Microsoft pans Chrome, Firefox security
- 12 October, 2011 05:00
Microsoft today launched a website that cranks out security scores for the various editions of its own Internet Explorer (IE) as well as browsers built by rivals Google and Mozilla.
The new site -- yourbrowsermatters.org -- runs a browser through a security feature checklist, then posts a score out of a possible high of four points.
Not surprisingly, Internet Explorer 9 (IE9) comes out on top with a perfect score of 4 out of 4. The older IE8, which debuted in 2009, garnered a 3.
Google's Chrome 14 -- the current "stable" build that launched last month -- kicked back a second-place score of 2.5 out of 4.
Another month-old browser, Mozilla's Firefox 7, generated a ranking of just 2.
And Opera Software's Opera and Apple's Safari -- the two remaining browsers of the top five -- weren't even competitive enough in Microsoft's eyes to warrant a score. Both simply displayed the message "We can't give you a score for your browser."
The new site and its scoring exam are meant to illustrate the insecurity of older browsers, said Microsoft -- its decade-old IE6, an application Microsoft has not been shy about wanting to kill, scored 0 out of a possible 4 -- as well as the prevalence of Web-based threats that try to trick users into making poor decisions.
"Browsers that provide better protection against the most common threats -- such as socially engineered malware -- will receive a higher score," said Roger Capriotti, Microsoft's chief IE marketing executive, in a Tuesday blog.
Microsoft has touted the malware-blocking abilities of IE8 and the newer IE9 for some time, regularly citing studies done by NSS Labs -- some paid for by Microsoft, some not -- that recently announced IE9 stymied 99.2% of all malicious links and Web-hosted malware it faced.
Capriotti also referenced Microsoft's latest Security Intelligence Report, which downplayed the threat posed by "zero-day" vulnerabilities in lieu of their small part in the overall threat theater.
"The biggest threats stem from clever 'socially engineered' malware targeting outdated software, such as older Web browsers," said Capriotti.
Microsoft's two-year-old IE8 scored better on the company's security test than newer browsers from either Google or Mozilla.
According to Microsoft, the company worked up the scoring methodology -- which it published in full on its site ( download PDF ) -- in conjunction with unnamed security researchers and several organizations, including the Anti-Phishing Working Group (APWG), Identity Theft Council and Online Trust Alliance.
Microsoft is a premium member of APWG and on the steering committee of Online Trust Alliance.
Both Capriotti in his blog and Microsoft in the description of the site's scoring methodology anticipated disagreement about the test. "Security scores like this are often the subject of much scrutiny, and there is certainly no single test that can perfectly summarize all aspects of browser security," said Capriotti.
The company went further in its methodology document. "If you still consider the security score to be arbitrary, we encourage you to design one better," said Microsoft.
Google and Mozilla did not immediately reply to requests for comment on Microsoft's test and their browsers' scores.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org .
Read more about browsers in Computerworld's Browsers Topic Center.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
- Your Browser Matters
- Google patches 32 Chrome bugs, revs browser to v.14 - Computerworld
- Chrome improves anti-malware blocking score by 340% - Computerworld
- Zero-day bugs overrated, Microsoft says - Computerworld
- download PDF
- Gregg Keizer - Google+
- Computerworld Gregg Keizer News
- Articles by Gregg Keizer - Computerworld
- Browsers Topic Center - Computerworld
Why change management doesn’t work
Larry Page wants to see your medical records
Dual-Persona Smartphones Not a BYOD Panacea
After two-year hiatus, EFF accepts bitcoin donations again
CIOs struggle to deliver timely mobile business apps: survey
Agentless Security for Virtual Environments
Virtualised datacentres, desktops, and cloud computing should be secured by the same strong protection technologies as physical machines. However, traditional agent-based solutions that are not architected for virtualisation can result in a number of significant operational security issues. Find out more about the first agentless security platform solution.
Benefits of Deploying Microsoft Exchange Server 2010 on Dell Compellent with Data Progression
Messaging and collaboration platforms have emerged as mission critical applications, consuming a large portion of IT spending for organisations. The rich features in these applications have significantly changed the messaging requirements and needs of today’s information from anywhere with any device, the result is an ever increasing demand on storage systems both in terms of capacity and bandwidth. Many organisations are rethinking their storage strategies to meet the demanding criteria and to handle the future requirements. Read more.
Spear-Phishing Email: Most Favored APT Attack Bait
This research paper presents findings on APT-related spear phishing from February to September 2012. We analysed APT-related spear-phishing emails collected throughout this period to understand and mitigate attacks. The information we gathered not only allowed us to obtain specific details on spear phishing but also on targeted attacks. We found, for instance, that 91% of targeted attacks involve spear-phishing emails, reinforcing the belief that spear phishing is a primary means by which APT attackers infiltrate target networks.