Report: Vista Security Not Enterprise Ready

By Ed Oswald | Published May 8, 2006, 1:01 PM

Microsoft's attempts to bolster security may hurt it in the enterprise sector, an analyst report said Monday. Behind the Boston analyst firm Yankee Group's reasoning is the general user-unfriendliness of those security features.

As such, Yankee Group has recommended users stick with Windows XP Service Pack 2 until 2008 if they believe such issues may present a problem. It even suggested looking at Apple's dual-boot Macs as a "hedging strategy."

The firm gathered feedback from developers, who complained that Microsoft had went too far in its implementation. They also said that some of the security measures were too repetitive, and even seemed to talk down to the user.

The report's author Andy Jaquith specifically pointed to the user account feature as an area of greatest concern. Based on a build released in December 2005, the way the feature was implemented in that release was too strict and a posed potential problem.

However, it should be mentioned that researchers did complement the Redmond company's efforts in strengthening the overall security of the operating system. But the firm still felt the way it was implemented would turn off enterprise customers from Vista.

Jaquith believes it would be well into next year before these security features are improved, which could indicate many enterprise users may hold off on large-scale licensing of the new operating system. Microsoft is counting on Vista to improve its bottom line and bring a return for investors, who have seen its stock price stagnate for much of the past five years.

Yankee Group said that it expected the antivirus industry not to suffer from the release of Vista, although anti-spyware and firewall products would likely see a significant drop in demand. Vista will have both features natively integrated into the operating system.

Comments

We are still using Windows 2000 here and Windows 98!. Well over a 1000 computers in house. Our IT department thinks XP is not ready for enterprise deployment! So I doubt we will see Vista until sometime in late 2020.

Score: 0

|

Your IT department is a little behind the times...

Score: 0

|

Wayyyyyyyyyyyyyyyyyyy behind.

Score: 0

|

Your IT dept "IS" a security risk.

Score: 0

|

Enterpise's rarely if ever let users determine security settings so whether the features are 'user friendly' is a mute point. Further, even IF these features are complicated, the Yankee Group's 'hedge strategy' of using dual-boot Mac's is the most asinine statement I have ever heard.

Enterprise = 1,000's of installed PC's
Yankee Group says stay on XP or hedge, throw ALL the PC's out, train all your employees on a dual boot strategy - > Does the Yankee Group believe their 'dual-boot' strategy to be LESS complex than a few security features an end user will never see or use?

Please. We want more complex security tools. The Enterpise wants a more sophisticated security model.

Score: 0

|

That's just not true. It depends on the environment. If you have an AD (active directory) you can instill policy on the machines, but only if you have a global policy setup.

If you have Administrative rights on the machine (most Companies let people have this level of control) then you can do anything you want to your machine.

The settings aren't unfriendly, everyone complains, its just CHANGE. Its not harder, its not easier per se, its just different.

They initially showed Windows 95 wouldn't be adopted either, and they said that "finally" Apple would have the edge, well where are we 12 years later? Still using Windows, that's where.

You can't listen to these so called "experts". They ALL have a ulterior motive, or they are motivated by some other liberal group to promote their ideas.

Maybe Vista isn't Enterprise ready, and I for one don't see any benefit in moving to the new OS, but to say features (which aren't even finalized yet) aren't user friendly, is premature. Everytime something changes, its always because people can't figure them out. People can't figure them out because they don't READ or take the time to learn the changes.

People are hard headed. I know people that insist carboretors are still better, or regular gas has more power, or some other 20 year old reason why they can't use technology, its insane.

People are just stubborn, and they will find ANY reason NOT to use the new stuff, its rediculous.

Score: 0

|

" Microsoft is counting on Vista to improve its bottom line and bring a return for investors, who have seen its stock price stagnate for much of the past five years."

when was the last time MS brought out a new OS?
5 or so years ago i think

vista better be something else

Score: 0

|

Microsoft is in a tough spot. For years they never headed our calls to strengthen Windows poor security favoring ease of use. Now we have a slew of people who favor ease of use and cannot deal with security functions that require understanding of the product.

