According to Microsoft, it’s the most secure operating system the company has ever produced. Five years in the making, Windows Vista promises to lock down the desktop and usher in the era of “trustworthy computing,” in which PCs are more reliable, user experience is improved, and rampant malware is a thing of the past.

Just three months into the official commercial release of the OS, however, questions are flying. Anti-malware vendors, hackers, and security experts have raised doubts as to the efficacy of Microsoft’s new security measures, with one — blogger Joanna Rutkowska — going so far as to suggest that Vista’s security model might be merely "a big joke."

Microsoft is always an easy target, especially when it makes extravagant claims. The truth is that early testing suggests Vista is significantly more secure than previous versions of Windows.

That doesn’t mean that the new OS signals an end to Windows security headaches. Some of the pain for IT administrators will subside, but weak spots and their work-arounds should be top of mind as always.

Administrator no more
One of Windows Vista’s most lauded security enhancements is also one of the most criticized. UAC (User Account Control) aims to address a long-standing flaw in how Windows handles user permissions, but its detractors say it doesn’t offer enough protection and that inadequate design undermines its effectiveness.

At issue is the role of the administrator account. Best practices dictate that a user should be assigned administrator privilege only when performing tasks that require it, such as installing device drivers or changing the registry. But part of the legacy of DOS is that older versions of Windows were essentially single-user systems. Even on Windows XP, which was Microsoft’s first multiuser client OS, users would routinely log in as administrator by default, even for mundane tasks.

This practice made workstations easy to manage but was a security disaster. When a user is logged in as administrator, worms and Trojan horses have free rein to run amok. Worse, Microsoft’s inattention to user permissions encouraged ISVs to use sloppy, insecure programming practices that compounded the problem. Many Windows applications simply would not work unless they were allowed to run with full administrator privilege — that is, to run in the least secure way possible.

UAC attempts to correct these bad habits. Under UAC most software runs at reduced privilege by default. When an application attempts to do something that requires administrator privilege, UAC prompts the user with a dialog box asking for permission to “elevate” the application to the increased privilege level.