Migrating to Security

Comment | Print | RSS

• Login to Rate

Since 1981, the MS-DOS/Windows ecosystem has been relatively open. Sure, Microsoft owns (and jealously guards) the core operating system, but it has always been pretty easy to write new software for MS-DOS and to build new systems around the hardware and software that make up the environment. It has become somewhat more challenging over the years (I remember when you could order an IBM PC with the BIOS listing and patch the BIOS yourself if you needed to do something truly special), but even the last decade has seen Windows occupying a point between the creative chaos of Linux and the tightly controlled realm of MacOS. With Windows 8, the spot that Windows occupies shifts considerably toward the "locked-down" end of the spectrum.

Enterprise IT managers are, in general, happy to see Windows 8 come with a much more restrictive view of the world. Applications for Windows 8 RT, for example, must come from the Windows 8 app store. No more random downloads of mobile applications for your users, for good or for ill. Even when you leave the mobile world for that of the desktop, you'll find that things are much less open than they once were.

Steven J. Vaughan-Nichols has looked at the issue of creating a system that dual-boots Windows 8 and Linux. He focuses on the heart of Windows 8 security -- Secure Boot -- and finds that it does precisely what it's supposed to do, making it impossible to load software that doesn't have all the appropriate certificates and approvals.

Now, it's easy enough to get around this by simply disabling Secure Boot entirely. Of course, doing this leaves your system insecure, and that really represents the basic issue that many IT departments are going to have with the idea of Windows and flexibility. For corporate IT departments, it's a relatively straightforward breakdown that will favor control. For education CIOs, it's considerably more complex.

The complexity of the issue in education arises partially around the grade level involved. It's very easy to say that systems for use by elementary and middle-school students should be highly restricted and kept in a locked-down state. When you get to high school, the question is somewhat more complicated (and highly dependent on the location of and subject matter taught on the system), and by the time you get to university, things get very, very complicated. For the latter group, computers in open-access labs can easily be kept locked down, but how do you deal with the systems that sit in faculty offices? How, to put a fine point on it, do you apply some sort of uniform rule over all the systems in your fleet?

One option, if you're in charge of an infrastructure that runs on Active Directory, is to disable Secure Boot and tie many of its features to permission levels set by AD roles for users and groups. It's something of a pain, but it combines flexibility and security in a system that makes sense. For those looking at Windows 8 RT (and RT Pro), though, the answer is going to be "it's locked" for some time to come. This is one of those situations that requires as much change to mindset as to infrastructure when it comes time to migrate. Now, it's time to prepare your user community for the change.