Who's upgrading to Windows 10?

In the three weeks since the new OS's debut, Windows 8.1 users have been the most willing to migrate

Windows 8.1 users have been half again as likely to upgrade to Windows 10 as their compatriots running Windows 7, data from a Web metrics vendor showed today, confirming expectations about who would upgrade first to Microsoft's new operating system.

The ascension of Windows 10's usage share has largely come at the expense of Windows 8.1, according to measurements by Irish analytics company StatCounter. Of the combined usage share losses posted by Windows 7, Windows 8 and Windows 8.1 since the last full week before Windows 10's July 29 launch, 57% has been attributed to Windows 8.1 deserters.

Windows 7, meanwhile, contributed 37% of the losses by the last three editions, and Windows 8, 6%.

The disparity was not unexpected: Most pundits and analysts figured that users of Windows 8.1 -- like Windows 7, eligible for a free upgrade -- would be first in line to dump their existing OS and migrate to the new. The changes in Windows 10, including the restoration of the Start menu and windowed apps, were most attractive to Windows 8 and 8.1 users, experts believed, because their removal had been widely panned.

Simply put, Windows 7 users, who were more satisfied with the OS Microsoft gave them, would be less motivated to upgrade. That's been proven out by StatCounter's early numbers.

But there were recent signs that Windows 7 users have begun jumping to Windows 10 in numbers nearly equal to Windows 8.1.

During the week of August 10-16, the difference between the declines in Windows 7 and Windows 8.1 was the smallest it's been since Windows 10's debut. In that week, Windows 7 lost 0.55 percentage points of usage share, only slightly less than the 0.64 percentage points given up by Windows 8.1. The week before -- August 3-9 -- the gap between the two was much larger: Windows 7 lost 0.95 percentage points, while 8.1 declined by 1.42 points.

StatCounter's data also illustrated just how important Windows 7 conversions will be to Windows 10's ultimate success -- as Microsoft has defined it, that would mean 1 billion devices running the operating system by mid-2018. Even if it coaxed every Windows 8 and 8.1 user into upgrading, Microsoft would be looking at a usage share of less than 21% for Windows 10. It must convince large segments of Windows 7's base to migrate as well.

That may require modification of the Windows 10 pitch, perhaps with less talk about the return of the Start menu, say, and more about enhanced security. Working against Microsoft are a plethora of Windows 10 behaviors, particularly its mandated updates and the concurrent loss of control over what reaches customers' devices and when. That has raised hackles among the traditionalists who stuck with Windows 7.

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Microsoft explains timing of Windows 10 updates

Windows 10's staggered timetable will kick off by early December

If Microsoft follows through on its announced plans for updating and upgrading Windows 10 after the new OS launches in two weeks, it will issue the first update no later than the end of November or early December, then follow with three more in 2016, repeating with a trio each year following.

Lather, rinse, repeat.
The update churn will result in a near-constant patter about upcoming updates and upgrades -- Microsoft itself isn't sure which of those terms apply, using both interchangeably -- for customers to digest.

Microsoft has left those customers guessing on answers to a slew of questions about Windows 10 refreshes, ranging from how long the updates and upgrades will appear free of charge to how substantial those changes will be. But it's talked about the schedule, pulling back the curtain in small jerks.

Here's what's known about the timetable and what's still unknown -- or in the infamous words of former Secretary of Defense Donald Rumsfeld, the "known unknowns" -- as the July 29 release date looms.
Updates will come every four months

According to a Microsoft-hosted webinar in late April, Windows 10 will receive updates about every four months, or three times a year.

It's likely that Microsoft won't hew to a set schedule, as does Mozilla, which rolls out a new edition of Firefox at almost-sacrosanct six-week intervals. Microsoft could trim the time between updates or extend the timeline, depending on whether it's satisfied with the quality and composition of the new build, or even on external factors, like the calendar.

If Microsoft wanted to present a newer Windows 10 for the end-of-year holiday sales season, for example, it would like to have that on new devices no later than mid-November, meaning a release -- or, at least, finished code -- in October.

