Report: Security Drives Vista AdoptionBy Lisa Vaas5/23/2007 3:38:00 PMIn a recent report on enterprise security, the top reason survey respondents gave for adopting Windows Vista was that the new operating system is perceived as being more secure. The "Fourth Annual Enterprise Security Survey" was commissioned by secure-file-transfer software maker VanDyke Software and conducted by independent research firm Amplitude Research. According to the report, 52.3 percent of security-motivated Vista adopters are specifically interested in the improved firewall and anti-spyware functions in Microsoft's latest operating system. And in spite of the bad rap Microsoft's UAC (User Account Control) has gotten from security researchers, another 14.28 percent of Vista adopters cite limited user accounts as their biggest reason for migrating. If Vista users continue to use the operating system as early adopters are doing, there will be no additional exposure to system compromise, Friedrichs said. Overconfidence in Vista's security technology may put users at risk, however, he said. Overall, Vista is indeed a more secure operating system, Friedrichs said. He pointed to core technologies that are responsible for this security boost, including ASLR (address space layout randomization)a technology designed to make it harder for an attacker to figure out addresses of critical functions and hence harder to get exploits running correctly; safe structure exception handlers; and a new heap manager that is more secure from a dynamic memory allocation perspective, with its newly hardened resistance to certain types of heap usage attacks. Vista's attack exposure remains, for the most part, in third-party applications, Web applications and other areas where attackers are largely focusing their efforts at this time, Friedrichs said. But despite these improvements, Vista is not devoid of flaws. The .ANI vulnerability, which Microsoft patched early in April, occurred in the way Windows, including Vista, handled cursor, animated cursor and icon formats. That particular vulnerability was so critical that it caused one of only three instances wherein Microsoft has patched outside of its Patch Tuesday cycle. Of the 217 Vista users surveyed for the report, the other reasons they gave for adopting the operating system were improved usability, given by 22.11 percent, and "other," given by 11.05 percent of respondents. Other relevant Vista-related findings from the report were that out of 300 individuals surveyed, 6.66 percent have finished testing Vista, 44 percent are currently testing, 18.33 percent are waiting for Service Pack 1 before testing and 31 percent aren't testing. When asked if their organizations planned to deploy Vista, 19 percent of those 300 said their organizations planned to deploy after testing the official release. Twenty percent said their organizations would deploy Vista after SP1 is released, 19 percent said Vista would be deployed but only on new PCs with Vista preinstalled, and 42 percent said their organizations didn't plan to deploy Vista at this time. |