Bye Bye Microsoft

In 2004-5 Microsoft avoided a disaster by ramping up it’s security efforts. Thanks to the continuous public vulnerabilities in their Windows OS, Internet Explorer, IIS, and Word it was becoming extremely expensive to maintain a Windows environment, especially for the SMB. Microsoft went on a hiring binge of security experts, trained all of their developers in secure coding practices and introduced a new set of desktop protections. But did Microsoft succeed in making their products a safe choice for SMB?

Analysis

It is almost impossible for the SMB to use Windows products and not have to fight continuous infections and even rebuild/re-image machines on a regular basis. Just in the past few weeks there have been major vulnerabilities discovered that forced Microsoft to issue fix-it tools in advance of official patches. The latest shortcut vulnerability is particularly onerous. It led Siemens to announce they had discovered a USB delivered attack that targeted manufacturers using SCADA networks. The fix turns the familiar shortcut icons on your desktop into blank images. At what point does the cost of this additional maintenance exceed the switching costs to move to another platform? And on top of the operational costs there is the unquantifiable cost of a data breach. I believe that that point has finally arrived.

Yes, MAC OS and Linux based desktop environments such as Ubuntu have their security issues. But they are not continuously targeted by every cyber criminal and scam artist in the world. There are sometimes 50,000 new forms of malware for Windows released in a day. The other platforms? You can count the malware of concern on one hand.

What would it take for the typical small business to migrate off of Windows? Here is the short list. Let me know if you have experience with these or other options:

Office productivity. How to get away from using Word, Excel, PowerPoint, etc? the most straightforward migration is to OpenOffice, supported by Sun (now Oracle). It is easy to install and easy to get used to. Google Apps are another alternative but it is yet unclear if Google’s treatment of your data is always going to be secure.

Email. This is the hard one. Most SMBs are married to Exchange and Outlook. The same functionality can be had from myriad products, many open source, such as Mozilla Thunderbird. And free SMTP servers predate Microsoft’s products. Of course Gmail, and Yahoo! email are cheap alternatives that many SMBs already use.

Where are your applications? There are Linux based versions of just about any application you need to conduct business. Have you developed your own Windows based apps? Time to consider migrating those too.

Conclusion

Have you noticed that most of the security practitioners you meet or work with have already switched to Apple? I have resisted doing so all these years because it seemed like giving up the battle. Without knowing firsthand the issues my clients had to deal with how could I speak to those problems? Recently IT-Harvest’s office computers all became infected with a zero day Trojan. None of the five security suites they tried c eradicate the infection. There network defences block the beaconing back to servers in Russia and China but the radical cleansing process with multiple anti-malware products has disabled sound card drivers, WiFi connectivity, and system performance. Rather than rebuild or make the switch to Windows 7 IT-Harvest is going to move to Ubuntu. We will report on the experience on Focus.com. If you have war stories to tell on your own Windows nightmares and your transition efforts please chime in.

Disclosures and References

Greg Keizer, Microsoft issues tool to repel Windows shortcut attacks