So, in a year when Windows rootkits went mainstream and malware went criminal, what's to brag about?

Probably the most significant event was the lack of a global crisis -- you know, a Slammer- or Blaster-style worm that infects the world in eight minutes. There was no malware with a replication magnitude on the order of Code Red, Slammer, Nimda, or the Iloveyou virus. With the notable exception of PHP worms, even the Linux side had fewer popular viruses and worms this year.

This was also the year when patching got easier. Not only did more and more sophisticated patch management tools arrive from every sector, but there were fewer patches to deploy. 2005 is Microsoft's best year since the days of Windows 3.1, with fewer Windows patches compared with the past four years. And when Microsoft patches did come out, they came out on a single day each month, so IT teams everywhere could breathe a little easier the other 29 days of the month. More Linux distros got automated patching tools, and it seemed nearly every miscellaneous program had an auto-updating mechanism.

Administrators got better at blocking hackers and malware -- not yet perfect, but overall there was improvement. And it seems that end-users have finally got it: I actually know end-users who don't click on every file attachment they receive.

Security tools got better, too. IPSes are finally going inline real-time and beating the first generation issue of false-positives. Network access control and quarantining methods are becoming more commonplace, and even anti-virus software seems to getting more accurate.