It's a tough spot for MS but it called it upon itself. Anyone serious about security won't look at Microsoft anyway. So here is the choice, ease of use lovers try on Vista or go Unix? Funny dilemna.

Score: 0

|

Really? And you are basing this on what exactly? Windows is more secure than any other OS, otherwise why would the government use Windows?

Evidently, its not as bad as you THINK it is, because Banks, Government agencies, use them for SECURITY EVERY DAY. And don't give me this song and dance about Linux/Unix either, those are NOT the primary systems, Windows is the front line in just about every major industry in the world.

So evidently they must be doing something right, because they replaced Novell as the backend server, and MS products are utilized all over the world, even co-existing with those other systems..

If they werent' secure, they wouldn't use them. Quit believe the hype you read. Windows is fine. its the people that DON'T adhere to updates, that's where the problem comes in. People that use machines at home, are basically ambivolent to updates, they don't care. If it runs, they are happy. If something happens, and a program is run, that's where the trouble starts, because they find that there are holes in the OS and the browser.. why? Because people are damn lazy. They don't even click a simple window that says "click here for updates". They ignore them, so I push, no force them on our people.

Its YOUR job to protect YOUR machine, not MS. They give you the tools, if you don't update them or download them, how is that MS fault? They are available, go get them.

Do they have to remind you to close and lock your house door when you leave the house? If you leave it unlocked, and a thief steals your stuff (everything except your downloaded music, because they aren't really stolen -rolling eyes-) I suppose its Master Locks fault, because YOU didn't lock the device?

If you leave your car unlock, and it gets car jacked, I suppose its your car companies fault for not enforcing that you keep your doors locked too huh?

Score: 0

|

Score: 0

|

Windows is NOT more secure than any other OS, you need to do some research.

Why does the Government use Windows? 90% of the world uses Windows because it is "user friendly". This is the same reason why the government uses it. You want a system that is secure? Don't let it on the internet ...

Where there is an OS, there is assuredly another hacker / programmer, etc .. that can most likely pry their way into a system.

Agreed, it IS your job to protect your PC just as it is your job to protect your house. One of the best ways to make your system "more" secure is to educate yourself about the "flaws" of your machine and windows, in knowing that, you can better protect yourself against intrusions from outside sources.

Score: 0

|

Never thought I'd be defending Microspud, but I think this is absolutely asinine. People have been complaining about the holes in Windows for years and now they are complaining that Vista is going to be "too secure" to use. Idiocy

Score: 0

|

Score: 0

|

So, your point is what?

UNIX is safer and easier to use than Vista?

From what I have seen, Vista is safer than XP and before, but harder to use, especially when to UAP prompts.

For me, I will just use GPO to suppres all UAP prompt with default is deny.

Score: 0

|

Score: 0

|

Wow, I had no idea someone could type so much and say so little...lol.

Score: 0

|

You obviously don't work in Information Assurance!

Just out of curiosity, what system was your last Common Criteria (Security) Protection Profile utilizing the DOD Trusted Computer System Eval Criteria- DoD 5200.28-STD? I'd love to hear your take on the CAPP conventions!

Score: 0

|

Ahhhh, there you go, that's better.

An equally useless statement with many fewer (albeit more complex and impressive,) words.

You should be commended for your ability's!

(Here fishy, fishy, fishy.....lol.)

Score: 0

|

lmao...

"You obviously don't work in Information Assurance!"

Who does?

Sorry, couldn't resist.

Score: 0

|

Score: 0

|

Score: 0

|

No, Translated..."I (as most others here,) DONT CARE about your blow hard, long winded ego exposing novels."

But I can have some fun trolling because in your little world you think its the only thing that matters.

(or did you forget this is a discussion of an article written about Vista security...lol)

Score: 0

|

yes, some do. But the GOOD ones don't see a need to proclaim their "superior knowledge," to the world.

If you're truely in a high level securtiy position (instead of someone who thinks they are,) you'd keep as low a profile as possible, and definatly NOT be bragging about it on Beta News...lol.

(Almost in the boat.)