Such flexibility is not guaranteed: We simply don't know because Microsoft won't say, or doesn't know itself.

But on average, expect to see updates/upgrades spaced out every four months.

The first update will appear before year's end

Four months from the July 29 launch date would be November 29, close to the start of winter in the northern hemisphere.

Although that date may not be set in stone, it's clear that to make good on its promises Microsoft must roll out a finished first update/upgrade before year's end.

That alone will be a record for the company: The previous shortest lag has been the six months between Windows 8.1 (launched Oct. 17, 2013) and Windows 8.1 Update (April 8, 2014).

Consumers as guinea pigs get the first update
The first update/upgrade will be primarily, perhaps exclusively, for consumers, delivered to devices running Windows 10 Home by default via the Windows Update service. Microsoft is calling that update cadence or track "Current Branch" (CB), part of the new release lexicon the Redmond, Wash. company's invented.

Those running the more advanced Windows 10 Pro can also adopt the consumer-speed CB track. People most likely to do so are the power users, enthusiasts and work-at-homers with a Pro edition, as companies -- which also widely deploy the various Windows' Professional or Pro SKUs (stock-keeping units) -- will probably play it conservative and instead take updates from the Current Branch for Business (CBB) after they have moved to Windows 10 Pro.

Not everyone on CB will get the first update at the same time
Microsoft has provided some update flexibility (its take) or complicated matters (the cynic's view) by segmenting each "branch" into "rings." The latter is a second release timing mechanism that lets customers receive a branch's update as soon as the build is approved via a "fast" ring, or delay the update's arrival using a "slow" ring.

Rings on the CB were confirmed only this week by Terry Myerson, chief of the company's OS and devices division, and may number more than the two: Again, Microsoft's not elaborated.

The Windows Insider preview program, which will continue to run after July 29, has put devices into the slow ring by default; Microsoft may or may not do the same with the CB.

The one certainty is that not everyone on the CB will get the update immediately. "Some consumers just want to go first. And we have consumers that say, 'I'm okay not being first,'" Myerson said on Monday.

Most business PCs won't get the first update until the Spring of 2016
Because Microsoft will be using its Insider participants, and more importantly the millions of consumers running Windows 10, as testers, it will not release builds to businesses at the same time as those on the Current Branch.

With the four-month stretch between updates/upgrades and the automatic delay built into the Current Branch for Business (CBB), customers on the latter will not receive the first build until next year: On a strict schedule, that will be at the end of March or beginning of April 2016.

Microsoft's doing it this way, it's said, to produce more bug-free code to its most important users, businesses. Microsoft figures that the four months will shake out more bugs so that those running Windows 10 Pro or Windows 10 Enterprise will get a more stable update with a correspondingly lower risk of something breaking.

Users of Windows 10 Pro and Windows 10 Enterprise can stick with the old way of managing updates -- using Windows Server Update Services (WSUS) or another patch-management product -- or go with the new Windows Update for Business (WUB), an analog to the consumer-ish Windows Update service.

Those on WUB must deploy a given build within four months of its release or Microsoft will shut off the patch spigot: That means CBB users applying updates/upgrades with WUB must have the first build on their devices by approximately Aug. 1, 2016.

Businesses can delay the first update only so long

Microsoft's not giving anyone a choice: Either take the updates and upgrades or face a security patch drought. (The one exception: Windows 10 Enterprise.)

The longest delay allowed for CBB will be eight months from a specific build's release to the branch, or 12 months after the same build has hit the consumers via the CB.

Customers using WSUS or another Microsoft (or third-party) patch management solution must have the first build deployed no later than late November, early December 2016.

Microsoft has talked about rings on the CBB since the May announcement of Windows Update for Business, but as with rings on the CB, details remain muddled. How long the slow ring follows the fast, for instance, is unclear.
Only Windows 10 Enterprise can ignore the updates and upgrades

The only Windows 10 edition that can pass on the constant updates and upgrades is Enterprise, the SKU available solely to organizations that have a volume licensing agreement tied to the annuity-like Software Assurance (SA) program.

