Roger Halbheer on Security » Products http://www.halbheer.ch/security Information Security Discussion by Microsoft's Worldwide Chief Security Advisor. Thu, 12 Jan 2012 19:53:16 +0000 en hourly 1 Connecting with your Windows Phone 7 http://www.halbheer.ch/security/2011/11/04/connecting-with-your-windows-phone-7/ http://www.halbheer.ch/security/2011/11/04/connecting-with-your-windows-phone-7/#comments Fri, 04 Nov 2011 09:34:47 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/11/04/connecting-with-your-windows-phone-7/ I tried to convince my wife that using the Windows Phone 7 to keep track of the shopping to do is a cool idea. Well, she is not there (yet). And now I saw the latest commercial…

Probably I should convince my kids, not my wife

Roger

. . . → Read More: Connecting with your Windows Phone 7]]> I tried to convince my wife that using the Windows Phone 7 to keep track of the shopping to do is a cool idea. Well, she is not there (yet). And now I saw the latest commercial…

Probably I should convince my kids, not my wife Smile

Roger

]]> http://www.halbheer.ch/security/2011/11/04/connecting-with-your-windows-phone-7/feed/ 0 EMET–Protection Against Zero-Days http://www.halbheer.ch/security/2011/10/23/emetprotection-against-zero-days/ http://www.halbheer.ch/security/2011/10/23/emetprotection-against-zero-days/#comments Sun, 23 Oct 2011 22:27:33 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/10/23/emetprotection-against-zero-days/ The Enhanced Mitigation Experience Toolkit is definitely not new but I recently realized that not too many people know about it – and they should. EMET helps you to raise your shields against zero-days and any exploit in the wild. I do not say that it is a silver bullet but it is definitely going . . . → Read More: EMET–Protection Against Zero-Days]]> The Enhanced Mitigation Experience Toolkit  is definitely not new but I recently realized that not too many people know about it – and they should. EMET helps you to raise your shields against zero-days and any exploit in the wild. I do not say that it is a silver bullet but it is definitely going into this direction – a little bit.

You can find all the necessary information on EMET here:

Before you start, please make sure that you have the Bitlocker recovery key ready (you are running Bitlocker, don’t you?) or that you suspend Bitlocker for the time of the configuration as EMET might change your Data Execution Prevention settings, which change your bootloader, which invalidates the Bitlocker signature, which needs to be proven.

I always love to strengthen my policies and see when something breaks and how. I started to use it and it actually provides you a fairly straight-forward interface with what is running and in which state:

image

You can then configure your applications and define on which level you want them to be protected. It might then happen that this pops up:

image

I wont tell you which application it was but I was a little bit scared…

Anyway, if you did not use it yet, I think you should!

Roger

]]> http://www.halbheer.ch/security/2011/10/23/emetprotection-against-zero-days/feed/ 2 Comparing Windows Phone 7 and iPhone http://www.halbheer.ch/security/2011/10/20/comparing-windows-phone-7-and-iphone/ http://www.halbheer.ch/security/2011/10/20/comparing-windows-phone-7-and-iphone/#comments Thu, 20 Oct 2011 16:08:16 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/10/20/comparing-windows-phone-7-and-iphone/ Well, I have to admit – I am biased. I never used an iPhone in my life and based on my experience with my iPod, I hope I never have to, but who knows. I really do not like the UI which – to me – is everything but user friendly and the worst thing . . . → Read More: Comparing Windows Phone 7 and iPhone]]> Well, I have to admit – I am biased. I never used an iPhone in my life and based on my experience with my iPod, I hope I never have to, but who knows. I really do not like the UI which – to me – is everything but user friendly and the worst thing with iPhone is iTunes. Whenever iTunes starts to download podcasts and similar things the performance of my notebook just drops significantly – and it is not that slow generally.

