The firewall security experts at Agnitum, developers of the widely-acclaimed Outpost Firewall product family, have conducted an in-depth analysis of Microsoft's new OneCare Firewall, part of Microsoft's "Live" security initiative. The results are so far below industry standards that the company felt obliged to share the results of its analysis with the public.

Highlights of the report include the following:

• The OneCare firewall failed all but the simplest leak tests and does not offer even the most basic intrusion detection capability, leaving users' PCs wide open to being hijacked into a botnet
  
• The OneCare firewall database of pre-approved applications is very small, and adding each new application requires several user interactions and a reboot
  
• Application access rules are limited to 'allowed' and 'not allowed' - users cannot configure different rules for different types or times of usage, such as allowing IE to connect with some but not all websites
  
• Similar limitations apply to network file access and remote desktop operations
  
• The Windows Defender anti-spyware component of OneCare imposes significant delays on program execution, and is updated on a separate schedule than other OneCare components

Agnitum engineers also found compatibility issues with OneCare - but not the ones they had expected. Before installing the software, they already had a firewall running, as would most people. OneCare did not request the de-installation of any existing firewall, so Outpost Firewall Pro was left in place. OneCare worked smoothly alongside Outpost Firewall Pro - so smoothly that Outpost was the first to monitor the system, ask questions and protect the user, not OneCare.

The full analysis can be found on the Agnitum website (link below).

"Microsoft has tried to create software for novice users, making it very limited in settings and customization. The problem is, they've gone too far. OneCare is too simple. Yes, it's easy to use. But unfortunately, it doesn't provide much protection," says Alexey Belkin, Chief Software Architect at Agnitum. "This 'one product for everyone' attempt is likely to end up being 'one product for no one.' The product itself looks like it was designed as a mandatory part of the operating system, and that is simply shortchanging users who haven't yet decided what security solution to invest in."

The business community worldwide, as well as the firewall security vendor community, has reacted swiftly to the appearance of this new player, not only from a technology perspective but also from the point of view of Microsoft's business practices. Reactions concerning "predatory pricing" (first discussed by Sunbelt president Alex Eckelberry in his blog - link below) are arising, primarily that Microsoft is setting artificially low prices. But "cheap" doesn't equal "good value," as can be seen in the Agnitum analysis of the OneCare firewall.

"No one is underestimating the potential impact of Microsoft entering the Internet Security market, but at Agnitum we are seeing this development having more positive than negative effects," says Mikhail Penkovsky, Global VP of Sales & Marketing at Agnitum. "The updating of the Windows Firewall in Vista makes a clear statement that the personal firewall is a must-have Outpost and other third-party firewalls will still be there for customers when they realize - as many will - that the protection provided by OneCare is extremely limited. Our key distributors and resellers are in full agreement that OneCare is nice to look at but that's pretty much all there is to it."

[Sour grapes? Probably not. We have long-term tested Agnitum's firewall here and found the product excellent - and the people behind it likewise. We intend to play with Vista and its components shortly. --Ed.]

Related links: (Open in a new window.)
www.agnitum.com/r/firewall/onecare

View printable version (opens in new window)
Back