Score: 0

|

Score: 0

|

"You should be commended for your ability's!"

Yeah, tell us more about your abilities!

Score: 0

|

Who's Trolling now...lol? You have become the very thing you're attacking me for being.

Fish in the boat!

Edit, wow you even went back and removed all your posts.....how classic is that. Embarrassed much??? lol.

Score: 0

|

I'm getting a bit tired of all these people bashing Vista because of the improved security features.

For one, everyone's been bashing them for years about window's POOR security and it's about damn time they really did something about it.

Second, no security implementation is going to be perfect, compromises are part of life. You don't want malware infecting your box on every click, then accept the fact that you'll have a few (and IMO rather trivial) inconveiniences.

Three, all these dumb ass, marketing driven, MS a** sucking application developers that are complaining about how much rewriting they're going to have to do should have done the rewriting years ago. Instead they've been resting on their laurals, pissing off admins with their s*** that's writen to the discraceful and abysmal Win9x security model. How many times have YOU had to hack the registry, file permisions, etc... because some multi-thousand dollar app is saying that it must have admin rights. In all cases where I had to do hackery, the app--properly written--would not need admin rights to do it's function.

Fourth, who really gives a good damn about how many people, how fast are running the new OS.

Fifth, these imbecilic "anlysts" (and I use that term *very* loosly here) are saying there's no new "ground breaking" features. Have they not noticed the new scripting and managment facilities? Have they not noticed the *vastly* improved task schedular? Have they not noticed...?

Sixth, why are so many drawing comparisons to XP and making the usual un warranted attacks on it. Any tech worth their salt can use n-lite to make an optomized install of XP that is just as fast, if not faster, with as low or lower ram use as any stock Win2k install. If you're using Win2k, you're missing out on a lot of nice managment features or are making do with ones that are buggy and not as polished and robust. I find it real hard to believe that vista will have no ability to be streamlined and improved, just as all prior MS OS's have been.

Lastly, friggen lighten up. Improving and tweaking the latest windows is almost as good as pr0n to most of us. It'll be fun and you'll probably pirate it anyway.

Score: 0

|

What? My eyes must be deceiving me--there's no such thing as an intelligent post on betanews, is there? :)

Hit it on the head with the Win9x thing--everyone is writing code for the Win9x architecture and that is causing havoc with "incompatible" Windows Updates.

Score: 0

|

"complaining about how much rewriting they're going to have to do"

Should be glad they haven't been coding for Mac for the past 10 years. ;) (How many rewrites have they been through?)

Flake, as much as I agree with you on most points, you gotta realize, most of the folks here have *zero* experience with Vista and are basing their opinions 100% off of the Media and comments made in tech-forums like this.

As negative as press and "techies" have been, can you really blame them?

Most people, when unable to, or incapable of forming their own opinions will more than glady adhere to those of the majority ... and then run with them.

Can't wait for the first RC of Vista. Am fully expecting it to blow me away.

Here's to tweaking. ;)

Second...

"I find it real hard to believe that vista will have no ability to be streamlined and improved, just as all prior MS OS's have been."

The Vista installation routines are *vastly* different than those of prior NT-based Operating systems. Gone is the i386 directory. Gone are the unattended setup TXT files. I am *sure* there is a way to streamline the installation and make it unattended (in fact, I read a write up on it not long ago, but cannot remember it's name), but it will be a real PITA to integrate into current streamliners such as n-lite, autostreamer, or Flexbeta's Slipstreamer.

As such, I think it may take some time to get something like those out there unfortunately. They're probably going to end up building the Vista end of them from scratch.

EDIT**:

Details about Ximage, the new Disk-Image install solution Vista is using can be found here:
http://www.microsoft.com...ista/expert/ximage.mspx

Tools like nlite, etc..will *not* work with this new format.

Some of the more interesting features:

The WIM image format allows you to service an image offline. You can add or delete certain operating system components, patches, and drivers without creating a new image. (Could this mean nlite oculd remove components, or provide a pre-installation method of picking and choosing your components out the image?)