When my parents recently wanted to buy a smartphone, they asked me… I told them fairly simple: “It is your choice but I cannot give you any support on an iPhone as I do not know it”. I guess, it is kind of blackmailing but that’s life Smile. So, they bought a Windows Phone 7 and guess what – they love it but they are under constant pressure by their friends… And then recently a person (owning an iPhone) said: “It is actually fairly simple: If you just want to do simple and easy stuff, iPhone is the right device. If it gets sophisticated, you need a Windows Phone 7” – and I did not even offer this guy a bottle of wine, I probably should have.

The reason for this blog is an article I started to read called Windows Phone 7.5 vs. iOS 5 – you should read it. He kind of stumbles across the same issues as I do with my iPod (and btw, he seems to be an experienced iWhatever user):

But it’s not really the performance that bothers me with iOS 5, and as noted previously I’m sure the iPhone 4S will clear those issues up nicely. It’s the usage model. Apple’s mobile OS, like its desktop OS, is inscrutable. It presents a grid of icons, none of which can offer more than the dumbest heads-up that something has happened: A little red “2″ on the Mail icon suggests you have two unread emails, for example, but that’s all you get.

On Windows Phone, yes, we have these dumb little overlays too. And yes, the Mail tile will indeed display a little “2″ when you have two unread emails. But other tiles are more descriptive, “alive with information” as Microsoft says. The Calendar tile has the title and time of your next appointment, so you can check that information without diving into the app. Third party weather apps actually display the weather forecast, so, again, you don’t have to actually tap anything to find out what’s happening. All across the Windows Phone ecosystem, these more intelligent apps provide you with information right from the Start screen, no navigation required.

Before that, he was actually looking at Apple’s business model (emphasis is by me):

On the 3GS, it’s also dog slow, a situation that will obviously not be the case on the iPhone 4S, which has dramatically faster innards. You tap and then wait, and just when you start to doubt you tapped anything, whatever it is you tapped finally launches. It’s not a good experience, and one suspects that’s completely by design. Apple, after all, has mastered the quickie obsolescence/upgrade model better than any company.

Back to the user interface:

I’ve used photo viewing as a canonical example of why the Windows Phone usage model–which thinks and works the way you do, not vice versa–is superior to that of the iPhone and iOS. And that’s as true today as it was a year ago. If you want to view photos in iOS, you–yes, you, the user–needs to think first where those photos may reside. Are they in the Photos app? Are they in the Facebook app? Are they in the MobileMe Gallery app? The App Store for iOS, after all, is just bursting with apps. It’s the platform’s single biggest selling point, as you know.

In Windows Phone, you just visit the Pictures hub. Here, all of your photos are brought together in one place, whether they’re on the phone (taken with the camera or otherwise saved to the device), on Windows Live (where your camera photos can be automatically backed up, albeit in versions for sharing, not full-sized originals), on Facebook, or on Twitter. Third party photo apps also integrate into the Pictures hub, so while you could do the iOS-style “think, then search for the app” thing, you don’t have to: They’re all in one place.

To be fair, he has quite some nice words for iPhone as well:

Where iOS really excels, of course, is with the devices on which it runs. Apple is, at heart, a mobile devices company, and its iPhone, iPod touch, iPad, and Mac laptop product lines are all highly rated and desirable. I don’t have my iPhone 4S yet, but aside from a concern about the too-small screen, which makes the virtual keyboard hard to use, and the lack of an all-new design, there’s little to genuinely criticize there. The current crop of Windows Phones, which date back a year, are getting long in the tooth.

Looking forward to Nokia…

And the last statement I love:

In the end, iOS 5 is the safe choice, the one you recommend to less experienced users. But it is Windows Phone that occupies the innovation seat that Apple once commanded, back in 2007. If you’re looking for the best aesthetics, the best efficiency, and the best software design, Windows Phone is where it’s at. And that’s something I suspect Apple’s most ardent fans will have difficulty understanding. But look beyond your favorite platform for a moment and you will discover that the outside world is in some ways moving along faster than is Apple. And that what brought you to Apple in the first place is happening elsewhere.