The branch available only to Windows 10 Enterprise, dubbed Long-term Servicing Branch, or LSTB, mimics the traditional way Microsoft has handled its OS: Only security patches and critical bug-fixes will reach systems on the LTSB.

Every two to three years, Microsoft will create another LTSB build, integrating some or all of the feature changes released to CB and CBB in the intervening time, then offer that to customers. They will have the option to move to that build -- it won't be mandatory -- and can skip at least one build, passing on LTSB 2 (or whatever Microsoft names it), then years later adopting LSTB 3 with an in-place upgrade.

The code released on July 29 will be considered LTSB 1, Microsoft has said, so a second, optional LTSB won't appear until 2017 at the earliest.
By December 2016, there will be multiple update/upgrade builds being used

The staggered releases Microsoft plans will create a situation where multiple builds are in use at any one time, each by a segment of the Windows 10 device population.

Come December 2016, Microsoft will have issued its fourth build to the CB, and the third to the CBB. But there will be some still using the second build (those on the CBB managing updates with WSUS).

Analysts, however, have largely discounted fragmentation as a factor, arguing that while the delays offered to businesses on the CBB may be disruptive, Windows 10 will ultimately be a more uniform ecosystem than the current mix of vastly different editions of Windows.
What Microsoft gets out of this stretched, staggered release schedule

Microsoft may pitch the Windows 10 update and upgrade schedule as all about customers, but there's something in it for the company, too.

"Rings will be more about controlling the rate at which the updates flood out into market," said Steve Kleynhans, an analyst at Gartner, in a recent interview. "With potentially a billion devices ... eventually ... getting an update, you need some level of flow control or else you could crush your servers and a large part of the Internet. By using rings, Microsoft can stagger the release over the period of days or weeks."

In fact, the entire cadence, not just the rings, can be envisioned as Microsoft's way of reducing stress on its update servers. Although the second build for the CB -- slated for late March-early April 2016 -- will coincide with the launch of the first build for the CBB on Computerworld's timeline, it will not be a surprise if Microsoft staggers the two by launching first one, then the other.

Microsoft is clearly concerned about server load and the possibility that something could go awry: It's not releasing the free Windows 10 upgrade to all eligible customers on July 29. Instead, it plans to give the several million Insiders the code first, then gradually trigger upgrades on others' devices in an unknown number of "waves" that could run weeks or months.

The company will also control demand for the upgrade another way by silently downloading the bits in the background to eligible PCs and tablets, then notifying them on its own schedule that the upgrade is ready to process locally.

It may do the same with later updates and upgrades, Kleynhans speculated.

"I wouldn't be surprised if under the covers Microsoft uses a separate ring for each week after an OS is released, or maybe even one for each day immediately after it is out," said Kleynhans. "But these will be mostly invisible to users and really isn't all the different from the way some updates roll-out today."
The naming problem

Computerworld has used generic place holders to identify the various update/upgrade releases Microsoft will distribute to Windows 10 -- "first build" and "LTSB 2," for instance -- because Microsoft hasn't talked about how it's going to name each build.

That will have to change.

"Another factor that Microsoft has yet to discuss is how it will identify each update," Kleynhans said. "We know that the OS will be called Windows 10 regardless of what updates have been delivered and installed.... But as for identifying the state after each update, we don't know if Microsoft will stick with the build number, as it has during the preview program, opt for a simplified numbering scheme -- something similar to the build number but without the holes in the numbering scheme -- go back to point identifiers [like] Window 10 v 10.1 and Windows 10 v 10.2, [as] Apple does with OS X, or maybe use something more date oriented [such as] 'Windows 10, July 2016.' There will have to be something to help developers understand what they are facing in the field."

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com

Why you need to care more about DNS

There’s one key part of your network infrastructure that you’re probably not monitoring, even though it keeps you connected, can tell you a lot about what’s happening inside your business – and is an increasing source of attacks. DNS isn’t just for domain names any more.

