Biggest-ever Windows upgrade boosts security

REDMOND, Wash. -- Almost since the day Microsoft Corp. released its Windows XP computer operating system nearly three years ago, it has been a favorite target of hackers and critics eager to stress its numerous security shortcomings.

Now, more than two years after promising to do something about it, Microsoft is about to release the biggest update ever for Windows. The free upgrade is designed to make users safer from cyberattacks by sealing entries to viruses, better protecting personal data and fending off spyware.

Microsoft chairman Bill Gates said the upgrade, dubbed Service Pack 2, revises less than 5 percent of the millions of lines of code that make up Windows XP -- but adds more value than any update the company has ever done.

Some of the nearly $1 billion that's gone into Service Pack 2 also will be used on future versions of Windows. But Gates said it was absolutely necessary to give away the security advances now because of the barrage of attacks plaguing Windows-based computers.

"If we weren't viewing this as such a key priority, then we wouldn't be giving it away as a free thing," Gates said.

The long-awaited update is due to be completed "in the coming days," Microsoft senior product manager Matt Pilla said.

Service Pack 2 has been delayed as programmers have worked to make sure the new security safeguards would not keep people's favorite applications -- such as online games and music download services -- from working right. But such delays aren't unusual in the software industry, and especially with such a massive undertaking as this.

For regular users, the most noticeable change will be a series of new prompts users will see. The idea is that if users have to actively give permission for programs to interact with their computers, there is less chance they will be hit by a virus or inadvertently allow malicious software that can monitor computer activities.

It's always risky to ask loyal customers to suddenly do things differently, but Gates said the changes aren't major and are worth it.

"Believe me, a click -- the time it takes to click versus if you have a security problem, it's a dramatic benefit," he said.

Many security experts agree, arguing that the security changes are badly needed. Analyst Joe Wilcox of Jupiter Research likens the situation to the changes people might make when entering a bad neighborhood, which is what the Internet has become with rampant security attacks.

"Maybe you don't go there at night, you lock the doors in the car. You change your behavior, and that's what these things are going to do," he said.

But analysts have raised concerns that if the system is too confusing or causes too many other applications to fail, then users will simply turn it off.

That's one reason Microsoft delayed the system to improve its compatibility with consumer applications.

Among other changes, the new system automatically turns on a Windows firewall to better guard against attempts to infiltrate personal computers. It also creates a "Windows Security Center" to help users monitor their various security sentinels -- including those from other companies, such as antivirus protections.

Service Pack 2 also fortifies protections on the Internet Explorer browser and offers tougher policing against e-mail-borne attacks.

Most users will have to download about 80 megabytes of data for the upgrade. Because it's so big, users are being urged to turn on an automatic update function that will let Microsoft slowly download Service Pack 2 onto your computer with minimal disruption to normal computer activities. The company plans to increase phone support and offer Web-based help with the download.

Microsoft senior product manager Matt Pilla said virtually all Windows XP users will be able to download Service Pack 2, regardless of whether they have a legal or pirated copy of the operating system. Research firm IDC estimates that about 260 million copies have been sold.

Other companies, such as Symantec Corp. and McAfee Inc., already offer similar security protections, such as firewalls, plus more in-depth antivirus protection and other features.

Gates conceded that he's heard complaints that parts of the free update, such as its firewall, duplicate features others sell separately. Those companies now "need to move up to another level of innovation," he said.

John Pescatore, vice president of Internet security with Gartner Inc., said Service Pack 2 won't affect business sales of other companies' security programs but could hurt sales to consumers, who would be more reluctant to shell out extra money for something already bundled into the operating system.

Matthew Moynahan, vice president of consumer products at Symantec, said his company's Norton products already offer deeper protection than Service Pack 2. Symantec will continue to add features to deal with more sophisticated threats, such as "phishing" scams designed to get people to give out personal information like credit card numbers.

Bill Kerrigan, senior vice president of McAfee's consumer division, said Service Pack 2 might be a boon to his company's business because it will raise awareness of the overall need for security safeguards.

Gates said he expects Service Pack 2 will lead to fewer of the incremental security fixes Microsoft now regularly releases. If the improved system works right, it's the things that users won't notice that will matter most.

"It's funny in a way because it's the dog that doesn't bark. It's the problems that don't happen," Gates said.

But Gates has no illusions about the challenges ahead.

"The investments we're making in security are ongoing," Gates said, "because the bad guys -- who are criminals -- are always sort of raising up their style of attack."

------

On the Net:

http://www.microsoft.com/security