Windows Vista introduces numerous new security and safety features intended to deliver greater privacy, security, and system integrity than earlier releases of Microsoft Windows. In 2002 Microsoft announced its Trustworthy Computing initiative, which introduced within the corporation an ambition to build secure software by means of new development policies and procedures. New principles mandated the reviewal of software to ensure that architectures, designs, and implementations promote resilience to attacks and vulnerabilities; that default configurations promote security from the onset; that software patches are broadly distributable and securely deployable; and that straightforward security guidance is available. Windows Vista is the first Microsoft Windows operating system built in full accordance with the principles of this initiative. During its development Microsoft executives including Bill Gates and Jim Allchin cited security as being both its most important development factor and value proposition for consumers.
New security features in Windows Vista include anti-malware software (Windows Defender); exploit protection features such as Address Space Layout Randomization, Data Execution Prevention improvements, and stack overflow detection for operating system binaries. Windows Firewall introduces new features such as support for IPSec, Kerberos, and outbound filtering. For privacy, Windows Vista introduces features such as Encrypting File System improvements (page file encryption and smart card support), and parental controls. For system integrity, Windows Vista introduces features such as Code Integrity for the enforcement of kernel-mode code-signing to assess the legitimacy of the boot process and of crucial system components. Windows Service Hardening reduces privileges of Windows services and limits their interactions between file system object resources, processes, and other Windows services (which was a noteworthy avenue of attack in earlier releases of Windows, with Blaster being a prominent example).
There are major changes to or replacements of components that originated in earlier releases of Windows. CryptoAPI is replaced by Cryptography API: Next Generation. GINA is succeeded by Credential Providers (with refactoring in Winlogon). With the introduction of User Account Control, Windows Vista is built on the principle of least privilege. The use of NTFS for the partition on which Windows is installed is now mandatory. Mandatory Integrity Control enforces lower and higher levels of privilege across file system object resources and processes. Windows Resource Protection supersedes Windows File Protection. There are several changes to strengthen access-control lists of system directories when contrasted with previous releases of Windows. On x64-based systems kernel-mode driver signing is mandatory; unsigned software will not load and will not run.
Windows Vista is the first release of Microsoft Windows with functionality based on firmware and hardware designed by the Trusted Computing Group (TCG), with native support for the TCG specification and secure cryptoprocessor, Trusted Platform Module (TPM). BitLocker Drive Encryption, a full-volume encryption feature available in Windows Vista Enterprise and Windows Vista Ultimate relies on both TCG-compliant firmware and TPM 1.2 to ensure boot integrity by sealing volume encryption secrets to an environment; if subsequent environments do not match these measurements, secrets will not be revealed, and the volume will not be decrypted.
Windows Vista additionally introduces digital rights management (DRM) for commercial high-value content.
User Account Control
User Account Control is a new infrastructure that requires user consent before allowing any action that requires administrative privileges. With this feature, all users, including users with administrative privileges, run in a standard user mode by default, since most applications do not require higher privileges. When some action is attempted that needs administrative privileges, such as installing new software or changing system or security settings, Windows will prompt the user whether to allow the action or not. If the user chooses to allow, the process initiating the action is elevated to a higher privilege context to continue. While standard users need to enter a username and password of an administrative account to get a process elevated (Over-the-shoulder Credentials), an administrator can choose to be prompted just for consent or ask for credentials. If the user doesn't click Yes, after 30 seconds the prompt is denied.
UAC asks for credentials in a Secure Desktop mode, where the entire screen is faded out and temporarily disabled, to present only the elevation UI. This is to prevent spoofing of the UI or the mouse by the application requesting elevation. If the application requesting elevation does not have focus before the switch to Secure Desktop occurs, then its taskbar icon blinks, and when focussed, the elevation UI is presented (however, it is not possible to prevent a malicious application from silently obtaining the focus).
Since the Secure Desktop allows only highest privilege System applications to run, no user mode application can present its dialog boxes on that desktop, so any prompt for elevation consent can be safely assumed to be genuine. Additionally, this can also help protect against shatter attacks, which intercept Windows inter-process messages to run malicious code or spoof the user interface, by preventing unauthorized processes from sending messages to high privilege processes. Any process that wants to send a message to a high privilege process must get itself elevated to the higher privilege context, via UAC.