When you say Domain Name System (DNS), you might think, naturally enough, of domain names and the technical details of running your Internet connection. You might be concerned about denial of service attacks on your website, or someone hijacking and defacing it.

While those certainly matter, DNS isn't just for looking up Web URLs any more; it's used by software to check licences, by video services to get around firewalls and, all too often, by hackers stealing data out from your business. Plus, your employees may be gaily adding free DNS services to their devices that, at the very least, mean you're not in full control of your network configuration. It’s a fundamental part of your infrastructure that’s key to business productivity, as well as a major avenue of attack, and you probably have very little idea of what’s going on.

6 simple tricks for protecting your passwords
DNS is the most ubiquitous protocol on the Internet, but it’s also probably the most ignored. Data Leak Protection (DLP) systems that check protocols used by email, web browsers, peer-to-peer software and even Tor, often neglect DNS. “Nobody looks much at DNS packets, even though DNS underlies everything,” says Cloudmark CTO Neil Cook. “There’s a lot of DLP done on web and email but DNS is sitting there, wide open.”

Data lost in the Sally Beauty breach last year was exfiltrated in packets disguised as DNS queries, but Cook points out some unexpected though legitimate uses; “Sophos uses DNS tunnelling to get signatures; we even use it for licensing.”

A number of vendors are starting to offer DNS tools, from Infoblox’s appliances to OpenDNS’ secure DNS service; Palo Alto Networks is starting to offer DNS inspection services, U.K. domain registry Nominet has just launched its Turing DNS visualisation tool to help businesses spot anomalies in their DNS traffic, and Cloudmark analyzes patterns of DNS behavior to help detect links in email going to sites that host malware. There are also any number of plugins for common monitoring tools that will give you basic visibility of what’s going on.

Few businesses do any monitoring of their DNS traffic despite it being the source of many attacks. It’s not just the malware that runs on Point of Sale systems, capturing customer credit cards in attacks like those on Sally Beauty, Home Depot and Target, that uses DNS tunnelling. DNS is the most ubiquitous command and control channel for malware, as well as being used to get data stolen by malware from your business.

“DNS is frequently used as a conduit to surreptitiously tunnel data in and out of the company,” says Cricket Liu, the chief DNS architect at Infoblox, “and the reason people who write malware are using DNS to tunnel out this traffic is because it's so poorly monitored, most people have no idea what kind of queries are going over their DNS infrastructure.”

There’s also the problem of people using DNS to bypass network security controls; that might be employees avoiding network restrictions, security policies or content filtering, or it might be attackers avoiding detection.

DNS attacks are a widespread problem
In a recent Vanson Bourne study of U.S. and U.K. businesses, 75 percent said they’d suffered a DNS attack (including denial of service and DNS hijacking as well as data theft through DNS), with 49 percent having experienced an attack during 2014. Worryingly, 44 percent said it was hard to justify investments in DNS security because senior management didn’t recognize the issue.

That’s because they think of DNS as a utility, suggests Nominet CTO Simon McCalla. “For most CIOs, DNS is something that happens in the background and isn’t a high priority for them. As long as it works, they’re happy. However, what most of them don’t realize is that there is a wealth of information inside their DNS that tells them what is going on within their network internally.”

Liu is blunter: “I’m surprised how few organizations bother to do any kind of monitoring of their DNS infrastructure. DNS doesn’t get any respect, yet TCP/IP networks don’t work without DNS; it's the unrecognized lynch pin.” Liu insists “it’s not rocket science to put in monitoring of your DNS infrastructure; there are lots of mechanisms out there for understanding what queries DNS servers are handling and their responses. And you really ought to be doing because this infrastructure is no less critical than the routing and switching infrastructure that actually moves packets across your network.”

Usually, he finds demonstrating the threat is enough to get management attention. “Most CIOs – once they see how with one compromised machine on the inside of a network you can set up a bi-directional channel between that endpoint and a server on the internet – realize they need to do something about this. It's just a matter of being faced with that cold hard reality.”

