There are good reasons why expectations have run higher for Windows Server 2003 from a security standpoint than for any prior edition that Microsoft has released.
With its April launch, Windows Server 2003 became the first operating system to ship since Microsoft commenced its much-touted Trustworthy Computing initiative in earnest, after Chairman Bill Gates sent the company's employees a memo in January 2002 telling them that security would be the "highest priority."
Soon after Gates issued the memo, Microsoft shut down Windows production for 10 weeks to train engineers in writing secure code. The company delayed Windows Server 2003 for roughly a year, in part to allow more time for intensive source-code analysis, threat modeling, penetration testing, buffer overrun checks and security audits.
The natural question becomes this: Is Windows Server 2003 living up to its billing? Some say no. More say it's too early to tell.
Better security by default
Early adopters, analysts and consultants agree that Microsoft has made improvements -- most notably, disabling many features and functions in the default install to reduce the surface area available for hackers to attack. Internet Information Server 6.0, for instance, is turned off by default. And overall, Microsoft shut off or reduced privileges for more than 30 services in Windows Server 2003.
"You design the role of the server and turn on only things appropriate to the task at hand. That is the greatest security feature we've seen and taken advantage of in Windows Server 2003," says Scott Campbell, director of IT operations at First American Title Insurance Co. in Santa Ana, Calif. The company is currently certifying applications to run on Windows Server 2003 in preparation for a gradual rollout to 172 servers.
But early adopters have yet to reach a verdict when judging the new operating system from a vulnerability standpoint. Most have neither tested nor deployed Windows Server 2003 at large scale or in a wide enough range of scenarios to tell just how solid it is.
"We want to see at least two quarters' worth of data -- and I don't care about patches. I want to see the penetration test results," says Jeremy Lehman, a senior vice president who heads the technology group at New York-based Thomson Financial, which has migrated about 20 servers to Windows Server 2003.
Some security experts are already dubious. They point out that some of the vulnerabilities affecting older Windows operating systems also plague Windows Server 2003, as demonstrated through patches that have been issued.
"I still give them an F," says Russ Cooper, surgeon general at TruSecure Corp. in Herndon, Va. "We keep getting examples of how nothing's changed."
But where some see a black cloud, others see a brighter horizon. Microsoft CEO Steve Ballmer noted this fall during keynote presentations that Windows Server 2003 had four critical vulnerabilities at the 150-day mark, compared with 17 for its predecessor at the same stage. "It's insufficient, but it's real improvement," he says.
The total vulnerability count was 32 for Windows 2000 and 14 for Windows 2003, according to Mike Nash, vice president of Microsoft's security business unit. Nash notes that certain vulnerabilities rated critical for some products are moderate for Windows Server 2003 because of its more secure default configuration. He adds that the vulnerability comparison to Windows 2000 is fair, since there are more people scrutinizing the product than there were three years ago.
But Marc Maiffret, co-founder and chief hacking officer at security services vendor eEye Digital Security Inc. in Aliso Viejo, Calif., doesn't view the statistics that Microsoft has put out -- or statistics from any vendor -- as a credible gauge. He says some vendors may neglect to mention that some advisories address multiple vulnerabilities, or they may silently address a collection of vulnerabilities via a service pack. "I've never seen anyone do a valid breakdown on the numbers. Everyone seems to have some type of agenda," he says.
And Tom Bittman, an analyst at Gartner Inc., says Windows 2000 Server was a "monster release," so it's not surprising that its vulnerability count was higher in the first 150 days. In contrast, Windows Server 2003 is an incremental release, he says. "The billing was Trustworthy Computing, the most secure operating system. The impression people took away is we would see a dramatic improvement," Bittman says. "This is a battle they cannot win. All they need is one dangerous security problem out there, and it'll look like they haven't solved their problem."
New security features
Microsoft introduced a collection of features and enhancements to help improve security in Windows Server 2003. Administrators who use public-key infrastructure services, for instance, will be able to automatically enroll and renew certificates. They will also be able to control access to resources based on an employee's role and set policies to prevent executable programs from running on computers.