Applications written with the assumption that the user will be running with administrator privileges experienced problems in earlier versions of Windows when run from limited user accounts, often because they attempted to write to machine-wide or system directories (such as Program Files) or registry keys (notably HKLM). UAC attempts to alleviate this using File and Registry Virtualization, which redirects writes (and subsequent reads) to a per-user location within the user's profile. For example, if an application attempts to write to “C:\program files\appname\settings.ini” and the user doesn't have permissions to write to that directory, the write will get redirected to “C:\Users\username\AppData\Local\VirtualStore\Program Files\appname\.”
Encryption
BitLocker, formerly known as "Secure Startup", this feature offers full disk encryption for the system volume. Using the command-line utility, it is possible to encrypt additional volumes. Bitlocker utilizes a USB key or Trusted Platform Module (TPM) version 1.2 of the TCG specifications to store its encryption key. It ensures that the computer running Windows Vista starts in a known-good state, and it also protects data from unauthorized access. Data on the volume is encrypted with a Full Volume Encryption Key (FVEK), which is further encrypted with a Volume Master Key (VMK) and stored on the disk itself. Format in Windows Vista now writes zeros to the whole disk when a full format is performed; Windows XP and earlier releases of Windows do not write zeros when performing a full format. Moreover, format has been updated to be BitLocker-aware; performing a format of a BitLocker-protected partition will specifically destroy BitLocker key data.
Windows Vista is the first Microsoft Windows operating system to offer native support for the TPM 1.2 by providing a set of APIs, commands, classes, and services for the use and management of the TPM. A new system service, referred to as TPM Base Services, enables the access to and sharing of TPM resources for developers who wish to build applications with support for the device.
Encrypting File System (EFS) in Windows Vista can be used to encrypt the system page file and the per-user Offline Files cache. EFS is also more tightly integrated with enterprise Public Key Infrastructure (PKI), and supports using PKI-based key recovery, data recovery through EFS recovery certificates, or a combination of the two. There are also new Group Policies to require smart cards for EFS, enforce page file encryption, stipulate minimum key lengths for EFS, enforce encryption of the user's Documents folder, and prohibit self-signed certificates. The EFS encryption key cache can be cleared when a user locks his workstation or after a certain time limit.
The EFS rekeying wizard allows the user to choose a certificate for EFS and to select and migrate existing files that will use the newly chosen certificate. Certificate Manager also allows users to export their EFS recovery certificates and private keys. Users are reminded to back up their EFS keys upon first use through a balloon notification. The rekeying wizard can also be used to migrate users in existing installations from software certificates to smart cards. The wizard can also be used by an administrator or users themselves in recovery situations. This method is more efficient than decrypting and reencrypting files.
Windows Firewall
Windows Vista significantly improves the firewallThe January 2006 issue of The Cable Guy covers the new features and interfaces in Windows Firewall in greater detail. to address a number of concerns around the flexibility of Windows Firewall in a corporate environment: IPv6 connection filtering Outbound packet filtering, reflecting increasing concerns about spyware and viruses that attempt to "phone home". With the advanced packet filter, rules can also be specified for source and destination IP addresses and port ranges. Rules can be configured for services by its service name chosen by a list, without needing to specify the full path file name. IPsec is fully integrated, allowing connections to be allowed or denied based on security certificates, Kerberos authentication, etc. Encryption can also be required for any kind of connection. A connection security rule can be created using a wizard that handles the complex configuration of IPsec policies on the machine. Windows Firewall can allow traffic based on whether the traffic is secured by IPsec. A new management console snap-in named Windows Firewall with Advanced Security which provides access to many advanced options, including IPsec configuration, and enables remote administration. Ability to have separate firewall profiles for when computers are domain-joined or connected to a private or public network. Support for the creation of rules for enforcing server and domain isolation policies.
Windows Defender
Windows Vista includes Windows Defender, Microsoft's anti-spyware utility. According to Microsoft, it was renamed from 'Microsoft AntiSpyware' because it not only features scanning of the system for spyware, similar to other free products on the market, but also includes Real Time Security agents that monitor several common areas of Windows for changes which may be caused by spyware. These areas include Internet Explorer configuration and downloads, auto-start applications, system configuration settings, and add-ons to Windows such as Windows Shell extensions.
Windows Defender also includes the ability to remove ActiveX applications that are installed and block startup programs. It also incorporates the SpyNet network, which allows users to communicate with Microsoft, send what they consider is spyware, and check which applications are acceptable.
Device Installation Control Windows Vista allow administrators to enforce hardware restrictions via Group Policy to prevent users from installing devices, to restrict device installation to a predefined white list, or to restrict access to removable media and classes of devices.
Parental Controls