Toolkit

Story: Windows XP Service Pack 2: a first look

Posted by: David Wright (Thursday 25 March 2004, 8:19 AM)

The reviewer makes a couple of naive and potentially dangerous comments regarding the security of a Windows system.

Yes, a firewall gives extra security when correctly configured. But a badly configured firewall can be worse than no protection at all - it can lead to complacency. Saying that, for example, Blaser Worm can't get through because the firewall is automatically turned on could be misleading.

I've been using a mixture of hardware and software firewalls and anti-virus protection since the early 90's and have worked on security projects.

One of the biggest problems I've seen with the personal firewalls is that they tend to restrict traffic that should come through, especially if there is a local network running. This often frustrates the users into just turning Firewalls off because it stops them doing normal tasks. They don't have the knowledge (and are often unwilling to learn) to configure such a connection themselves. Education is at least as important, if not more so than turning the firewall on by default.

Providing SP2 on CD, along with a WMV/MPEG video on how to secure your machine against attack (and why) would be a good start - and for the large number of users who don't have high-speed Internet connections, the shere size of the update will put people off downloading it in the first place.

Also, the comment on never opening e-mail from an unknown adressee is, to a certain extent, good advice, but this can mean that important mails are missed - installing a virus checker that works with your mail client is much more important. Viruses and Worms are often delivered from people you know, who have themselves been infected. Again, user education on attachments is very important here. If someone can't say something in plain-text, it probably isn't worth hearing.

The changes to IE are just glanced at in passing (pop-up and add-in manager). Has the rendering engine been updated to comply with W3C standards? Or does it still only render accurately to MS HTML standards?

What about other changes, such as to the .NET Framework, application compatibility etc.