Feeds

Gates: protect Windows Vista users with IP

Stoopid human

Top three mobile application threats

Improved technology and design alone will not be enough to keep Windows Vista and Office 2007 users safe from hackers and identity thieves, according to Bill Gates.

The industry must find ways to protect users from themselves in a world where people and business connect more devices, and where more business is done online.

According to Gates, IPv6 and IPsec combined with smart-card access - rather than passwords - are the best ways to protect users' identities and safeguard systems.

For the record, IPv6 and IPsec are available using tunneling in Windows XP and are native in Windows Vista, with native support also due in Longhorn Server. Microsoft's version of smartcards, called CardSpace, shipped with Windows Vista.

Bill Gates delivered his message today in his last RSA Conference keynote, attended by 4,000 people. It was a tag-team performance with chief research and strategy officer Craig Mundie, who'll be filling Gates's now-traditional conference opening slot in San Francisco next year.

It was five years ago at RSA that Gates, at Mundie's prompting, issued the Trustworthy Computing memo, which called for better security in Windows and that led to an overhaul in Windows engineering practices.

Gates today claimed Windows Vista and Office 2007, launched last week, as the first two Microsoft products to benefit from those re-worked process. Mike Nash, corporate vice president for security, made similar claims for Windows Server 2003 back in January 2003, saying Microsoft had spend $200m to lock down its new server under Trustworthy Computing.

While making the expected plug for improved security and privacy safeguards in Windows Vista and Office 2007, Gates believes the challenge now is to avoid mistakes and accidents that can take place as more systems become connected.

"The challenge we face in administering and using them [Windows Vista and Office 2007] is humans - and humans make mistakes. A large part of what we do going forward is not dealing with the engineering aspects of the software we build, but we have to deal with the fact errors do happen whether by accident or intentional," he said.

IPv6 and IPsec have greater memory than IPv4 meaning more information can be placed in the IP packets about the devices and applications connecting online and about users' access rights. Microsoft's Longhorn Server, due by the end of the year, will feature a simplified interface to overcome the complexities of setting up and managing IPv6 and IPsec. "We think it will be the way we build this model of seamless, easy-to-use access across these different devices and applications," Gates said.

Like many vendors, Microsoft has tussled with allowing users to easily connect to different web sites and online services through their browser, without using passwords, while maintaining security and privacy.

It was some years back, Gates wrongly forecast the death of the password. While supporting the principle of smart cards as one alternative, where users create and carry their identity with them in digital form, Microsoft has - naturally - taken its own approach by devising CardSpace - formerly known as InfoCards. As ever, the decision to push a Microsoft-centric approach has failed to galvanize the industry, even though InfoCards used WS- specifications for trust, security, exchange and security policy.

Gates, today announced a new direction - collaboration with the community based OpenID initiative. OpenID authenticates users online via URIs or XRIs, and Microsoft is working on support for OpenID 2.0 in Windows Vista.

According to Mundie, OpenID helps Microsoft span security form the enterprise to the internet by providing the internet-portion of the authentication circle.

"If I want more security, but in browser, this marriage of CardSpace and OpenID is a big step forward. It eliminates the man in the middle attack," Mundie said. "We have a continuum from browser-based environments to [the] complete enterprise access control environment, and that's going to be step in the right direction." ®

3 Big data security analytics techniques

More from The Register

next story
Next Windows obsolescence panic is 450 days from … NOW!
The clock is ticking louder for Windows Server 2003 R2 users
This time it's 'Personal': new Office 365 sub covers just two devices
Redmond also brings Office into Google's back yard
Ubuntu 14.04 LTS: Great changes, but sssh don't mention the...
Why HELLO Amazon! You weren't here last time
Half of Twitter's 'active users' are SILENT STALKERS
Nearly 50% have NEVER tweeted a word
Ditch the sync, paddle in the Streem: Upstart offers syncless sharing
Upload, delete and carry on sharing afterwards?
Microsoft TIER SMEAR changes app prices whether devs ask or not
Some go up, some go down, Redmond goes silent
Batten down the hatches, Ubuntu 14.04 LTS due in TWO DAYS
Admins dab straining server brows in advance of Trusty Tahr's long-term support landing
Red Hat to ship RHEL 7 release candidate with a taste of container tech
Grab 'near-final' version of next Enterprise Linux next week
Windows 8.1, which you probably haven't upgraded to yet, ALREADY OBSOLETE
Pre-Update versions of new Windows version will no longer support patches
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.