Chapter 8
Automatic Updates
Internet security is a never-ending cat-and-mouse game between the security experts and the hackers who seem to have endless amounts of time to search for new ways to exploit the basic programmability of PCs. Every time the good guys find a way to patch some security hole that the bad guys have learned to exploit, the bad guys find two more holes to exploit.
Windows 10 is the most secure Windows version ever, by a long shot. But no computer is 100 percent secure because people can always find a way to turn something good into something bad. So, in addition to the security features discussed in the preceding chapters, you need to keep your computer up to date with security patches as they become available.
Windows Update in Windows 10 builds on one of the most essential components in the OS engine: its self-healing and self-patching ability. An operating system can never be defect-free, and when a defect is discovered that must be “fixed” quickly, Windows Update kicks in. In Windows 10, Microsoft has installed the technology that may once and for all end the idea of an “upgrade.” That's what Windows Update and this chapter are all about.
Understanding Automatic Updates
Many people are afraid of Windows Update — they're afraid that the updates will break something on their system that they can't fix. It's true that any change to your system can create a problem. But keeping up with updates is unlikely to cause any significant problems — certainly nowhere near as many problems as you expose yourself to by not keeping up with updates. In addition, Windows Update creates restore points before installing many updates (but not for all updates), so you have the added security of being able to restore the system to a point prior to the update.
Other people fear that Microsoft will somehow exploit them through automatic updates. That isn't the way updates work. Microsoft has tens of millions of customers and tens of billions of dollars. It doesn't need to exploit anybody to be successful. Microsoft is also a publicly held company on the stock exchange, which means it's subject to constant scrutiny. When you're making up your mind about which companies to trust, large, publicly held companies are by far the most trustworthy, if for no other reason than that they can't afford to be untrustworthy.
A third common fear of automatic updates centers around the question “What's this going to cost me?” The answer to that is simple: Absolutely nothing. This brings us to the difference between updates and upgrades.
Updates versus upgrades
People often assume that the terms update and upgrade are synonymous. We certainly use the terms interchangeably in common parlance. But in the computer world, there is a big difference. Upgrades usually cost money and involve a fair amount of work. For example, upgrading from Windows 8.1 to Windows 10 costs you some money and takes some time. However, updating your existing version to Windows 10 is actually a free upgrade (for at least a year after it's released) and your previous version simply morphs into Windows 10. You don't even need to hire someone to verify that the upgrade worked.
Why updates are important
Automatic updates are an important part of your overall security. Many forms of malware, especially viruses and worms, operate by exploiting previously unnoticed flaws in programs. The term exploit, when used as a noun in computer science, refers to any piece of software that can take advantage of some vulnerability in a program in order to gain unauthorized access to a computer.
Some hackers actually publish, on the Internet, exploits they discover, which is both a good thing and a bad thing. The bad thing is that other hackers can use the exploit to conjure up their own malware, causing a whole slew of new security threats. The good thing is that the good guys can quickly create security patches to prevent the exploits from doing their nefarious deeds. Automatic updates keep your system current with security patches that fix the flaws that malware programs attempt to exploit.
Enabling Automatic Updates
Automatic updates are the best way to keep up with security patches. In fact, chances are, they're already enabled on your system. To find out, open Windows Update. As you know from previous chapters, you simply click Settings to launch the Settings applet. Then click the “Update & security” image.
Figure 8.1 shows the Update & security applet.
Figure 8.1 The Settings applet showing the Windows Update & security option.
Managing Updates
Automatic updates related to security require little or no effort on your part. When you open the Update & security applet, it may be in the middle of checking for updates or completed, as shown in Figure 8.2.
Figure 8.2 The Windows Update & security applet when it's finished checking for updates.
But sometimes you may be faced with optional updates. These updates aren't security related. Instead, they're new versions of drivers, fixes for minor bugs, or some other type of update. They're optional because your computer is secure whether you install the update or not. You also have the option, as you'll see later in this chapter, to automatically update more than just the operating system bits. This is shown in Figure 8.3.
Figure 8.3 The Windows Update & security applet showing how it will update other Microsoft products.
