Windows 7 users got a nice surprise on Tuesday, Nov 10, 2009 when Microsoft released its first set of security patches since unveiling Windows 7 last month. It will focus on the Windows 7 security outfit.
When Microsoft launched Windows 7, it was billed as the company's best secure release ever -- the result of a nine-year "Trustworthy Computing" effort to shore up a product line that had been riddled with major security holes.
But does stress-tested windows 7 how to software really matter to Microsoft's customers, seemingly besieged by more online attacks than ever before? Microsoft had years to improve Windows XP, but the Conficker worm, which began spreading last year, has till date infected more than 7 million Windows machines. And for every Windows bug that gets squashed, hackers seem to get new problems in the software that runs on top of latest Windows7-- Flash Player, QuickTime and Java.
No doubt Windows 7 is definitely by far the most secure operating system, said Dave Aitel, chief technology officer with Immunity, a security company that spends a lot of time finding the latest software bugs. But the question that everybody is asking right now is will it be sufficient?
The man behind Microsoft's Trustworthy Computing initiative, Chief Research and Strategy Officer Craig Mundie, says the industry still needs to improve.
This is Microsoft's conundrum. Windows may be safer, but cyber-criminals still have plenty of other places to attack. And when you can target hundreds of millions of customers with a single attack, why change the game plan? So most of the worst attacks today still target PCs running Windows, whether the OS itself is safe or not.
Consider spear-phishing. Attackers are so efficient at sending these highly customized e-mail messages, complete with malicious attachments, that the underlying security of Windows 7 is almost irrelevant.
According to Alan Paller, director of research for the SANS Institute, a security training company, the problem with the targeted attacks is that there's so much money that they can actually trump the security. Hence the governments and large industrial crime groups have to spend huge amount of money to trump any of the defenses.
In a report released last month for a congressional advisory panel, Northrop Grumman analysts detailed exactly how this happens. Looking at known attacks, the report found that targets are carefully selected, and then sent very believable e-mails with maliciously encoded attachments that exploit bugs in a product such as Adobe Reader -- something that's outside of Microsoft's control. The victim opens the .pdf and suddenly attackers have a foothold on the network.
Microsoft has taken initiation step in this direction with its Windows CardSpace identity management software. This will make people to check any fraud while online dealing.