Windows Vista provides an API for the WIM image format called WIMGAPI that developers can use to work with WIM image files. (They seem to be providing tools to mess around in the WIM files. Good start)

The WIM image format allows for non-destructive deployment. This means that you can leave data on the volume to which you apply the image because the application of the image does not erase the disk's existing contents. (Doesn't have much to do with slipstreaming, but makes rescuing a dead OS a bit easier.)

Anyway, hope your not overloaded here, guys. :)

Score: 0

|

Awesome. I appreciat ethe link. Imaging means much much easier deployments, finally, natively, in corps.

Score: 0

|

Ximage is a command-line interface for WIMGAPI.DLL.

It's an open DLL, so one so inclined could easily, it looks like, write a new front-end for it. WIM Images can be mounted and edited on-the-fly.

nlite could create a graphical front-end for this with all the familliar options from the old nlite.

Whoever jumps on this first is gonna be a friggin' hero. Too bad I don't have any coding exp. ;)

Score: 0

|

That's sweet, thanks for the link man.

It's only a matter of time before the third party apps catch up :)

Score: 0

|

One can only hope. :)

Score: 0

|

"Jaquith believes it would be well into next year before these security features are improved, which could indicate many enterprise users may hold off on large-scale licensing of the new operating system."

It's not being released until well into 2007 anyway.

I'm sure there will be Training and educational materials available for admins to familiarize themselves with.

No enterprise IT department would go blindly into any new OS, how is Vista different? At least the switch isn't being "forced," on us like SP2 was.

Score: 0

|

"At least the switch isn't being "forced," on us like SP2 was."

I agreed with your post until you said this. First of all, the computer in which I am currently typing this BN comment has SP1a--no SP2. This network has hundreds of workstations that use the Internet all day long and not a one has SP2.

Really though--need I say more?

Score: 0

|

But no SP2 means hundreds of hotfixes. =(

Score: 0

|

"This network has hundreds of workstations that use the Internet all day long and not a one has SP2.

Really though--need I say more?"

100's of un-patched and feature lacking pc's in your corporate enviornment you say? Nope, you sure don't.

Score: 0

|

Way to base it off an older release instead of a current one, good job guys.

Score: 0

|

How about a link to the actual report, guys? Just a suggestion.

Linking to the "Yankee Group"'s homepage doesn't get one much information about this report.

Score: 0

|

Most of these analysts reports are not only not free, they are not cheap.

Score: 0

|

So there's no way to weed out bias?

Right. okat then.

***note to self: avoid topics starting with "Report:" (Like yeah...I'll do that. Er....not.)

Score: 0

|

Nope, they're probably just as biased as you and me.

Score: 0

|

Yeah, but we don't generally try to pass ourselves off otherwise.

*grin*

Score: 0

|

"Based on a build released in December 2005,"

Translation:

We were gonna b**** about Microsoft, but they fixed it. Now we'll just have to b**** about an older version and hope no-one notices.

Looks like it's working, guys. Good job!

Score: 0

|

Isn't this exactly why Vista is being delayed? So...do you want "this" version now or do you want vista to be delayed? There can be only one or the other, folks, not both.

Score: 0

|

There are probably much more reasons why it's being delayed.

Score: 0

|

Yeah, it just released Build 5381 1 days ago.

Score: 0

|

"Based on a build released in December 2005,"

They have already completely revamped the interface and design. It's also completely customizeable for the enterprise.

Score: 0

|

I hope that Vista is the OS that makes Microsoft fall behind.

I hope that more people buy Macs and start using OSX and Linux.

I hope so few people buy Vista that Microsoft doesn't know what in the world to do.

They need a kick in the pants as a wake up call.

Score: 0

|

And we all know that it's never going to happen. :)

Score: 0

|

People won't buy Vista. People will buy Dells, HPs and Gateways with Vista pre-installed.

Score: 0

|

...and the difference is?

Score: 0

|

There you go--exactly right. That will, in turn, get the computer geeks to upgrade because:

1. Gamers will not allow dell owners to have better technology than they--Vista supports dx10
2. Mom and pop buy the dells, hps, etc., and how can any PC enthusiast let the Moms and Pops out-do them?

