MS gets tough on Net security
Following a rash of security-related glitches in its products, Microsoft steps up efforts to protect Net surfers from potential risks.
Today, the software giant introduced several security enhancements that will be incorporated into its Internet Explorer 4.0 browser, including a new version of its Authenticode technology and a feature that lets administrators define Internet security "zones" where users can safely roam, the company said. Microsoft also introduced a new security system for Java designed to warn users about suspicious applets before they download them.
Bill Gates discussed the new security technologies in his keynote at Spring Comdex in Atlanta today. The new technologies could make it easier for systems administrators at companies to set up security policies for workers so that they don't inadvertently--or intentionally--download malicious programs such as viruses onto their computers.
However, with today's announcements, Microsoft has not radically altered its stance on the security of ActiveX, a technology that has been criticized by Net security experts for lacking a protective user "sandbox" like one found in Sun Microsystems' Java.
Microsoft argues that ActiveX programs, in order to be useful, cannot be constrained by a sandbox and that stamping programs with the digital signature of a software publisher is the best hope for protection against malicious hackers in the Internet age.
"The tension between security and functionality is not new," said Cornelius Willis, a group product manager at Microsoft. "The reason native code is still going to be with us is that there's no way to write powerful applications without it."
Still, with one of its new security enhancements, Microsoft hopes to eliminate one downside of its current security model, a phenomenon it calls "authorization fatigue."
With digitally signed ActiveX programs, and increasingly with Java applets, users are sometimes presented with a thicket of warning windows about potential security risks that they must respond to. Microsoft notes that an abundance of warnings often lose their effectiveness with end users.
By permitting companies to define trusted zones on the Web, Microsoft aims to reduce the burden on individuals while protecting them from risky code. The new zones feature will be supported in the next beta version of Internet Explorer 4.0. It will also be supported in IE Administration Kit 4.0, a tool that will let systems managers define trusted and untrusted zones for workers and to prevent them from modifying related preferences in their browsers.
In addition, Microsoft has created a new "capabilities-based" security system for Java applets that integrates with the IE kit. Similar to a feature in Netscape Communications' Communicator Internet software, the system permits digitally signed Java programs to venture outside the sandbox for specific tasks such as deleting or reading a file.
With IE Administration Kit 4.0, managers will be able to define specific tasks that Java programs are allowed to do.
The new Java security system could cause some frustrating compatibility problems for end users as well. The Microsoft and Netscape Java security systems are different because Sun has not released a standard version of capabilities-based security to its Java licensees, Willis said. Sun said the technology will be available this summer in the Java development kit 1.2.
Today, Microsoft will post Authenticode 2.0, a new version of its code-checking program for Internet Explorer. The software, which can be downloaded for Explorer 3.0, will allow a browser to check to see if a digital certificate for a program has been revoked.
The company will also offer a certificate management feature to specify which ActiveX controls and Java applets run on an individual computer. The feature will be incorporated into IE 4.0, which is due in final form by the end of the summer.
The zones feature, new Java security system, and certificate management will be available in beta form within six to eight weeks.
Some analysts welcomed Microsoft's announcements but suggested that clever users could find a way around the "lockdown" controls imposed by systems managers.
"Being able to set policy for enterprise is a step in right direction," said Clay Ryder, an analyst at Zona Research. "I'd like to see this stuff eventually on a centralized server. It belongs on Windows NT server."