full administrative privilege, just like in old-fashioned Windows. In addition, Symantec security analyst Ollie Whitehouse points out that Vista ships with executables that can be used to compromise UAC.

"I still think that Microsoft did a good job with Vista," Rutkowska says, yet the significance of these discoveries is clear: Don't expect UAC to eliminate problems associated with the administrator account overnight.

Programmatic exploits aren't the only way around UAC's protections, either. User behavior is equally critical. UAC confirmation dialogs can be intrusive and somewhat cryptic. Users might be tempted to simply disable UAC out of frustration, or they might become so numb to the UAC warning messages that they click "OK" without thinking. What's more, they can easily be tricked into doing the wrong thing using social engineering or deception.

"Windows Vista provides many features to protect your system, but they require proper use," reads Microsoft's Windows Vista Security Best Practice Guidance for Consumers on the subject of UAC. "Your system security is only as strong as your actions, so think before you click." In other words, relying on UAC puts the responsibility for system security in the hands of the individual user -- hardly an ideal scenario.

In fact, Microsoft discourages customers from thinking of UAC as an explicit security boundary -- and therefore, as Rutkowska notes, it does not consider flaws in the UAC implementation to be security flaws . Don't ignore this point. It speaks volumes to how IT should view UAC within the enterprise environment.

Page Break

Tweaking out

Microsoft has added numerous other features to Windows Vista besides UAC, many of which are intended to increase the overall security of the OS. But upon closer examination these add-ons are only marginal improvements over previous versions of Windows.

Windows Firewall has been enabled by default on all new Windows installs since the introduction of Windows XP Service Pack 2. With Vista, Windows Firewall gains the capability of blocking outgoing connections as well as incoming ones -- a marked improvement, when you consider the growing threats of spyware, phishing, and DDoS attacks. Unfortunately, the filtering of outgoing packets is not enabled by default. In other words, Vista's firewall won't provide significantly more protection than the one included in XP SP2 without manual configuration.

A new program called Windows Defender adds anti-malware capabilities to Windows, but it's primarily consumer-focused and so far does not seem to be up to par with the major aftermarket options already available for XP. According to competing anti-malware vendor Webroot,

Windows Defender misses the vast majority of spyware. Worse, in February Windows Defender was shown to actually be a vector for attack on Vista, with the disclosure of an exploitable bug in Microsoft's malware detection engine. Similarly, while Vista includes a new hard drive encryption feature called BitLocker, it is not enabled by default, and whether it offers any real protection against advanced computer forensics techniques is questionable.

Worst of all, some new features added to Vista actually have proven detrimental to overall security. In January, hackers discovered that Vista's speech recognition feature could be used to gain limited access to a remote system, including the ability to delete arbitrary files. Such annoyances sound almost cute -- until they result in real data loss.

Enemy at the gates

The Vista speech recognition exploit underscores an important point. As with previous versions of Windows, by far the majority of attacks on systems running Windows Vista will come not in the form of exploits of the OS itself, but of applications running atop the OS.

Microsoft actually has made significant improvements to Windows Vista that are designed to mitigate some of the most common types of application vulnerabilities. A group of new technologies makes it more difficult for hackers to exploit commonplace bugs by obscuring the memory addressing space and protecting access to the OS kernel.

Preliminary research by Symantec suggests that Vista may still be vulnerable to some forms of attacks but concludes that "the implementation of these protections achieves many of the security goals that Microsoft had envisioned."

The rise of .Net as the dominant development model for Windows Vista also bodes well for security. The managed code and security sandbox features of the .Net platform protect developers from common programming errors that can lead to exploitable vulnerabilities.

Despite these improvements, the primary weakness of these technologies is that developers must rewrite their code to take advantage of them. Legacy applications that are unaware of Vista's new security model will remain vulnerable. Examples have already begun to surface, including a previously patched bug in Computer Associates' BrightStor backup software.

Patches to widely used commercial applications will doubtless continue to surface during the next few months, but custom enterprise software remains the big unknown. Until older applications are upgraded to take advantage of Microsoft's latest security technologies, they will gain little benefit when running under Vista beyond what is provided by UAC. Though Microsoft has made significant advances, this new OS is no panacea for a secure Windows-based IT environment.

Page Break

The road to security

"We remain confident that Windows Vista is the most secure version of Windows to date," says Russ Humphries, senior program manager for Windows Vista security, "however, it is important to note that no operating system is ever going to be 100 percent secure -- there are no silver bullets."

The bottom line: Windows Vista is not immune to attack, nor would it be fair to expect it to be. Technological advances within the OS bestow real security benefits, but Microsoft acknowledges that Vista users will benefit from aftermarket security and anti-malware products, as they have for previous versions of Windows.

As is often the case with Microsoft operating systems, perhaps Vista's biggest weakness lies in the desire for backward compatibility. Most of the vulnerabilities discovered in Vista so far exploit legacy applications that don't take advantage of the new Windows security model. Even UAC itself is a capitulation to outdated practices.

The sooner enterprises embrace the latest Windows technologies, the sooner they will begin to benefit from Microsoft's engineering efforts in the area of security. Wherever possible, custom applications should be migrated to managed code and the .Net framework, and care should be taken to observe the new core Windows security APIs and practices. Even more hardware-based security mechanisms will become available as the industry transitions to 64-bit computing platforms.

In the meantime, the watchword is caution. Microsoft has issued specific security guidance for IT administrators who are evaluating Vista for enterprise networks with Active Directory.

The exact configurations recommended depend on the level of security required within a given organization, but the overall message is straightforward: Effective security under Windows Vista will still require a combination of IT oversight, adherence to security policies, and third-party anti-malware and security management tools -- in other words, business as usual. Vista does represent a significant security improvement over Windows XP, but after all, it's still Windows.