Tackling DNS security
First, you need to stop thinking about DNS as being about networking and just “part of the plumbing,” says David Ulevitch, the CEO of OpenDNS (which Cisco is in the process of acquiring).

“It used to be network operators who ran your DNS, and they were looking at it in terms of making sure the firewall was open, and not blocking what they viewed as a critical element of connectivity as opposed to a key component of security policy, access control and auditing. But we live in a world today where every network operator has to be a security practitioner.”

If you actively manage your DNS, you can apply network controls at a level employees (and attackers) can’t work around. You can detect phishing attacks and malware command and control more efficiently at the DNS layer than using a web proxy or doing deep packet inspection, and you can detect it as it happens rather than days later.

“DNS is a very good early warning system,” says Liu. “You can pretty much at this point assume you have infected devices on your network. DNS is a good place to set up little tripwires, so when malware and other malicious software gets on your network, you can easily detect its presence and its activity, and you can do some things to minimize the damage it does.” You could even see how widespread the infection is, by looking for similar patterns of behaviour.

Services like OpenDNS and Infoblox can also look across more than your network. “It’s easy to build a baseline of what normal looks like and do anomaly detection”, says Ulevitch. “Suppose you’re an oil and gas business in Texas and a new domain name pops up in China pointing to an IP address in Europe, and no other oil company is looking at this domain. Why should you be the guinea pig?”

You also need to monitor how common addresses are resolved on your network – hackers can try to send links to sites like Paypal to their own malicious sites – and where your external domain points to. When Tesla's website was recently redirected to a spoof page put up by hackers, who also took control of the company's Twitter account (and used it to flood a small computer repair store in Illinois with calls from people they'd fooled into believing they'd won free cars), the attackers also changed the name servers used to resolve the domain name. Monitoring their DNS might have given Tesla a heads-up that something was wrong before users started tweeting pictures of the hacked site.

At the very least, remember that DNS underpins all your online services, Ulevitch points out. “The bar is very low for improving DNS. Usually, DNS is seen as a cost enter; people don’t invest in reliable enough infrastructure or high enough performance equipment so it's hard to cope with a high volume of transactions.”

That doesn’t only matter if you’re targeted by a DNS attack. “Organizations should look at DNS performance because it will have a material impact on everything you do online. Every time you send an email or open an app you're doing DNS requests. These days, web pages are very complex and it's not uncommon to have more than 10 DNS requests to load a page. That can be a whole extra second or more, just to handle the DNS components of loading a page.”
Tracking business behavior

Monitoring DNS can also give you a lot of information about what’s going on across your business far beyond the network. “We live in a world where the network perimeter is becoming ephemeral and where services are easy to adopt,” Ulevitch points out. “A marketing executive can sign up to Salesforce; if you're looking at the DNS you can see that. You can see how many employees are using Facebook. You can see devices showing up in your network, whether it’s because they’re checking a licence or doing data exfiltration. If you have a hundred offices, you can still see who is connecting devices.”

That’s not just PCs either, he points out; printers and televisions and IoT devices are increasingly connecting to your business network. “Do I want my TVs phoning home? If you look at the Samsung privacy policy, it says the TV has a microphone that might be listening at any time; do I really want that in the corporate boardroom? Maybe I want to apply DNS policies so my TVs can't phone home.”

Infoblox’s Liu agrees. “IoT devices are often not designed with a lot of security in mind. You want to make sure devices are connecting where they should be and that if someone throws something else onto your IoT network they can't access your internal network. DNS is a useful place to monitor and control that access.”

And because you’re already using DNS, monitoring it isn’t disruptive, Ulevitch points out. “Usually in security, the reason most things aren't used is the effort needed to make sure they don’t have a detrimental effect on user performance.”

In fact, you need a good reason not to be doing this, he says. “There are fundamental best practices in security and one of them is network visibility. Not being able to see the traffic on your network means you're flying blind. Finding a way to inspect DNS traffic is a fundamental requirement of a strong security posture. To not know what's happening on your network is borderline derelict.”

---

Best Microsoft MCTS Certification, Microsoft MCITP Training at certkingdom.com