Mixed Reviews On Windows Server 2003 Security

Microsoft has touted the security of the new software, which ships with more than 20 services off by default and includes other protective functions. Security has been Microsoft's mantra since it launched its Trustworthy Computing initiative nearly 18 months ago.

Phil Cox, consultant at SystemExperts, a network security consulting firm based in Sudbury, Mass., said Microsoft is headed in the right direction with Windows Server 2003 when it comes to security, especially compared with Windows NT and Windows 2000.

"Windows Server 2003 is more secure out of the box. It's got more functionality to make the system more secure," said Cox, who co-wrote a handbook on Windows 2000 security. "It's the best so far, but is it perfect? No. But they're on the right track."

For example, the software has more templates for automating security functions that administrators previously had built on their own, he said.

Also, Microsoft proactively released a security guide for Windows Server 2003; however, it distributed the guide online in a way that was vulnerable to attacks, he added.

Cox said the software has a new set of functionality in terms of new services such as .Net that could open the door to problems down the road. Web services and the .Net framework are not yet well understood by users and could be improperly configured from a security standpoint, he said.

Rex Frank, CTO of Alvaka Networks, a solution provider based in Huntington Beach, Calif., said the newness of the operating system might protect it, at least for now.

"Any new OS is inherently more secure in the short run simply because the hacker community has not had time to discover new vulnerabilities-- yet," he said. "It will also be some time before the installed base has the critical mass to support a fast-moving widespread worm."

"On the other hand, I could argue that new features translate to new potential vulnerabilities," Frank added.

He said the best advice he could offer now is for users to upgrade if there's a feature they need in the new software, pay attention to permissions and stop all unused services.