What You Need to Know About Windows Vista Beta Security Features

by Paul Thurrott, thurrott@windowsitpro.com

Three long years after first promising customers that it would ship the successor to Windows XP, Microsoft is finally moving ahead on a concrete development schedule for Windows Vista (formerly code-named Longhorn). Vista will be a major Windows release, incorporating a revolutionary UI, a dramatically enhanced Explorer shell, image-based deployment tools, and perhaps most import, vastly improved security. Now that the Vista beta is available, I've had time to evaluate what Microsoft has changed and can more accurately discuss why it's much better than XP. Here's what you need to know about the security improvements in the Vista beta.

User Account Security
One of the most obvious improvements to the security infrastructure in Vista is a feature that UNIX, Linux, and Mac OS X have had for years: Even on systems in which the user is logged on with administrator-level privileges, all applications will automatically run with lowered privileges. This major architectural change will have two primary ramifications.

First, users who want to install or remove applications, fiddle with Control Panel properties, or make other changes that affect the system will need to provide a password for an administrator-level account before doing so. Second, legacy applications (i.e., virtually every application that was written before Vista ships) will have to be spoofed into working correctly with Vista because most of those applications were written with the assumption that the user has administrative privileges.

Here's how the User Account Protection (UAP) feature (formerly called Least-Privileged User Account) works. When you attempt an action that requires elevated privileges, you'll be presented with a Windows Security dialog box that requires you to enter a password. If you have administrative privileges, you can enter the password for your own  account. Alternatively, you can select another account that has the necessary privileges, then enter that account's password.

UAP works behind the scenes with the new Protected Mode IE to help protect your Vista system from electronic attacks. Based on the success of this security model on UNIX, Linux, and Mac OS X, my guess is that it will prove to be a pivotal change in the way Windows handles security.

Built-in Malware Detection and Removal
Although these features aren't yet fully implemented in pre-Beta 2 builds of Vista, Microsoft says that Vista will include pervasive anti-malware technologies that will detect and remove any unwanted applications and processes. Like Microsoft Windows AntiSpyware, this technology will run in the background and provide a semiautomated solution for malware management.

It's worth noting, however, that Vista won't include antivirus utilities or a managed anti-malware solution. Instead, Microsoft will
sell or license both of these solutions separately.

Recommendations
Although Vista likely won't be the security panacea we so desperately need, it will offer dramatically better security than today's Windows versions. As a result, I strongly recommend that all Windows-based enterprises begin evaluating this release as soon as possible. Security is just one of the many improvements in Vista, but it is perhaps the most important one.