To view parent comment, click here.
To read all comments associated with this story, please click here.
NT is a reasonably secure OS. Starting from scratch at this point really helps no one. You lose compatibility and have to go through the iterative security testing process all over again. Even the "secure-from-the-ground-up" UNIX had to go through the trial by fire until it has reached its current status as a secure OS.
At work, could you use "Software Restriction Policies" to only allow the people you support to run supported applications? If they can't execute anything that they don't need for their job, then you wouldn't have to worry so much about them getting taken over by questionable stuff.
Link here:
http://www.microsoft.com/technet/security/prodtech/windowsxp/secwin...
"NT is a reasonably secure OS. Starting from scratch at this point really helps no one. You lose compatibility and have to go through the iterative security testing process all over again. Even the "secure-from-the-ground-up" UNIX had to go through the trial by fire until it has reached its current status as a secure OS."
Reasonbly is not good enough. You gain compatibility by having a box that old programs run in like using VMWARE to run the old OS inside the new one, each protected from each other. That's how you do it. XP has had plenty of time (if Microsoft cared) to secure their OS if they could. The foundation is cracked (think of cement with cracks) though so they can't.
"At work, could you use "Software Restriction Policies" to only allow the people you support to run supported applications? If they can't execute anything that they don't need for their job, then you wouldn't have to worry so much about them getting taken over by questionable stuff."
We do have those policies in place. But when have you ever seen those policies stop someone from going to a bad website. No one knows about ALL of them and while we do our best to detect SPAM and possibly bad links for them, some will always get through. So will the occasional e-mailed document that has a virus that the AV software didn't catch. Not to mention the documents/viruses brought in on USB memory cards. We of course run AV software on the desktop and update each night there is an update. But again, show me the tests that show that any AV software catches 100% of viruses.





Member since:
2005-07-06
I didn't purposely misspell your nick. My fault. I typed it once then copied it without realizing I had misspelled it.
Security problems are actually with both but more with the latter. Despite what they will tell you there is still a lot of security work to be done. They won't truly get really far though until they build a secure OS from the ground up.
Just like a parent that is supposed to set limits and protect their children. OS venders need to make sure to put in limits of what general users can do to themselves.
Too many people I support at work do not realize that what they do can cause someone to gain rights to their financial data on their computer. It's not that they are stupid but they assume that Microsoft would leave them vulnerable. I have to explain to them that MS does by making it too easy to say yes to hazardous websites, downloads, and attachments in e-mails.
To protect them we have several servers that constantly check all of these things, causing a slight delay in the user's access of all of them, and blocking things that are questionable. We even block zip files or any kind of file that can't be easily scanned. A message is put in their e-mail stating the attachment has been blocked and why. Same with websites.
We shouldn't have to go to this expense. The security should be built in the desktop OS to begin with.
Edited 2007-04-24 00:05