Microsoft Security Essentials good but not enough to shake up rivals

According to Microsoft, the application (formerly called Morro) will only work on PCs running "genuine" copies of the Windows operating system viz. XP, Vista and the forthcoming Windows 7 that have been verified by Microsoft. In other words, MSE will run Microsoft's Windows Genuine Advantage tool before installation to check the PC user's copy of Windows is not counterfeit.

"By making Microsoft Security Essentials easy to get and easy to use, Microsoft hopes to encourage broader adoption of anti-virus protection across the consumer audience, which in turn will help increase security across the entire Windows ecosystem," the company said in a statement.

According to Cliff Evans, head of security and privacy at Microsoft, at least 50 percent of PC users do not have up-to-date anti-virus softwares installed in their computers and MSE is intended to help close that gap. "There are not enough people taking up anti-malware subscriptions," Evans said. "We want to make sure that across the world enough people have access to something."

MSE, however, will not be bundled with Windows as of now and Microsoft has left it up to PC manufacturers whether they wanted to install MSE on their machines. "It's not being included as part of the operating system or as an automatic update," Evans said. "There are not enough people taking up anti-malware subscription. We want to make sure that across the world enough people have access to something."

MSE, which is available in full version as a free download on the Microsoft homepage, does not require registration or subscription unlike others. However, PC users will still need to install a firewall, and ensure their operating system is patched with the latest software updates.

"The combination of Windows Firewall and Security Essentials provides you with pretty complete coverage," said Bob Muglia, the president of Microsoft's server and tools division.

MSE also replaces Windows Defender, which currently come bundled with Windows Vista, deactivating it on installation.

Also, though MSE is designed to co-exist with third-party personal firewalls it will not do so with other anti-malware scanners, a limitation common to other anti-virus apps.

The latest offering is Microsoft's second attempt to launch a security suite for its Windows operating system. Earlier, Microsoft launched Windows Live OneCare, which was a paid-for service, but it failed to poach on users of established security and anti-virus brands and was cancelled in June.

A beta version of MSE was released by Microsoft in the same month for users in the US, China, Brazil and Israel, but with demand far exceeding plans for limited trials, Microsoft shut off downloads after less than a day.

Though MSE does not include the non-security features, such as automated PC tuneups, provided by its subscription-based predecessor, Microsoft's Evans said it uses the same engine as Live OneCare and is, in fact, "better, in the sense that it's a later iteration of that engine." Microsoft said it would honour any outstanding subscriptions to the discontinued software.

According to Evans, MSE uses a higher amount of heuristic detection techniques than Live OneCare i.e. the software studies the behaviour of suspicious applications and then reports back to a central server to check the behaviour against that of known malware.

MSE, which has achieved good results in independent tests from organisations such as AV Comparatives and West Coast Labs, also "compares favourably" with commercial security suites, Microsoft said.

Unlike commercial security suites, MSE's Dynamic Signature Service technology uses the most recent virus definitions to check applications for risks, rather than relying on the last batch of definitions downloaded, the company said.

MSE also emulates programs before they complete their execution, and looks for suspicious behaviour such as carrying out operations without user permission. If a program is behaving suspiciously, MSE will ping the Dynamic Signature Service to see whether the program should be submitted for analysis or terminated.

The software also addresses PC users' concerns of nagware as Microsoft has promised that MSE has been "designed to run quietly in the background alerting the user only when there is an action for them to take."

Most importantly, unlike branded anti-virus softwares, MSE does not hog too much memory and offers a performance boost because it is not a "big suite."

In contrast to other tools, MSE requires a minimum of just 256MB memory and a 500MHz processor on an XP system, and 1GB memory and a 1GHz processor for Vista or Windows 7, according to Microsoft. "We wanted it to be capable of running on as many machines as possible, and it runs quietly and silently without any fuss. You just install it and forget it," Evans said.

Meanwhile, MSE's launch has been welcomed by branded anti-virus makers such as Symantec, McAfee, Kaspersky, Trend Micro, AVG and Alwil Avast with cautious optimism.

"The security industry has moved on from the product Microsoft is launching," said Con Mallon, Symantec's marketing director. "Unique malware and social engineering fly under the radar of the traditional signature based technology employed by free security tools such as Microsoft's."

"We believe the false sense of security provided by this tool is almost as dangerous as having no security at all," Mallon cautioned, adding that PCs using only MSE are vulnerable to phishing attacks as MSE's Dynamic Signature Service technology is vulnerable against a malicious website that offers each visitor their own personalised Trojan.

"It (MSE) is a stripped down version of their old OneCare product which was poorly rated by industry experts and users alike," a Symantec spokesperson said, commenting on the release of the software. "From a security perspective, this Microsoft tool offers reduced defences at a critical point in the battle against cyber crime."

"I do not think its (MSE) a bad thing. It's only a bad thing if people think that's all they need to do," said Roger Thompson, chief research officer for AVG, which offers free as well as paid-for versions of anti-virus software by the same name. "The danger is if users think that they can just get by with the Microsoft tool."

According to Thompson, MSE does not provide 100 percent protection and itself could become a target for malware writers who, if they manage to penetrate it, would potentially have a large pool of victims to target.

Agrees David Emm of Kaspersky's. "We're not immediately concerned; if you look at the developments in the last 10 years or more in anti-virus software it has gone through several iterations. These days, protection for consumers is a lot more than merely signature recognition. It is a lot more than strictly anti-virus (AV), a specific AV offering doesn't encompass all of that and clearly there is still a market place for other people," Emm said.

According to Emm, though MSE will not be "closing avenues for (commercial security suite) vendors," its launch, however, most certainly redefines the rules in internet security industry. ""It would be naïve to say it (MSE) doesn't have any implications. But it will depend, I think, on how significant the impact will be. It might impact on sales of the purely anti-virus portion and there is less scope to sell a vanilla anti-virus product," he said.

In conclusion, MSE will not have other anti-virus software makers quaking in their boots anytime soon. "It (MSE) won't be the application that puts Symantec or McAfee out of business," said Andrew Storms, the director of security operations at nCircle Network Security. "...Microsoft still has to prove itself in this arena. Take, for example, Windows Defender, which has been free. It's not necessarily the best anti-spyware product available."

However, as the name clearly indicates, "Security Essentials" does not claim or try to protect a PC user against every possible threat. But then, no product does.

MSE is nothing more than a basic defence against basic malware – the stuff that is prominent enough to succumb to signature identification. And also unlike software offered by Symantec or the like, MSE is not a money-spinning venture: that is clear from the free, perpetual licence.

All that Microsoft seems focused on doing right now is woo users who do not use full-featured security software by offering them something easier, lighter and less intrusive: a security client stripped down to the basics, with a "so-simple-it-hurts" interface. With no nagging and free updates for life, it is a pretty compelling proposition to not only consumers consumers but also smaller businesses as well who know they are getting a "high-quality, excellent anti-malware product" for free.

MSE has been launched in eight languages and in 19 countries - the UK, Ireland, the US, Austria, Belgium, France, Germany, Italy, the Netherlands, Spain, Switzerland, Australia, Brazil, Canada, Israel, Japan, Mexico, New Zealand and Singapore and Microsoft said the software will be available for use in more countries soon.