News

Microsoft Touts Security in Windows 7

New features include revised User Account Control, enhanced BitLocker encryption, new Windows Biometric Framework

• By Herb Torrens
• 04/27/2009

Microsoft last week described improved security features in its upcoming Windows 7 operating system, currently in beta release.

Those security features include a revised User Account Control (UAC) feature, an enhanced BitLocker encryption solution, Authentication Profiles, and a new Windows Biometric Framework. Most of these features were first introduced in Windows Vista.

"Vista was a concerted effort to focus on security," said Michael Cherry, research vice president for operating systems at Directions on Microsoft. "However, some of the new features, such as UAC, were a little too 'in your face.'"

The UAC annoyed Vista users with too many unclear dialog boxes about security. Microsoft has since announced a plan to tweak the UAC in the release candidate version of Windows 7.

"[The UAC] caused a lot of aggravation for users," Cherry said, "but make no mistake: Microsoft was and is doing the absolute right thing in regards to privileges. The fundamental premise of business computing is that a user should be doing his or her job with the least privileges possible."

One way that Windows 7 limits privileges is by setting up most users as "standard users" who are not part of the administrative group. They only are notified by UAC when programs try to make changes to their computers, and not for common administrative tasks, according to a Windows 7 security blog.

Windows 7 will also include BitLocker, an encryption solution designed to protect data on laptops, desktops, and servers. With Windows 7, group policy settings can integrate with smart cards on non-OS drives. In addition, the partitioning of drives has also been simplified, according to the blog.

BitLocker To Go is a new feature introduced with Windows 7. It provides strong encryption to protect data on removable drives.

"BitLocker To Go is an excellent encryption solution for those devices that is simple and easy to use, and it contains a reader that can be transferred to an XP machine," Cherry said.

Authentication Protocols in Windows 7 allows users to share data between home and office machines using an online ID. It uses a new protocol called Public Key-based User to User (PKU2U). It eliminates choosing between Kerberos and NTLM (Windows challenge/response) protocols, according to the blog.

Windows 7 also introduces a new Windows Biometric Framework to support biometric authentication devices, such as fingerprint readers. The framework contains two options for configuring biometric devices that can be managed from the Control Panel or Group Policy.

Overall, Cherry said that the security improvements in Windows 7 are "incremental" since Vista. He added that "the beta is incredibly solid and they took so much heat on Vista that I am very optimistic that Windows 7 will ship on time or maybe even ahead of time."

Microsoft recently announced that the release candidate version of Windows 7 will be available for download on April 30 by MSDN and TechNet subscribers, with public availability scheduled for May 5.