Ah, yes you have more apps in the marketplace on iPhone – I know. But I usually challenge people to give me one single app I really want to use (not the stuff I delete after the second use), which I do not have on Windows Phone 7. There is one (1) – it is called “Peak Finder Alps” and that’s it so far. I know that I am not the ultimate representative sample…

When are you going to get your Windows Phone 7?

Roger

]]> http://www.halbheer.ch/security/2011/10/20/comparing-windows-phone-7-and-iphone/feed/ 0 Using the Microsoft Diagnostics and Recovery Toolset (DaRT) for Incident Response http://www.halbheer.ch/security/2011/10/19/using-the-microsoft-diagnostics-and-recovery-toolset-dart-for-incident-response/ http://www.halbheer.ch/security/2011/10/19/using-the-microsoft-diagnostics-and-recovery-toolset-dart-for-incident-response/#comments Wed, 19 Oct 2011 13:01:45 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/10/19/using-the-microsoft-diagnostics-and-recovery-toolset-dart-for-incident-response/ A few years ago I posted on DaRT after having seen it: Microsoft Diagnostics and Recovery Toolset. It is a really good an interesting tool for a lot of problems, one of them being incident response. I just stumbled across one article describing this: Using the Microsoft Diagnostics and Recovery Toolset (DaRT) for Incident Response.

. . . → Read More: Using the Microsoft Diagnostics and Recovery Toolset (DaRT) for Incident Response]]> A few years ago I posted on DaRT after having seen it: Microsoft Diagnostics and Recovery Toolset. It is a really good an interesting tool for a lot of problems, one of them being incident response. I just stumbled across one article describing this: Using the Microsoft Diagnostics and Recovery Toolset (DaRT) for Incident Response.

An overview over DaRT can be found here. To prelude rants and questions: DaRT is part of the Microsoft Desktop Optimization package and cannot be downloaded from our website

Roger

]]> http://www.halbheer.ch/security/2011/10/19/using-the-microsoft-diagnostics-and-recovery-toolset-dart-for-incident-response/feed/ 0 Windows Lifecycle and Support http://www.halbheer.ch/security/2011/06/21/windows-lifecycle-and-support/ http://www.halbheer.ch/security/2011/06/21/windows-lifecycle-and-support/#comments Tue, 21 Jun 2011 20:09:42 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/06/21/windows-lifecycle-and-support/ One of the things which surprises me often, when talking to customers is, that they do not know, when certain (key) products run out of support – and therefore no security updates will be shipped.

You should include the following dates in your plans:

Windows XP Home: Mainstream support ended 4/14/2009 Windows XP Professional: Extended . . . → Read More: Windows Lifecycle and Support]]> One of the things which surprises me often, when talking to customers is, that they do not know, when certain (key) products run out of support – and therefore no security updates will be shipped.

You should include the following dates in your plans:

  • Windows XP Home: Mainstream support ended 4/14/2009
  • Windows XP Professional: Extended support ends 4/8/2014 (if you did not yet plan to migrate to Windows 7, you should probably start)
  • Windows Vista Ultimate and Windows Vista Home: Mainstream support ends 4/10/2012
  • Windows Vista Enterprise: Extended support ends 4/11/2017
  • Windows NT Server 4.0: Support ended 12/31/2004 (I guess you know that)
  • Windows Server 2003, Enterprise Edition: Extended support ends 7/14/2015
  • Windows Server 2003 R2 Enterprise Edition: Extended support ends 7/14/2015

If you want to see the full lifecycle database, you will find it on our Lifecycle site.

This is the general policy:

Business and Developer products

Microsoft will offer a minimum of 10 years of support for Business and Developer products. Mainstream Support for Business and Developer products will be provided for 5 years or for 2 years after the successor product (N+1) is released, whichever is longer. Microsoft will also provide Extended Support for the 5 years following Mainstream support or for 2 years after the second successor product (N+2) is released, whichever is longer. Finally, most Business and Developer products will receive at least 10 years of online self-help support.

