Security expert: Microsoft should cut IE's links to Windows

Update IE separately, and often, like Firefox and Chrome.

Microsoft would better protect users by severing Internet Explorer's connections to Windows, then patching the browser invisibly in the background -- daily if necessary, a security expert argued Tuesday.

"The browser is the heaviest-used application that interacts with the Internet, and the most likely source of malicious content. IE vulnerabilities should be given the highest priority and patched first," said Wolfgang Kandek, CTO at security company Qualys.

But that's not what happens in the real world, he said. "Unfortunately, the vulnerability data that we collect shows that companies treat browser patches just like all other patches. IE's patch deployment cycle correlates very closely with other critical patches."

According to data Qualys collected from scans of several hundred thousand Windows PCs owned by its customers, the patching pace for IE vulnerabilities was essentially the same as the rate at which users fixed other non-IE critical flaws.

To pick up that pace, Kandek suggested that Microsoft sever Windows' links to IE completely, then boost IE's update frequency and take some, or all, of the control out of users' hands. "There's just too much user interaction required by Microsoft for IE," he said, referring to the way Microsoft updates its software, IE included, using services such as Windows Update.

"If Microsoft removed IE from Windows and made it independently updatable, I think you'd get improved update performance," said Kandek.

Although pulling IE from Windows would mean that Microsoft would have to come up with a different mechanism for Windows Update -- currently the service relies on IE -- Kandek believes the benefit to users would be significant. "Taking IE out of the [monthly] patch cycle would give us better protection," he said.

Rather than patching IE only once a month, as it does now, Kandek would like to see Microsoft pick up the pace by rolling out fixes as soon as they're ready, in effect mimicking the update process that Mozilla Corp. uses for Firefox, or the even less intrusive approach that Google applies to its Chrome browser.

Firefox users receive a notice when security updates are available, and can click through to download and install the patches. Chrome users, meanwhile, do nothing: Google pushes patches to its browser automatically, and they're installed with no user action required. Either method would be preferable to Microsoft's current update strategy for IE, Kandek said.

That applies for all IE users, including those working for companies where IE is mandatory, and patch deployment can be delayed by testing, or for fear of disrupting workflow. "I think that you should just determine for the corporation to trust Microsoft and their quality control" on the patches, Kandek said. "Browser patches are heavily tested by Microsoft, and unlikely to break any existing functionality on the desktop."

Microsoft could conceivably split IE from Windows with its newest browser, Internet Explorer 8, which reached "release candidate" status late last month. "IE8 would be a good opportunity," said Kandek.

Ironically, he may get his wish if the European Union has its way. The Competition Commission, the EU's antitrust agency, recently hit Microsoft with a new set of charges, this time concerning IE. On Jan. 15, the Commission said that by tying IE to Windows, Microsoft "distorts competition" in browsers and gives IE "an artificial distribution advantage" over rivals like Firefox, Apple's Safari and Opera Software ASA's Opera.

"If the [Commission's] preliminary views were confirmed, the Commission would consider ordering Microsoft to give users an objective opportunity to choose which competing Web browser(s) instead of, or in addition to, Internet Explorer they wanted to install in Windows, and which one they wanted to have as default," said EU spokesman Jonathan Todd in an e-mail. "Microsoft could also be ordered to technically allow the user to disable Internet Explorer code should the user choose to install a competing browser."

Although IE's market share has been steadily shrinking -- under assault from Firefox, first of all, Safari second -- it accounted for about68% of all browsers used last month, according to Internet metrics vendor Net Applications.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Internet Explorer

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Gregg Keizer

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?