Microsoft touts Vista security features

25.05.2006
New encryption and policy control functions being built into Microsoft Corp.'s Vista operating system will help make it easier for enterprises to protect against data compromises such as the one involving the Department of Veterans Affairs publicized earlier this week, a company executive said Wednesday.

The V.A. on Monday said that the names, Social Security numbers and birth dates of more than 26 million veterans discharged since 1975 had been compromised when a computer containing the information was stolen from the home of a data analyst.

Vista technologies such as BitLocker and Group Policy Console will improve the ability of companies to protect against these kind of compromises, said Mike Chan, a senior technical product manager for Microsoft's Vista team who delivered a keynote at the Microsoft Security Summit here this week.

Vista's BitLocker, for instance, will allow companies to encrypt all of the data on their hard drivers using 1024-bit encryption, Chan said. The key used for encrypting the data is not stored on the hard drive but on a separate Trusted Platform Module microchip mounted on the motherboard, allowing for full encryption of the hard drive. The goal is to give companies a way to protect sensitive data from compromise even when a computer or hard drive is lost or stolen, he said.

Vista's support for data encryption is useful, but a lot depends on the key management and key recovery capabilities it offers, said Lloyd Hession, chief security officer at BT Radianz, a telecommunications company for financial companies based in New York.

"Encryption at the OS level is a good thing," Hession said. But the big problem with encryption in general has been the issue of data recovery in the event of hardware failure or key loss, he said. It's one of the reasons why few companies encrypt data at the desktop level despite the many benefits. As a result, Microsoft needs to make its encryption capabilities easy to use for it to make a difference among enterprise users, he said.