News

Microsoft and DOD Defining Windows 7 Security

• By William Jackson
• 06/29/2009

As users await the release of the next version of the Windows operating system, Microsoft is working with the government to establish secure system settings that are expected to become the Federal Desktop Core Configuration (FDCC) for Windows 7.

Earlier this month, Microsoft released the alpha version of its security guide for the new operating system. At the same time, it is working with the Defense Department to harmonize the setting with the FDCC. Ideally, the two components will constitute a single standard for secure configuration when Microsoft releases the operating system this fall.

"We have the opportunity this time around to bring together several groups with similar interests to reach a consensus that will serve the common good," said Ken Page, a program manager at Microsoft.

The FDCC grew out of the Air Force IT Commodity Council's efforts in 2006 to develop a standard software configuration for Microsoft operating systems. Despite officials' concerns about the practicality of applying a single software configuration in a broad enterprise with thousands of users, the program succeeded in cutting costs, improving security and reducing the time needed to update security patches enterprisewide.

In 2007, the Office of Management and Budget adopted the settings for Windows XP and Vista as the FDCC and required their implementation in 2008.

"Our hats are off to the Air Force for getting us started," Page said. "We're getting a much earlier start on it for Windows 7."

It is not the first time the government has worked with Microsoft before the release of an operating system, said Steve Quinn, a senior computer scientist at the National Institute of Standards and Technology (NIST). The National Security Agency, the Defense Information Systems Agency and NIST worked with the company on configurations during the pre-release stage of Vista.

"A lot of the recommended security settings were baked into the system before it shipped," Quinn said.

However, at that time, the configuration settings were not codified as the FDCC. The OMB initiative came later and capitalized on work that had already been done.

"That was OMB lending their authority to the configuration settings," Quinn said.

Microsoft's security guide specifies two security configurations for its operating systems: a standard enterprise configuration and the secure limited functionality recommended for organizations with higher security needs. The government's FDCC for XP and Vista does not correspond exactly to Microsoft's security guides, but officials hope the settings for Windows 7 will be harmonized into a single industry/government standard.

The increased functionality and flexibility of the new operating system offer more choices for users and administrators, which means that more recommendations are required for establishing appropriate security levels. The process of developing standard configurations for Windows 7 is eased somewhat by the fact that the existing 650 FDCC settings for Vista will apply to the new release. Page could not say how many additional settings would be required for Windows 7.

NIST has outlined the process for creating security configuration checklists in its National Checklist Program (NCP). Quinn said DOD and Microsoft will perform the primary work of writing the configuration for Windows 7, but the goal will be a governmentwide standard applicable beyond just defense and national security systems. When completed, NIST will check the configuration against the NCP for appropriateness and evaluate it.

"We'll give it that value-added scrub," Quinn said.

A subcommittee of the CIO Council manages the FDCC. Agencies can check compliance with the configuration using the Security Content Automation Protocol for checking and validating security settings on IT systems. SCAP is a NIST specification for expressing security data that can enumerate configuration issues. Vendors have begun incorporating SCAP into tools for scanning software settings.