Software Developments: Security takes center stage with MS Vista

Two years after Microsoft chairman and chief software architect Bill Gates first revealed an early version of his company's next operating system - originally codenamed Longhorn - Microsoft has finally released the first beta for the new system, which is now branded as Vista.The new system was released at the end of July to about 500,000 programmers and technology professionals for review and testing, and thus far, a sample of early users has expressed optimism about Vista's Beta 1, which showcases a number of security and ease-of-use enhancements over Windows XP and older MS operating systems.

"Personally, I like the stability of the product. It's very stable, even though it's just in beta," said Shafat Qazi, chief executive officer of BQE Software Inc., a Microsoft Business Solutions reseller and business software provider headquartered in Torrance, Calif. "Finally, they have made some fundamental changes to the security, like the way the administrator accounts are different from the user accounts, and they keep spyware and viruses from PCs. It's not a new concept, it's been in Linux for years, but it's great to see them do that because it's much needed."

One of the security features in Vista, and the biggest change from the XP and older operating systems that Qazi referred to, is the ability for an administrator to limit a user's account to specific rights and applications. The administrator in Vista can limit the user's ability to download files and applications off the Web or from links within e-mails, as well as restrict the user from access to certain applications.

Beta 1, however, is not ready for the end user just yet, as this is what technology professionals call the "developer's release" - the release on which developers can begin building their vertical or horizontal products to ensure integration with the operating system.

"This beta is for developers, not the end users or geeks like me," explained Susan E. Bradley, a partner, CPA and CITP at Fresno, Calif.-based Tamiyasu, Smith, Horn & Braun Accountancy Corp. "It's for them to recode their products ... so that the program stays within the boundaries so the end user doesn't have the full rights, limits permissions and rights, so it's more protected from bad guys throwing stuff at us. Development cycles take time. Some applications like time and billing and QuickBooks have to get on board so they can properly run in this environment."

Beta 2 is due out this fall, and will be available to more end users to provide feedback. However, the final product is not due out until the second half of 2006 - a release date that follows when many of the major accounting software providers like QuickBooks and Sage unveil their annual software upgrades.

Meanwhile, other important security upgrades to Vista are designed for catching spyware and phishing attacks, as well as a built-in firewall that is not turned on by default in the beta.

"Right now [in XP] the firewall is what I call a half-firewall," said Qazi. "It does inbound security but not outbound, and in Vista the firewall is not automatically on, which is a bummer. I am hoping that by Beta 2 it will be - they have received a lot of feedback on this for Beta 2."

Last year, Forrester Research's Laura Koetzle, vice president and research director of Forrester's Computing Infrastructures and Security Group, wrote in a report that Microsoft ranked above four major Linux distributors - Debian, Red Hat, MandrakeSoft and SUSE - with the lowest number of total security flaws, at 128. And the report noted that all were later fixed.

However, MS did have the highest percentage of high-severity flaws - flaws that allow hackers to violate the system and gain complete control, and are severe enough to have the Computer Emergency Response Team Coordination Center issue an advisory.

The CERTCC is a center of Internet security expertise, located at the Software Engineering Institute, a federally funded research and development center operated by Carnegie Mellon University.

More new features

Other tools for accountants within the Vista operating system include added search tools. One is the virtual folders feature, allowing a user to save a search done in a separate folder for the next time the user needs that information. For example, if a CPA wants to find all the files containing a client's name, the CPA searches for the name and, once the files are retrieved, saves that search as a virtual folder for the next time they want to find the client's files again.

A new search box within Internet Explorer 7 - the Web browser embedded in Vista - simulates the multi-engine search box in Mozilla's Firefox Web browser, and allows the user to pick between Google, Yahoo! Search or MSN Search.

Internet Explorer 7 also offers a number of added security features, like those helping prevent users from entering a phishing site - a Web site that the user has been given, usually as a link in an e-mail, from a false user claiming to be a legitimate enterprise to gain private information for the purpose of identity theft. The user can also check the validity of a Web site by viewing the site's security certificate.

Another search tool residing in the Start section of Vista is designed to save end users time trying to find the correct program in which they saved a client's information. In XP and older systems, the user needs to click Start and move the mouse onto the Programs listing. A short list of recently used programs comes up, but if the program the user is looking for does not appear, the user has to search through a listing of all the applications available on that PC before finding the correct application and entering into it. With Vista, the user can just type the name of the program from the Start section and go immediately to it.

Making the most of it

Developers like BQE Software are taking full advantage of the beta versions to ensure that their newest releases will run on both XP and Vista smoothly.

"We're less focused on reinventing the wheel and more piggy-backing what's already there," said Qazi. "As a development platform, Vista has a major boost to the .Net framework. It's a huge improvement from the 1.1 framework, which is three years old, [and] for the development world it may even be four years old. It helps us improve our speed in Web products, and the development cycle is significantly reduced."

Qazi went on to explain that the .Net framework is significant because it provides a common way - the Internet - to connect applications, rather than a specific proprietary code to integrate to. The .Net environment enables partners and outside developers to run on the new OS easier and faster, without changing a great deal of their code.

Some, however, are not very impressed with the new features that Vista offers.

"There is nothing terribly exciting to say about it," said analyst and Beta 1 tester Peter M. Russo, a consultant for Pierre Audoin Consultants in New York City. "On the performance side, today you are supposed to defrag every few months; now [with Vista] it's more automated. The PC will run faster and to some degree with less maintenance, but probably not as much as they are claiming."

Although the final version of the newest MS operating system is not projected to be out until the end of 2006, if history holds true, computers running on Vista will not outnumber computers running on XP for quite some time.

Forrester Research analyst and vice president Ted Schadler wrote in a July report that XP finally surpassed Windows 98 as the most popular operating system for consumer PCs this year - four years after the initial release.

"The lesson of this slow refresh cycle is that it could take Windows Vista as much as three years to exceed 50 percent of the installed base of PCs," wrote Schadler.