IE7 flaw a canary in the coalmine?

Stan Beer
Friday, 20 October 2006 11:17

Opinion and Analysis

Internet Explorer 7 is supposed to be one of the big ones for Microsoft, a catchup browser five years in the making. Aside from the catchup features, it was the tighter security that was always going to be the clincher for many users, particularly in the business world. However, the perception of a more secure browsing experience with IE7 is already under strain with the discovery of a flaw just hours after release.

It must be remembered that more than 80% of the global market has persevered with the now hopelessly out of date IE6. However, in more sophisticated user markets, such as Germany, other parts of Europe, North America and Australia, Firefox has made significant inroads. IE7 was designed to arrest the slide.

What may be a worry to many users is that the unpatched flaw in IE7 also exists in its predecessor IE6. How the flaw was able to get under the radar during the development lifecycle of IE7 is anybody's guess, however, what does this indicate about the enhanced security of Microsoft's other new generation software?

IE7 is after all small change compared to Windows Vista and Office 2007. Recent Patch Tuesdays have revealed flaws in beta and release candidate versions of Vista.

Microsoft has promised that Vista will take Windows security to a new level and reduce the incidence of vulnerabilities requiring patches. This is not the first time Microsoft has made such claims. A flaw discovered within hours of release in a relatively simple software development compared to an operating system could be the proverbial canary in the coalmine portending more serious days ahead on the security front.

If one were to be cynical, one could question the entry of Microsoft into the security space on the eve of the release of Vista in the first place. Playing devil's advocate, one could ask why an operating system vendor in the process of releasing a supposedly rock solid secure system would believe there's money to be made out of security products for that system.