• PC World
• Business Center
• Business Center
• Root
• News

Windows Vista's revamped security features are posing difficulties for some IT security vendors looking to make their software work on the new operating system.

Although leading security vendors such as Symantec Corp., McAfee Inc. and Trend Micro Inc. have released updates or patches to make some or all of their products Vista-compatible, many others remain deeply entrenched in testing Vista versions of their tools.

Despite numerous complaints from gamers about poor performance on Vista, most applications written for Windows XP run on the new client OS out of the box, with only a few major exceptions, according to Brett Waldman, an analyst at Framingham, Mass.-based IDC.

But not so for security software. Many of the biggest changes made by Microsoft as part of Vista are in areas such as installation and security, including the operating system's user account control, resource protection and protected-mode features. Those changes are more likely to inhibit or cripple security software brought over to Vista than other types of applications.

"It's like they've changed all of the plumbing to make Vista more secure," said Scott Matsumoto, principal architect at Dulles, Va.-based software consultancy Cigital Inc.

Moreover, Microsoft acknowledges that available workarounds -- such as Vista's compatibility mode, which emulates XP and other older versions of Windows so users can run non-Vista-ready applications -- don't work well with software that interacts deeply with the operating system, as antivirus tools and other security programs do.

Further complicating the situation was a tussle last fall over a new security management console for Vista that security vendors complained would affect the performance of their products. Microsoft eventually agreed to release application programming interfaces that enable other vendors to disable the built-in console.

In addition, security vendors say that porting their products to a new operating system is inherently more time-consuming than moving over other applications is.

"You have to be more careful than with a productivity app," said John Dasher, director of product management at encryption tools vendor PGP Corp. "If something goes awry, people can lose data."

Palo Alto, Calif.-based PGP is blocking its users from even installing non-Vista-ready versions of its software on the new OS. The company released a Vista-compatible beta of its PGP Desktop 9.6 software two weeks ago, but Dasher declined to predict when the final version would be ready.

All of the factors facing security vendors are adding up to more development work for companies such as Check Point Software Technologies Ltd., maker of the popular ZoneAlarm firewall.

"Because Vista is such a major overhaul to the Windows operating system, Check Point is busy in development efforts to ensure that new Vista-compatible versions of ZoneAlarm will live up to high standards of protection," said a spokeswoman for the company, which is based in Ramat Gan, Israel, and has its U.S. headquarters in Redwood City, Calif.

Check Point expects to release a Vista-compatible update in a few months, the spokeswoman said. But, she added, some of the features in the new version may differ from Check Point's current release "due to the different needs and functionality" in Vista.

F-Secure Corp. expects to release a Vista version of its flagship Anti-Virus 2007 software in May. Par Andler, a spokesman at Helsinki, Finland-based F-Secure, said the product is arriving later than Vista itself did because the company wants to make sure it gets enough customer feedback on a beta version of the antivirus tool.

"As the volume of Vista installations worldwide has been very low so far, it has been difficult for any vendor to ensure a high enough volume of external technology-review testers," Andler said. He added that F-Secure thinks it can complete a sufficient level of testing during the spring.

Even top vendors like Symantec are admitting to some difficulties. Symantec has ported its most popular products, including Norton AntiVirus and Norton Internet Security, to Vista. On Tuesday, the company also released a new bundle called Norton 360 that combines its security and data backup tools and runs on both Vista and Windows XP.

But it still has about 10 products that remain unready for use with Vista, including its Norton SystemWorks and Personal Firewall tools.

"We intend to have our entire list logo-certified" for Vista, said Lily De Los Rios, vice president of product delivery at Symantec, although she wouldn't specify when she expects to achieve that. She added that some of Symantec's products haven't been adapted or certified for Vista yet because the certification requirements "are relatively new, and the interpretation still can be somewhat unclear."

Perhaps the most Vista-compliant security vendor at this point is Trend Micro. The latest versions of its AntiVirus, Client Server Security Agent and PC-cillin Internet Security products not only work on Vista but have been certified as such by Microsoft. No other leading security vendor has received Microsoft's "Certified for Windows Vista" designation for any products thus far.

Security products that have been awarded the lesser "Works with Windows Vista" designation include Absolute Software Corp.'s Computrace laptop recovery tool, Avast Antivirus from Alwil Software A/S and Radialpoint Inc.'s Security Services, Security Cleanup and Servicepoint Agent technologies.

Gregg Keizer contributed to this story.

For more enterprise computing news, visit Computerworld. Story copyright © 2007 Computerworld Inc. All rights reserved.