Expert Q&A: Windows 7 Security Issues

Microsoft already has a very large user base, so what is the most important security challenge when Microsoft is developing Windows 7?

The best technical protection measures Both require users to make informed decisions to protect themselves from malicious attackers and malware. UAC has been improved in Windows 7, reducing the amount of pop-up messages and helping to move the ecosystem to an environment where everyone can run as the default standard user. Other improvements include the new SmartScreen filter and Clickjacking defense technology, which are primarily deployed in IE8.

When developing a new version of Windows, is the malicious attacker and various attacks the main problem facing the new operating system?

Obviously, the motive and complexity of the malicious attacker is Great changes have taken place in the past few years, and our security researchers and others continue to work hard to understand the threats that exist and may arise in the future, which can help us better build protection mechanisms into new systems. Users do not get and run malicious code under unknown circumstances. In addition, we have been working hard to protect the internal protection mechanisms of Windows from tampering and evasion.

How has the security community reflected since the release of the Windows 7 operating system? Are you satisfied with the feedback? What have you learned from it?

So far, the security community’s response to Windows 7 is still Yes, although there are some problems with UAC and some of the changes we made, it also shows that we can listen carefully to everyone's opinions and eventually produce products that are satisfactory to everyone.

In terms of security protection, what is the fundamental difference between Windows 7 and Vista?

In fact, the Windows 7 operating system is built on top of Windows Vista and has been improved. Windows 7 also covers the Security Development Lifecycle, which is Vista's core security technology. In addition, other important security features from Vista, including User Account Control (UAC), Kernel Patch Protector, Windows Service Hardening, Address Space Layout Randomization (ASLR), and Data Execution Prevention (DEP), are also retained in Windows 7. . In addition, we have added new security features, such as AppLocker to help control applications running in the self-environment, we also enhanced the core BitLocker DriveEncryption capabilities, making it easier for IT organizations to deploy and manage this technology in their own environment. Wait. It can be said that Windows 7 combined with IE8 provides flexible security protection against malware and attacks.

How does the practicality issue affect Microsoft's decision-making in this regard?

Our goal for Windows 7 is to make it the safest operating system ever, when we developed the system Always thinking about how to combine advanced security with ease of use.

DirectAccess and BranchCache are functions that can help remote employees work. How do these two functions work? How to protect data?

DirectAccess is a breakthrough technology It enables employees to connect seamlessly and securely to their corporate network via the Internet. DirectAccess implements functionality by automatically establishing a two-way secure connection between the client computer and the corporate network, based on a reliable, standards-based technology such as Internet Protocol Security (IPsec), which is authenticated and encrypted. Protocols that help protect IP traffic, as well as Internet Protocol version 6 (IPv6), IPsec is used to authenticate computers and users, allowing IT to manage computers before users log in, and IT staff can require users to authenticate using smart cards. DirectAccess also uses IPsec to perform AES encryption on Internet communications.

BranchCache can help enhance the network's responsiveness to central applications while making remote access to corporate networks, making users feel like they are working on their own LAN. BranchCache can also help reduce the use of the WAN. When BranchCache is enabled, copies of data accessed from the internal network and file servers are cached in the local office. When another client on the same network requests the file, the client can Download from local without downloading the same content over the WAN. And this is done without reducing data security, and the access control cache file is executed in the same way as the original file.