Most of you who have been playing around with Vista probably noticed all of the security prompts when performing admin tasks. I'll try to give an overview of the most important security enhancements in Windows Vista.
Internet Explorer Protected Mode
With Protected Mode, the IE process runs with a different user account with very little system privileges.(Check the processes list for an additional process called ieuser.exe) By running in this sandboxed mode, the IE process does not have sufficient rights to write to most parts of the file system. (eg. users profile) Protected Mode IE reads/writes to "low" versions of cache, located in :
Cache: %userprofile%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low
Temp: %userprofile%\AppData\Local\Temp\Low
Cookies:
%userprofile%\AppData\Roaming\Microsoft\Windows\Cookies\Low
History: %userprofile%\AppData\Local\Microsoft\Windows\History\Low
By default, protected mode is enabled for all security zones, excepted trusted sites.
Windows Firewall
The Windows firewall now has firewall rules for three fixed profiles: public (very secure), private (less secure) and domain. The domain profile is automatically configured when the workstation is added to a domain. For the other two profiles, windows will prompt you to select a profile whenever a new network is detected. This detection is done by the Network Access Protection client, which I'll talk about later. Whenever multiple networks are connected, the most restrictive firewall profile will be applied to the system. (support for multiple profile application will be added later)
Another new feature of the windows firewall is IPSEC integration. IPSEC policies are now configured with the windows firewall mmc snap-in. (or through gpo's of course, as is the rest of the firewall config)
The windows firewall now also supports outbound traffic control, which can limit installed applications to send traffic onto the network.
NAP (Network Access Protection)
NAP is actually nothing more than controlling network access based on the configuration of a network client. These checks can be done on, for example: antivirus software, sms client, patchlevel, ...
Vista has a built-in NAP client, which communicates with a NPS (Network Policy Server). NPS is actually the new version of the
RADIUS server in Longhorn.
If the client has a compliant configuration, a health certificate together with network access is granted.
After being granted network access, the nap client will continiously monitor client configuration, and deletes the health certificate if the config becomes uncompliant.
User Account Control
Probably one of the most important security enhancement in Vista is UAC. Because of UAC, even an administrator runs with regular user privileges. Each time an admin task is performed, elevation is required. This prevents unauthorized programs from running, which in the past would have run without the admin even noticing it.
Another feature of UAC is virtualization. File access by legacy applications which try to write user configuration to the windows or program files location is captured, and redirected to a virtual folder : %userprofile%\AppData\Local\VirtualStore. This virtualization is controlled by a file system filter driver (luafv.sys)
The same goes for registry access. User configuration written to HKLM is captured, and redirected to HKCU\Software\Classes\VirtualStore.
Good to know is that these virtualization locations are not included in a roaming profile.
Microsoft really put a lot of effort in securing its new OS. I didn't even talk about Bitlocker, Windows Defender, or the new authentication architecture which replaced GINA.
If you're interested, read more about it here: http://www.microsoft.com/technet/windowsvista/security/default.mspx.
