Security: the impossible juggling act for Windows 7
By Simon Bisson & Mary Branscombe in Editorial
Posted in Windows Vista, operating systems, Windows, Security, Internet, Microsoft on
You want Windows to be secure; but are you prepared to use it if it is?
The big advances in Vista weren’t just the architectural changes that made for driver and application incompatibilities as the software vendors played chicken with Microsoft (or to be seasonal, pantomime dames: We’re finally going to launch Vista/Oh no you’re not!/Oh yes we are…). There are major security improvements, from the low-rights protected mode that browsers other than IE7 are finally taking advantage of to address space randomization - which isn’t perfect protection according to security expert and ex-Microsoftie Jesper Johanssen, but still gives you a one in 256 chance of getting infected by a Trojan rather than a hundred percent chance. And then there’s UAC - and the real problem.
UAC is far and away the most maligned feature of Vista. Microsoft’s Steven Sinosfky is only half joking when he compares it to Clippy: “the end user view of compatibility was the UAC prompt that was so famous I thought for a few moments it would surpass the fame of Clippy - and I’m now associated with both of those personally.” UAC is infamous but it’s widely used for something that’s supposed to be so hated - it was on in 88% of all user sessions in Vista by last April and probably rather more by now.
And it might be hard to believe as the screen goes dark yet again, but 66% of all Windows sessions have no UAC prompts at all and Vista SP1 will bring that down further because fewer tasks require an elevation prompt. When Vista came out, 80% of the prompts were caused by just ten apps (a mix of tools in Windows, Microsoft apps and third-party software). UAC is achieving its real aim, which is to get more software to work when you run as standard user. If you’re logged in as admin, you’re turning off almost every security option there is; according to David Cross, who made a name for himself by telling attendees at the RSA conference that Microsoft put in UAC to annoy users so much that software developers would do the work to make apps run in user mode, “almost half of vulnerabilities have a reduced impact because you’re running as standard user”.
But in Windows 7 you might not see any prompts at all, because Microsoft’s response to the UAC complaints has been to introduce a slider that allows silent elevation; that’s a nice graphical interface that makes the seven GPOs you could already use to control UAC much more accessible. But how does that make you more secure?
If you want to be 100% secure, you need to turn your PC off, unplug it and never use it again. Disconnect it from the Internet and don’t plug in any peripherals and you only have to worry about someone stealing your snail mail. It’s not very convenient, of course… and UAC did have an element of a toddler tugging at your sleeve and asking you ‘why?’ all the time. What people who think UAC is too much like hard work really want is the psychic computer; it should know when I want to install software, when I want to do updates and whether the link I’ve clicked on is legitimate, all without bothering me or tracking what I do. Security either needs to make dangerous things harder, or to make users more careful. How much inconvenience are you prepared to put up with to avoid getting hacked? If Windows 7 avoided Vista’s other flaws but had the same level of UAC prompts, would you be complaining?
Mary
Rated: 100% (1 votes)
Loading ...Pingback by - December 31, 2008 on 12:59 am
[…] Security: the impossible juggling act for Windows 7 IT PRO - London,England,UK But in Windows 7 you might not see any prompts at all, because Microsoft’s response to the UAC complaints has been to introduce a slider that allows silent … See all stories on this topic […]
Make a comment
Tag cloud
Archives
- September 2009
- August 2009
- July 2009
- June 2009
- May 2009
- April 2009
- March 2009
- February 2009
- January 2009
- December 2008
- November 2008
- October 2008
- September 2008
- August 2008
- July 2008
- June 2008
- May 2008
- April 2008
- March 2008
- February 2008
- January 2008
- December 2007
- November 2007
- October 2007
- September 2007
- August 2007
- July 2007
- June 2007
- May 2007
- April 2007
- March 2007
- February 2007
- January 2007
- December 2006
- November 2006
- October 2006
- September 2006
Most commented posts
- Java's SSVAGENT.EXE: training the monkey
128 comments
- When Windows 7 upgrades won’t hibernate (the solution)
- Do you need IPv6 for DirectAccess? Yes and No
- Chrome OS: what happens when "always connected", isn't?
- The ColdFusion Renaissance
- Make Adobe Acrobat Pro deactivate
- Is there a showstopper bug in Windows 7 CHKDSK?
- There’s a reason smartphones are locked down
- At sixes and Windows 7s
- The LHC isn
Highest Rated Blog Posts
- Songs of distant satellites (100%)
- Nobody knows what Web 2.0 really is (100%)
- Log in and lock in (100%)
- Top tips for speeding up Vista (100%)
- Mommy, why is there a home server in the office? (100%)
- Employees are our most valuable asset (snigger) (100%)
- Locking down IT or blocking creativity (100%)
- Consumer BlackBerrys are good for business (100%)
- HD Trek (100%)
- Join the (beta) community (100%)
