Windows XP SP3 opens security features

Microsoft Windows XP Service Pack 3 is packed with security features that had previously been available to Vista users. This is a good move, as even with four year desktop refresh cycles, IT can move to Windows Server 2008 products with support for mixed XP and Vista endpoints. Organizations are not likely to upgrade to Vista for security reasons only, so Microsoft has stepped up to extend security to XP. I found the top three features that are available in XP SP3 to be:

Network Access Protection (NAP). The ability to ask the endpoint "where it hurts" requires a ubiquitous agent that is best delivered by Microsoft. The best use of NAP is for automated updates to keep endpoint configurations compliant (without calling on IT first). Enforcing configuration compliance needs to cover the majority of the endpoints, which is now possible for those deploying NAP.

Remote Desktop Protocol (RDP). This is an enhancement to allow XP clients to support the new version of Terminal Server. Terminal Server virtualization allows remote users to access Windows-resident applications via a browser. This keeps both applications and application data on protected servers, simplifying IT application maintenance and reducing the risk of confidential data finding its way to laptops.

Server and Domain Isolation. This feature of IPSec cloaks the existence of servers from users that have not been granted access rights. Not only can the users not log on, they cannot even see the protected resources on the network. This feature is not for everyone, but if you have highly sensitive data, such as PCI information, it makes sense to isolate those servers from the rest of the network. IT then has a much tighter operational process to secure.

The existence of these features in XP SP3 means that IT can take advantage of security features introduced in Windows Server 2008 for both Vista and XP users. These might be particularly useful in small and medium sized organizations; larger organizations should look at blended efforts with Cisco NAC and Citrix application delivery.