That looks and sounds so stupid--but it is true nonetheless. IT admin will be the slowest to jump aboard, I predict.

Score: 0

|

IT and large company intranets are where the big $$$ is, that's the difference, and companies license Windows differently than just getting a PC from Wal-Mart or Best Buy that comes with Windows. MS got everybody but the big boys--they need to focus on security double-time to get those guys. As I say above, they already will get Mom and Pop, with technology enthusiasts following shortly afterward.

Score: 0

|

Aside from those that use software guaranteed to work in Vista on a Dell leasing program.

I'm guaranteed to have Vista workstations in this shop 6 months at most after Vista goes RTM.

It'll give me time to play with the actual RTM before jumpin on-board with my home systems.

Score: 0

|

Yep,

I was one of the last people to move to XP Pro. If it weren't for our users and my parents I would still be on Windows 2000 SP4. :-)

Score: 0

|

Corporate world drives the OS. WHat many "younger" people don't understand are the backoffice features that go unseen. Everyone has nice UI's now, but why MS rules the corp world (and thus, the 'real world') are the unseen features like their security and user policies, remote updates, remote control, etc... Active Directory, of course, drives most of this and this is perhaps one of the most important features in Windows, but it is not seen by a home/casual user.

MS will not "fall behind" because of Vista.

If anything, corp types will take a wait-and-see appraoch and deploy Vista to their labs. Since many corps don't deploy new releases, MS will release a SP1 and corporate IT staffs will declare it safe.

The MS biz plan does not call for hige sales during the first year. In fact, I bet XP still outsells Vista for the first half of 2007. MS knows this and realizes that after the initial geek-out period, sales will taper off for awhile.

While MS has released 2 servers, they have not delivered a desktop OS since XP. MS will make a TON of money off Vista while corps update their desktops.

Score: 0

|

Don't wait for Microsoft's patch: Secure Windows now from today's 0-day

Microsoft is recommending users simply get rid of a vulnerable ActiveX control that no one even uses any more. We'll show you how to do that right now.

Nokia: Android? Are you crazy?

Rumors about new Android devices abound, but Nokia squashes this one.

Symantec goes live with Norton 2010 betas

Norton Internet Security and Norton Antivirus 2010 are now available for testing.

What's Now: Drenched with 'Purple Ra1n,' iPhone users caught eating 'redsn0w'

Plus: Symantec and McAfee go to war, and what's LucasArts building in its top-secret, moon-shaped orbital facility?

In New York, online booze loses a Circuit Court decision

Court worried about gangster influence if liquor purchased directly.

British Telecom sacks bitterly unpopular Phorm ad platform

Phorm under BT is no more, but the targeted ad service could still go on under Virgin or TalkTalk.

CBS is the last man standing against Hulu

Popular streaming syndication site Hulu now has all the major networks in its camp except CBS.

Not just Vista: The operating system is dying, too

Carmi Levy: Wide Angle Zoom Vista's troubles point to a bigger shift that will affect more than just Microsoft.

Bolt: the dark horse mobile browser

Bitstream's small-footprint mobile browser is available in Beta 3

IE8 WSUS update push to begin August 25

After months of availability to users willing to seek it out, Internet Explorer 8 will be rolled into Windows Server...

Geeks vs. journalists: A tale of two worldviews

Recovery with Angela Gunn Why geeks think most mainstream journalism is flaky, and why the mainstream thinks geeks are trying to kill them. (They're both right.)

Can Linux do BitLocker better than Windows 7?

Betanews kicks off a new series with a look at how the Linux operating system's FDE stacks up against BitLocker, the Windows feature that today commands a $120 premium.

Windows 7 ISO Verifier 1.0

July 6 - 5:40 PM ET

ProgDVB 6.10.2

July 6 - 5:19 PM ET

FreeBSD 8.0 Beta 1

July 6 - 4:58 PM ET

K-Lite Codec Pack 64-bit 2.5.0

July 6 - 3:55 PM ET

SysCheckUp 1.4.0

July 6 - 3:34 PM ET