EXPERT RESPONSE
Microsoft informed its corporate customers that it plans to release Windows Vista SP1 in the second half of 2007. It will include security fixes and quality improvements. Windows XP and XP Service Packs 1 and 2 were released in a much slower fashion, suggesting that Microsoft now wants a faster response cycle. Most industries wouldn't dream of shipping a product that is assumed to be flawed, but given the complexity of modern operating systems and software, it is somewhat inevitable. Vista is certainly a different beast than previous Windows operating systems, and there is no doubt that early problems will take a while to get ironed out.
Vista doesn't appear to have any killer must-have features or functionality, but it is clearly a better operating system than its predecessors. The kernel mode security enhancements are quite substantial, resulting in a dramatic reduction of its overall attack surface. Features like native support for IPv6, BitLocker Drive Encryption, USB device control and the hundreds of other security add-ons will eventually make the day-to–day lives of many administrators a lot easier.
However, I think the upgrade path complexities, hardware compatibility issues and user education will give administrators a few sleepless nights early on. Plus getting quickly up to speed on Vista is a lot to ask of an IT department. Also, if you are still running Windows 2000 and XP machines, do you really want to add yet another version that needs to be supported?
I would advise against being an early adopter, and instead wait to see if any flaws are found. With Vista out in the wild and subject to the accelerated cycle of real-world vulnerability testing, many flaws will be discovered. You don't want your organization to be part of the Vista case history.
In the meantime, I would evaluate it yourself and test how well it sits in your own environment. If you use Active Directory and Group Policy to enforce policy standards, you will want to check the extended Group Policy settings. The hundreds of new settings may appear a little daunting, but they should allow you to configure settings to match your specific environment. The Network Access Protection (NAP) service also lets you set security standards that all computers must meet before connecting to a network. It could be set up so that virus signatures, for example, must be up-to-date before a server allows a connection. This will certainly reduce the problems caused by remote users connecting infected systems to your network.
More information:
Vista SP1: To be or not to be? Senior News Writer Bill Brenner asks the bloggers.
Learn which other Vista security features will make life easier for an administrator.
|
