making headway in plugging security leaks
by Alan Zisman (c) 2004 First
published in Business
11-17, 2004; issue 759 High Tech Office column
It's easy to get on software giant Microsoft's case about the ongoing
flood of Windows security issues. Every time there's another virus
outbreak, expect to hear a chorus of Microsoft bashing. Even when the
company tries to make it right, as with its recent release of fixes for
20 different flaws, Microsoft gets complaints.
Some days it just doesn't pay a monopoly to get out of bed.
But Microsoft really is trying to get it right, with a number of recent
initiatives as evidence that it's working hard. Many computer users
have had the experience of going to Microsoft's Windows Update website
only to be told that their computer needed several dozen "critical
updates," requiring hours online and multiple restarts. Microsoft is
trying to help ease the pain with a Windows Security Update CD.
Available free (even including free courier delivery) from www.microsoft.com/security/protect/cd/order.asp
it works with Windows versions from Win98 on, automatically detecting
the installed version, and providing recommended updates and patches.
Inevitably, it's not got the latest patches; after running the CD, a
trip to the Windows Update site will still be necessary, but the number
of fixes needing to be downloaded will be greatly reduced. If you
manage your own Windows computer, get this CD.
Free update CDs for Microsoft Office 2000 and XP versions are also
worthwhile. In this case, go to office.Microsoft.com/officeupdate/
find the More About Updates section, and then click on Order Office
service packs on CD-ROM.
In addition, the company is hard at work at a major upgrade for Windows
XP users. Service Pack 2 should be available mid-year, offering
enhanced security features. For example, XP's built-in firewall will
now screen outgoing Internet access, bringing it more on a par with
products such as ZoneAlarm. And where earlier versions tended to leave
many security settings off by default, this version turns on the
firewall and automatic downloading of security patches unless the user
explicitly chooses to do otherwise.
A new Security Center puts many of the various Windows XP
security-related options in a single location, easier to access than
wending your way through multiple Control Panels.
If you like living on the edge, you can download SP2's Release
Candidate 1 from http://www.microsoft.com/sp2preview/
Just be prepared for a nearly 300-MB file. I've been running this
pre-release version without problem, but your mileage may vary.
Microsoft has usually made its various service pack releases available
free or for a nominal shipping charge if CDs are required. In some
cases where new operating system features were bundled in, as with
Windows 95B's FAT32 support for large hard drives, or 98SE's Internet
Connection Sharing, Microsoft did not make them available for general
downloading. In this case, I would think the company would want to make
XP SP2's security improvements available as widely as possible.
It will be a while, however, before the company releases a next
generation Windows. At the March Windows Hardware Engineering
Conference (WinHEC), Microsoft Chairman Bill Gates suggested that the
company's Longhorn version shouldn't be expected before 2006. Very
preliminary Longhorn versions have featured updates to core operating
system features, including a new database-like file system allowing
users to do advanced searching along with dramatic improvements to the
basic communications and graphics features.
Company officials have been mum about rumours that Microsoft will
release an interim for-sale version of Windows after the upcoming
Service Pack 2 but prior to the far away Longhorn, a strategy similar
to the one that saw Microsoft market Windows ME to consumers to fill
the gap in significant upgrades between the release of Windows 98 and
XP. The gap between XP's 2001 release and Longhorn's expected 2006
release would be the longest time Microsoft has gone without the
revenue-boost of a new Windows version.