Pros and Cons of Windows 7 Security
The recently released Microsoft Security Intelligence Report highlights the vast improvements in security from Windows XP to Windows 7. Even so, no operating system is perfect. I asked security experts what they think about Windows 7 security and came up with a list of what Microsoft got right and where Microsoft is still missing the mark.
Mon, November 23, 2009
PC World — The recently released Microsoft Security Intelligence Report highlights the vast improvements in security from Windows XP to Windows 7. Even so, no operating system is perfect. I asked security experts what they think about Windows 7 security and came up with a list of what Microsoft got right and where Microsoft is still missing the mark.
[ For complete coverage on Microsoft's new Windows 7 operating system -- including hands-on reviews, video tutorials and advice on enterprise rollouts-- see CIO.com's Windows 7 Bible. ]
A Step in the Right Direction
Microsoft made significant changes to how it protects the Windows operating system kernel and added a number of new security controls when it transitioned from Windows XP to Windows Vista. With Windows 7, many of those security controls are enhanced and there are some new features as well.
Slideshow: Windows 7 in Pictures: The Coolest New Hardware
Slideshow: 7 Tools to Ease Your Windows 7 Rollout
Slideshow: Windows 7 in Pictures: 10 Cool Desktop Features
Here are three things Microsoft got right with Windows 7 security:
1. ASLR and DEP. ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention) both existed in Windows Vista, but have been improved for Windows 7. ASLR makes it more complicated for attackers to determine where core functions reside in memory, and DEP prevents buffer overflow attacks from working on files or in storage areas that are specifically intended to hold data.
Sophos Senior Security Advisor Chet Wisniewski says " ASLR was massively improved in Windows 7. This means that libraries (DLL's) are loaded into random memory addresses each time you boot. Malware often depends on specific files being in certain memory locations and this technology helps stop buffer overflows from working properly."
Wisniewski also notes that DEP now protects Internet Explorer and other key Windows services that were not protected by DEP in Windows Vista.
2. BitLocker-to-Go. Microsoft added BitLocker drive encryption in Windows Vista. Originally it was only capable of encrypting the partition that Windows was actually installed on, but the functionality was expanded with Service Pack 1 to include additional partitions or volumes--but not portable storage.
Tyler Reguly, Lead Security Research Engineer with nCircle, notes that with Windows 7, Microsoft has included the ability to encrypt data on USB thumb drives. Reguly says that with the popularity of USB thumb drives--capable of holding gigabytes of data--"the expansion of BitLocker to include removable drives should be counted as a significant enhancement."
3. IE8. Internet Explorer 8 is not specific to Windows 7--users of other Windows operating systems are also free to download and use the new Web browser. But, both Reguly and Wisniewski agree that it should go on the list.
