Consumer versions of Windows were originally designed for ease-of-use
on a single-user PC without a network connection, and did not have
security features built in from the outset.
[61]
However, Windows NT and its successors are designed for security
(including on a network) and multi-user PCs, but were not initially
designed with Internet security in mind as much, since, when it was
first developed in the early 1990s, Internet use was less prevalent.
[62]
These design issues combined with programming errors (e.g.
buffer overflows) and the popularity of Windows means that it is a frequent target of
computer worm and
virus writers. In June 2005,
Bruce Schneier's
Counterpane Internet Security reported that it had seen over 1,000 new viruses and worms in the previous six months.
[63] In 2005,
Kaspersky Lab found around 11,000 malicious programs—viruses, Trojans, back-doors, and exploits written for Windows.
[64]
Microsoft releases security patches through its
Windows Update service approximately once a month (usually the
second Tuesday of the month), although critical updates are made available at shorter intervals when necessary.
[65]
In versions of Windows after and including Windows 2000 SP3 and Windows
XP, updates can be automatically downloaded and installed if the user
selects to do so. As a result, Service Pack 2 for Windows XP, as well as
Service Pack 1 for Windows Server 2003, were installed by users more
quickly than it otherwise might have been.
[66]
While the
Windows 9x series offered the option of having profiles for multiple users, they had no concept of
access privileges, and did not allow concurrent access; and so were not true
multi-user operating systems. In addition, they implemented only partial
memory protection. They were accordingly widely criticised for lack of security.
The
Windows NT
series of operating systems, by contrast, are true multi-user, and
implement absolute memory protection. However, a lot of the advantages
of being a true multi-user operating system were nullified by the fact
that, prior to Windows Vista, the first user account created during the
setup process was an
administrator account, which was also the default for new accounts. Though
Windows XP
did have limited accounts, the majority of home users did not change to
an account type with fewer rights – partially due to the number of
programs which unnecessarily required administrator rights – and so most
home users ran as administrator all the time.
Windows Vista changes this
[67] by introducing a privilege elevation system called
User Account Control. When logging in as a standard user, a logon session is created and a
token
containing only the most basic privileges is assigned. In this way, the
new logon session is incapable of making changes that would affect the
entire system. When logging in as a user in the Administrators group,
two separate tokens are assigned. The first token contains all
privileges typically awarded to an administrator, and the second is a
restricted token similar to what a standard user would receive. User
applications, including the
Windows shell,
are then started with the restricted token, resulting in a reduced
privilege environment even under an Administrator account. When an
application requests higher privileges or "Run as administrator" is
clicked, UAC will prompt for confirmation and, if consent is given
(including administrator credentials if the account requesting the
elevation is not a member of the administrators group), start the
process using the unrestricted token.
[68]
File permissions
All Windows versions from Windows NT 3 have been based on a file
system permission system referred to as AGLP (Accounts, Global, Local,
Permissions)
AGDLP
which in essence where file permissions are applied to the file/folder
in the form of a 'local group' which then has other 'global groups' as
members. These global groups then hold other groups or users depending
on different Windows versions used. This system varies from other vendor
products such as
Linux and
NetWare
due to the 'static' allocation of permission being applied directory to
the file or folder. However using this process of AGLP/AGDLP/AGUDLP
allows a small number of static permissions to be applied and allows for
easy changes to the account groups without reapplying the file
permissions on the files and folders.
Windows Defender
On January 6, 2005, Microsoft released a
Beta version of Microsoft AntiSpyware, based upon the previously released
Giant AntiSpyware. On February 14, 2006, Microsoft AntiSpyware became
Windows Defender
with the release of Beta 2. Windows Defender is a freeware program
designed to protect against spyware and other unwanted software. Windows
XP and Windows Server 2003 users who have
genuine
copies of Microsoft Windows can freely download the program from
Microsoft's web site, and Windows Defender ships as part of Windows
Vista and 7.
[69]
In Windows 8, Windows Defender and Microsoft Security Essentials have
been combined into a single program, named Windows Defender. It is based
on
Microsoft Security Essentials,
borrowing its features and user interface. Although it is enabled by
default, it can be turned off to use another anti-virus solution.
[70] Windows Malicious Software Removal Tool and the optional
Microsoft Safety Scanner are two other free security products offered by Microsoft.
