jump to navigation

The Ones That Didn’t Make It: Windows’ Failed Rivals March 2, 2012

Posted by John Ruby in Archives, Microsoft, Platforms & EcoSystems, Windows.
add a comment

 

A quarter century ago, a new package called Windows faced some pretty daunting competition.

By Harry McCracken  |  Monday, November 22, 2010 at 5:37 am

Microsoft shipped Windows 1.0 on November 20th, 1985. Twenty-five years and two days later, it’s not just hard to remember an era in which Windows wasn’t everywhere–it’s also easy to forget that it wasn’t a given that it would catch on, period.

The company had announced the software in November of 1983, before most PC users had ever seen a graphical user interface or touched the input device known as a mouse. But by the time Windows finally shipped two years later, after a series of embarrassing delays, it had seemingly blown whatever first-mover advantage it might have had. At least four other major DOS add-ons that let users run multiple programs in “windows” had already arrived.

Read More…The Ones That Didn’t Make It: Windows’ Failed Rivals

Advertisements

Windows NT Security Systems March 2, 2012

Posted by John Ruby in Archives, Security, Technologies.
Tags: , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , , ,
add a comment

Windows NT Security Systems

The starting point for strong Internet security is the operating system of any machine connected to it. Fortunately for the organizations using IIS 4.0, strong levels of security were built into the core of Windows NT in order to meet and exceed certifiable security standards, i.e. the C2 security guidelines required by the U.S. Department of Defense’s evaluation criteria. Windows NT security contrasts sharply with the thin and weak security layers that are bolted on to the top of some other operating systems.

Compliance with the C2 security standard was originally only required for government organizations. However, many commercial organizations are demanding the same level of security, and they recognize the value that such standards offer. The main requirements for C2 compliance are:

  • User identification and authentication. Before gaining access to the systems, a user must prove their identity. This is typically done by providing a user-id / password combination, for example by entering the details via a keyboard or by the presentation of a device such as a smart card which stores such information.
  • Discretionary access control. Each object within the system, for example files, printers and processes, must have an owner—who can grant or restrict access to the resources at various degrees of granularity.
  • Auditing Capabilities. The system must provide the ability to log all user actions and object access, and include enough information to identify the user that performed any operation. Such information must only be accessible by system administrators.
  • Safe Object reuse. The system must guarantee that any discarded or deleted object cannot be accessed, either accidentally or deliberately, by other entities.
  • System integrity. The system must protect resources belonging to one entity, from being interfered with by another entity.

The C2 guidelines are applicable to standalone systems, and are specified in the document Trusted Computer System Evaluation Criteria (TCSEC). Fortunately, to make life simpler, this is often referred to as the Orange Book, thanks to the color of its cover. Other specifications that expand on the Orange Book include the Red Book for networking, and the Blue Book for subsystems.

Obtaining C2 certification is a long and complex task, and Microsoft are pushing hard for complete certification. Windows NT has passed the Orange Book certification process (for a standalone PC, not connected to a network) and is on the DOD’s official list of evaluated products. At the time of writing, Windows NT 4.0 is undergoing Red and Blue book evaluations.

Read More…Windows NT Security Systems