Comparison of Windows Vista and Windows XP - Security

Security

Security was a top priority during Windows Vista development. In Windows XP, every user is set up as an administrator by default (unless added through Computer Management). As a result, most home users ran all their software with Administrator access. However, this left most users unwittingly open to potential security threats, such as hacking and malware downloads. A large amount of existing software doesn’t run well as a standard user, due to developers not implementing the principle of least privilege in their design and testing. For example, many poorly written applications often assume incorrectly that they will have read and write access to the entire filesystem and system Registry. Denying such an application access to any of these assumed rights can cause the application to fail. Sometimes, a person logged on as a standard user under Windows XP can't perform user-specific tasks such as changing the system clock and calendar, changing the computer's time zone, or changing the computer's power management settings due to so-called "LUA bugs". User Account Control in Windows Vista improves this by limiting application software to standard user privileges until an administrator authorizes an increase in privilege level. In this way, UAC prevents users from making inadvertent changes to system settings and locks down the computer to prevent unauthorized applications from installing or performing malicious actions. Windows Vista is able to work around many LUA bugs in third party applications with its file and Registry virtualisation feature, as well as application compatibility shims. Internet Explorer 7's Protected Mode utilizes User Account Control to isolate IE from other applications and prevent it from writing content to any location, except the Temporary Internet Files folder. Internet Explorer 7 is available for XP, but does not support Protected Mode on XP. Windows Vista also includes Windows Defender, a spyware scanning and removal tool that is also available for Windows XP for free. Enterprise and Ultimate editions of Windows Vista include BitLocker Drive Encryption, which aims to help protect data in the case of stolen devices.

Vista implements address space layout randomization, that makes it considerably more difficult for malicious code to exploit Return-to-libc attacks than on previous versions of Windows, particularly on 64-bit systems. Furthermore, Vista implements heap management enhancements that make it much more difficult to carry out buffer overflow attacks.

64-bit editions of Windows Vista require all kernel-mode drivers to be digitally signed, initially making it difficult for rootkits to install until Alureon managed to overcome this obstacle in 2010 by subverting the master boot record.

The firewall in Vista has been rewritten, allowing both outbound as well as inbound traffic to be blocked.