Consumer, Hardware, and Multimedia products

Microsoft will offer Mainstream Support for either a minimum of 5 years from the date of a product’s general availability, or for 2 years after the successor product (N+1) is released, whichever is longer. Extended Support is not offered for Consumer, Hardware, and Multimedia products. Products that release new versions annually, such as Microsoft Money, Microsoft Encarta, Microsoft Picture It!, and Microsoft Streets & Trips, will receive a minimum of 3 years of Mainstream Support from the product’s date of availability. Most products will also receive at least 8 years of online self-help support. Microsoft Xbox games are currently not included in the Support Lifecycle policy.

Roger

]]> http://www.halbheer.ch/security/2011/06/21/windows-lifecycle-and-support/feed/ 0 How Microsoft Uses File Classification Infrastructure http://www.halbheer.ch/security/2011/06/08/how-microsoft-uses-file-classification-infrastructure/ http://www.halbheer.ch/security/2011/06/08/how-microsoft-uses-file-classification-infrastructure/#comments Wed, 08 Jun 2011 07:51:01 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/06/08/how-microsoft-uses-file-classification-infrastructure/ Quite a while ago, I blogged about the File Classification Infrastructure in Windows Server 2008 R2:

File Classification Infrastructure in Windows Server 2008 R2 File Classification Infrastructure:More content

In my opinion, this is an interesting tool, built in to your server platform.

Now, we just published a paper about how we use this File Classification . . . → Read More: How Microsoft Uses File Classification Infrastructure]]> Quite a while ago, I blogged about the File Classification Infrastructure in Windows Server 2008 R2:

In my opinion, this is an interesting tool, built in to your server platform.

Now, we just published a paper about how we use this File Classification infrastructure to protect PII. This is an interesting read: Microsoft IT Uses File Classification Infrastructure to Help Secure Personally Identifiable Information

Here is the summary:

In today’s high-tech world, collecting and storing data are business-critical processes that form an integral component of daily operations. However, the ever-increasing dependency on and use of electronic data also make data management more challenging—especially in light of government regulations for the appropriate use and storage of personally identifiable information (PII) and financial information. Improper storage of PII can also be a significant financial concern, as the cost of storage-related security breaches can be hundreds of dollars per record.

Microsoft Information Technology (IT) had been using an internally built solution to help secure personally identifiable information (PII), financial information, and other types of sensitive data by classifying internal file shares and Microsoft® SharePoint® sites. However, this solution was limited to defining information sensitivity at a file-share level. It also required each user to specify the sensitivity level of his or her file shares manually, which frequently led to mislabeled information.

This custom, internally developed solution also had a high total cost of ownership, requiring a significant amount of development and maintenance resources to fix identified issues and keep the system up to date, as each upgrade to the storage operating systems required upgrading the code.

Microsoft IT needed a solution that would bring consistency to the file classification process across all teams, and be able to scan content automatically at the file level for key words, terms, and patterns. It then had to apply the correct rights management protection based upon predefined security policies. Cost of ownership and performance were also important drivers for developing a new solution. Microsoft IT needed a system built from off-the-shelf, standardized Microsoft technology, that could scale across terabytes of data. With such a large amount of information, the solution had to be efficient at scanning files while maintaining a high degree of accuracy when identifying sensitive PII.