From the Windows Update & Security applet, you can choose between two values for the option Choose How Updates Are Installed:
- Automatic (recommended). If you choose this option, the applet informs you that the option will “Keep everything running smoothly. We'll restart your device automatically when you're not using it. Updates won't download over a metered connection (where charges may apply).” This is shown in Figure 8.4.
- “Notify to schedule restart.” If you choose this option, the applet informs you that “Updates won't download over a metered connection. You'll be asked to schedule a restart to finish installing updates.” This is shown in Figure 8.5.
Figure 8.4 The Windows Update & security applet setting for automated updates.
Figure 8.5 The Windows Update & security applet in prompt to restart mode.
Next on the applet is the following check box: “Give me updates for other Microsoft products when I update Windows.” By enabling this option through the check box you are essentially letting Microsoft decide which of its other products, such as Microsoft Office, it will update.
Also on the applet is a link that allows you to “View your update history.” When you click on this link, the applet opens the pane shown in Figure 8.6 and provides you with a list of your recent updates, successes, and failures.
Figure 8.6 Windows Update & security applet showing update history.
You can also select the option “Choose how your download updates.” The applet pane for choosing these options appears, as shown in Figure 8.7.
Figure 8.7 The Windows Update & security applet provides choices for downloading updates.
Here you can toggle on the option to get the updates faster by getting them from other machines on your network, or from either other machines on your network or the Internet.
The applet displays the following message: “Getting builds faster means you'll see new things sooner. Getting builds slower could mean more solutions are available for issues.”
Additionally, you can select the option to get Insider builds. Insider is like a beta tester group at Microsoft you can join to preview new software that has not yet been released to manufacturing (RTM).
Thwarting Exploits with Data Execution Prevention
Thwarting malware attacks that exploit software vulnerabilities is the most important element of automatic updates. But Windows 10 offers a second way of thwarting such attacks. It's called Data Execution Prevention (DEP). Don't use DEP as an alternative to other techniques described in this part of the book. Instead, use it in addition to other techniques.
Many malware attacks use a technique called buffer overflow (or buffer overrun) to sneak code (program instructions) into areas of memory that only the Windows operating system should be using. Those areas of memory have direct access to everything on your computer. So, any bad code that sneaks into that area can do great damage.
DEP is a security antidote to such attacks. It monitors programs to make sure they use only safe and appropriate memory locations. If DEP notices a program trying to do something sneaky, it shuts down that program before it can do any harm.
By default, DEP is enabled for essential Windows programs and services only. When coupled with antivirus protection, that setting is usually adequate. You can crank it up to monitor all programs and services. But if you do, you may also have to individually choose programs that are allowed to bypass DEP. Knowing when that's okay requires technical expertise that goes beyond the scope of this book.
To get to options for DEP, follow these steps:
- Open Control Panel then System. The System window opens.
- In the left column, click Advanced System Settings. The System Properties dialog box opens.
- Select the Advanced tab, click the Settings button on the Performance heading, and then select the Data Execution Prevention tab. You see the options shown in Figure 8.8.
- By default, the option to apply DEP only to essential Windows programs and services is selected. For stronger protection, you can turn on DEP for all programs and services. If you choose that option, DEP sometimes may shut down a program to prevent it from running.
Figure 8.8 Data Execution Prevention options.
If DEP shuts down a program you need, you have two choices:
- Contact the program manufacturer to find out whether a different version of the program runs under DEP.
- If you trust the program, you can add it to the list of programs that are allowed to bypass DEP. To accomplish that, click the Add button and then navigate to and double-click the executable file (typically, such a file has the extension
.exe) that DEP is shutting down.
Wrapping Up
In general computer security, the “big three” items are a firewall, malware protection, and automatic updates. Chapters 7 and this chapter cover those topics. Comprehensive malware strategy is beyond the scope of this book. But don't forget that running under a Standard user account (see Chapter 4) counts, too. Furthermore, you have less technical “social” threats to consider, such as phishing scams and pop-up ads.
The main points for this chapter are as follows:
- Automatic updates provide a quick and simple way to protect your computer against current software exploitation malware.
- Unless you have a compelling reason to do otherwise, you should allow Windows 10 to automatically download and install updates daily.
- Data Execution Prevention (DEP) offers another layer of protection against threats that work by sneaking errant code into sensitive parts of system memory.