Here’s a partial list.
Is it worth the delay?
Is it fair to call each new version of Windows bloated and the same old same old with new eye candy before you consider some of these new features?
Has their new security focus started to pay off?
What’s your opinion?
1. ASLR (Address Space Layout Randomization)
A security feature that randomly arranges the positions of key data areas to prevent malicious hackers from predicting target addresses.
2. /GS, a compile-time option in Visual C++
Juggles around some of the function arguments and the function stack variable to make some classes of attack harder to pull off.
3. /SafeSEH
This is a linker option that writes the addresses of exception handlers to the PE header of the executable, and when an exception is raised, the OS checks the exception handler address against the list in the PE header, and if the address is not in the list, something corrupted the exception handler address so the OS kills the process.
4. Data Execution Protection
Prevents code execution from data pages such as the default heap, various stacks, and memory pools.
5. Function Pointer Obfuscation
Encodes numerous long-lived pointers and only un-encodes them when the pointer is needed.
6. User Account Control
Reduces the exposure and attack surface of the operating system by requiring that all users run in standard user mode and by limiting administrator-level access to authorized processes. UAC also makes user accounts with administrative privileges safer by limiting access to sensitive system resources and functions by default, and by prompting for approval when performing administrative tasks that require greater privileges.
7. Windows Service Hardening
“Restricted services” that run under the least possible privileges
8. Personal Firewall
Now includes both inbound and outbound filtering and on by default
9. NX technologies at the Hardware Level
Enables software to mark sections of the computer’s memory as exclusively for data, and the processor will prevent applications and services from executing any code there.
10. Kernel Patch Protection and Mandatory Driver Signing
64-bit software makes it possible to make significant enhancements to the security of the kernel, reducing the potential for rootkits and similar types of malicious software to negatively impact users’ systems.
11. PatchGuard
Prevents unauthorized software from modifying the Windows kernel.
12. Driver Signing for x64
Any driver that is not properly signed cannot enter the kernel space and will fail to load.
13. File System and Registry Virtualization
Redirects writes (and subsequent reads) from protected areas to a location inside the user’s profile.
14. Network Access Protection (NAP)
A network access control system that lets IT administrators ensure that only “healthy” machines connect to their network, while enabling potentially “unhealthy” machines to get clean before they gain access.
15. Improvements to Windows Security Center
Shows the status of third party anti-spyware software, Internet Explorer security settings and User Account Control in addition to current status of firewall, updates, and antivirus software.
16. Windows Defender
Helps protect against and remove spyware, adware, rootkits, bots, keystroke loggers, control utilities and some other forms of so-called “malware.”
17. Internet Explorer Protected Mode
Internet Explorer 7 runs with reduced permissions, so it cannot modify user or system files or settings without the user’s explicit permission and also helps protect against malicious downloads by restricting the ability to write to any local machine resources other than temporary Internet files.
18. URL Handling Protections
Defines a single function to process URL data.
19. ActiveX? Opt-In
Automatically disables all controls that a developer has not explicitly identified for use on the Internet.
20. Fix My Settings
Warns users with an Information Bar when current security settings might put them at risk. Clicking the Fix My Settings option in the Information Bar instantly resets Internet Explorer 7 security settings to the Medium-High default level.
21. Security Status Bar
Helps users quickly differentiate authentic Web sites from suspicious or malicious ones by enhancing access to digital certificate information that helps validate the trustworthiness of e-commerce Web sites.
22. Microsoft Phishing Filter
Works by analyzing Web site content for known characteristics of phishing techniques, and by using a global network of data sources to assess whether a Web site should be trusted.
23. BitLocker Drive Encryption
Prevents unauthorized users from accessing data by breaking Windows file and system protections or attempting the offline viewing of information on the secured drive.
24. Integrated Rights Management Services Client
Helps protect the security and integrity of sensitive information by making documents accessible only to authorized users, and by enforcing specific policies around forwarding, printing and sharing by those users.
25. Encrypting File System Enhancements
Enables users to protect their data from unauthorized access by other users, as well as by external attackers. Supports storing user keys as well as administrative recovery keys on smart cards, can be used to encrypt the system page file, and tighter manageability features with Longhorn Server.
26. USB Device Control
Enables IT administrators to use Group Policy to manage or block the installation of unsupported or unauthorized devices.