Roger

]]> http://www.halbheer.ch/security/2011/06/08/how-microsoft-uses-file-classification-infrastructure/feed/ 0 A Security Comparison: Microsoft Office vs. Oracle Openoffice http://www.halbheer.ch/security/2011/04/19/a-security-comparison-microsoft-office-vs-oracle-openoffice/ http://www.halbheer.ch/security/2011/04/19/a-security-comparison-microsoft-office-vs-oracle-openoffice/#comments Tue, 19 Apr 2011 09:40:25 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/04/19/a-security-comparison-microsoft-office-vs-oracle-openoffice/ Actually, there is not much to say about this. It is a blog post by CanegieMellon called A Security Comparison: Microsoft Office vs. Oracle Openoffice and just does what it says. However, I do not particularly like the security comparison of products built solely on vulnerabilities as this shows only one side of the equation . . . → Read More: A Security Comparison: Microsoft Office vs. Oracle Openoffice]]> Actually, there is not much to say about this. It is a blog post by CanegieMellon called A Security Comparison: Microsoft Office vs. Oracle Openoffice and just does what it says. However, I do not particularly like the security comparison of products built solely on vulnerabilities as this shows only one side of the equation – an important one but only one.

For all the ones still claiming that Open Source software creates less vulnerabilities, here you find the some stats on Office:

Interesting, hmm….

Roger

]]> http://www.halbheer.ch/security/2011/04/19/a-security-comparison-microsoft-office-vs-oracle-openoffice/feed/ 2 Windows 7 and Windows Server 2008 R2 CC EAL4+ Certified http://www.halbheer.ch/security/2011/04/01/windows-7-and-windows-server-2008-r2-cc-eal4-certified/ http://www.halbheer.ch/security/2011/04/01/windows-7-and-windows-server-2008-r2-cc-eal4-certified/#comments Fri, 01 Apr 2011 19:12:08 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/04/01/windows-7-and-windows-server-2008-r2-cc-eal4-certified/ On March 24th, we got the certificate for the Common Criteria certification for Windows 7 and Windows Server 2008 on EAL 4+.

Here are the certified products: http://www.commoncriteriaportal.org/products/ and here you find the certificate.

A great job by the team – congratulations!

Roger

]]> On March 24th, we got the certificate for the Common Criteria certification for Windows 7 and Windows Server 2008 on EAL 4+.

Here are the certified products: http://www.commoncriteriaportal.org/products/ and here you find the certificate.

A great job by the team – congratulations!

Roger

]]> http://www.halbheer.ch/security/2011/04/01/windows-7-and-windows-server-2008-r2-cc-eal4-certified/feed/ 0 Internet Explorer 9, Release Candidate available http://www.halbheer.ch/security/2011/02/11/internet-explorer-9-release-candidate-available/ http://www.halbheer.ch/security/2011/02/11/internet-explorer-9-release-candidate-available/#comments Fri, 11 Feb 2011 02:46:35 +0000 Roger Halbheer http://www.halbheer.ch/security/2011/02/11/internet-explorer-9-release-candidate-available/ You might have seen it: IE9 RC is now ready for download. I am using IE9 since quite a while and it really, really rocks. Install it from here.

Roger

]]> You might have seen it: IE9 RC is now ready for download. I am using IE9 since quite a while and it really, really rocks. Install it from here.

Roger

]]> http://www.halbheer.ch/security/2011/02/11/internet-explorer-9-release-candidate-available/feed/ 0 Exciting News from the Consumer Electronics Show in Vegas http://www.halbheer.ch/security/2011/01/06/exciting-news-from-the-consumer-electronics-show-in-vegas/ http://www.halbheer.ch/security/2011/01/06/exciting-news-from-the-consumer-electronics-show-in-vegas/#comments Thu, 06 Jan 2011 12:05:58 +0000 Roger Halbheer http://www.halbheer.info/security/2011/01/06/exciting-news-from-the-consumer-electronics-show-in-vegas . . . → Read More: Exciting News from the Consumer Electronics Show in Vegas]]> After the launch of different products for the consumer, businesses and in the Cloud, Steve Ballmer opened CES today in Las Vegas. You should look at it. There are a few very cool announcements:

Or directly from the CES webpage.

Roger

]]> http://www.halbheer.ch/security/2011/01/06/exciting-news-from-the-consumer-electronics-show-in-vegas/feed/ 0