Michael Stephenson, a Windows Server group product manager, says another helpful new feature that shipped with a resource kit, the network access quarantine service, lets users check the state of computers accessing the network and block VPN access if necessary.
Yet no matter how many security enhancements the new server operating system has, early users most frequently mention the new default settings that lock down services that might be vulnerable to attack.
Instead of knowing how to turn services off, IT shops now have to learn how to turn them on, says Bob Lamoureux, chief architect at Thomson Financial. He says the process isn't difficult, although it doesn't hurt to check out the installation guides beforehand.
Although some early adopters think Microsoft did a good job with the new default settings, TruSecure's Cooper still doesn't think enough services are turned off. Internet Explorer, for instance, is enabled at a high security level in Windows Server 2003 for server administration purposes, but Cooper questions why the Web browser is enabled at all. "I need to know that I don't need to reboot my mission-critical server because of the latest IE cumulative update," he says.
Other features that Cooper thinks should not be on the box include Outlook Express, Media Player and Remote Assistance -- "just all these tools that are unnecessary for a server and have been exploited in the past."
Cooper says he conducted a study at the end of July and found that almost every vulnerability affecting Windows 2000 Server also affects Windows Server 2003. "This certainly doesn't bode well for all the extra work Microsoft claims to have put into the code base," he says.
Gartner's Bittman says he thinks Microsoft will eventually have to consider a complete Windows code rewrite. "It's a lot easier to design secure code from Square 1 than it is to go back and find possible holes," he says.
It has certainly been a source of frustration for Microsoft to learn of bugs that date back to Windows NT 4.0. Steve Lipner, directory of security engineering strategy at Microsoft, says the company is, in come cases, finding new vulnerabilities in old code, including new patterns of buffer overruns.
Lipner says Microsoft does a postmortem to determine the cause of every vulnerability, trying to find out if it occurred because of a process error, a technology problem or a programmer's mistake. "Then we'll respond appropriately to try to update what we do and how we do it to make sure that our customers don't suffer through the cost of that problem again," he says.
But some users are growing frustrated. David Bryant, senior information security engineer at St. Petersburg, Fla.-based Raymond James Financial Inc., which has migrated about 25 of its 500 Windows servers to the new operating system, says he's concerned that the buffer overflow problems of prior Windows versions affect the latest iteration as well. He says he fears that Microsoft may be depending on users deploying firewall technologies to secure its software, rather than focusing on writing secure code.
"I'm disappointed that it appears that Server 2003 will again be an OS that I can count on for several critical patches every month," he says.
Maiffret at eEye says it will take another six months to determine whether the vulnerabilities that have surfaced are flukes or signs of more to come in Windows Server 2003. But the early appearance of default remote system vulnerabilities -- "the most severe type of vulnerability you can have in a Windows operating system" -- has led him to conclude that Windows Server 2003 is not substantially improved securitywise and that companies with large Windows 2000 Server installations will find no cost justification to migrate.
Users of Windows NT 4.0 will be more compelled to move, although security may not be the driving factor. Steve Yeager, vice president of information systems at WestAmerica Mortgage Co. in Oakbrook Terrace, Ill., says his company was in growth mode and needed to upgrade its aging NT servers. The new security features were simply a "side benefit," he says.
Gartner analyst John Pescatore views Windows Server 2003 as a major leap forward, and he estimates that, in the long run, it will have fewer critical security flaws than Windows 2000. He notes that Gartner originally advised clients to wait 18 months to deploy the new operating system but has now reduced that by six months.
Some organizations may want to wait for security improvements that are on the way. Ballmer recently outlined new technologies that will help to lock the memory so worms and exploits can't write into "bad pieces of memory after a buffer overrun problem." New perimeter inspection technologies and role-based security configurations are due in the second half of next year with the first service pack for Windows Server 2003.
"Microsoft has made some significant advances in the security of Server 2003," says Bryant, "but it still needs more work."
Computerworld's Jaikumar Vijayan contributed to this story.