Windows Security wrap-up: praise for Vista and a historic first
Summary: At last week's Black Hat conference, a security expert who spent time “beating up Vista” talks about Microsoft's approach to security. Microsoft falls off a top 10 list. And you should visit Windows Update now to get a new Critical update for IE.
Context & Ripple Effects
The security story of Vista has come full circle. In 2006 Microsoft billed it as its most secure operating system ever, a claim that met skepticism through 2007 — when analysts argued raw flaw counts fell short of the true picture and Computerworld asked whether the security focus had actually paid off. Now an expert who spent years attacking Vista is praising Microsoft's security approach at Black Hat, an endorsement from the adversary side that marketing could never buy.
The other two items round out the picture: Microsoft has dropped off a top-ten vulnerability list for the first time, and a new Critical Internet Explorer fix is live on Windows Update — echoing the out-of-band IE patching practice Microsoft formalized in 2010.
First-order effects
- Windows and IE users have an immediate action item: a Critical-rated IE update is available now through Windows Update and should be installed without waiting for the regular Patch Tuesday cycle.
- Microsoft gains a credibility asset no press release can match — a Black Hat researcher known for breaking Vista publicly crediting the company's security engineering.
Second-order effects
- Rival OS vendors lose their easiest marketing wedge; with Microsoft absent from top-ten vulnerability lists, competitors must argue on features rather than on Windows' old insecurity record.
- Third-party vulnerability rankings gain weight as de facto scoreboards, since vendors will now tout absence from those lists the way they once touted internal flaw-count reductions.
Third-order effects
- If the pattern holds, the industry shifts from vendors self-certifying security ('most secure ever') toward external validation by researchers and ranking bodies becoming the accepted proof point — the standard Vista-era claims were held against.
The trend: Microsoft's Vista-generation security investment is maturing into externally validated credibility, shifting OS security competition from marketing claims to researcher-attested track records.