Firewalls Will Turn Off New Windows Firewall.

By Kevin Murphy

Microsoft Corp expects users of its forthcoming Windows XP Service Pack 2 to run the new Windows Firewall alongside existing personal firewalls, but rivals are expected to update their products to automatically turn the Microsoft software off.

During a security webcast this week, Microsoft executives spelled out more of their expectations from the new firewall software, including how it will be positioned against rival products from companies like ZoneAlarm, Norton and McAfee.

"We've been doing an awful lot of compatibility testing including what will happen if you have multiple firewalls on," said Rebecca Norlander, group manager of Microsoft's Security Business and Technology Unit, during the webcast.

"While we recommend that you keep Windows firewall on, especially so you get the boot protection, it will be up to you to configure how that works with another firewall product," Norlander said. "We don't think anything adverse would happen".

The boot protection feature means that the firewall will load and start protecting the PC before Windows has finished booting up. Most current software firewalls leave the PC vulnerable during the seconds before they execute.

"It's interesting she's saying that users would want to have two firewalls running, I don't think that corresponds to the best user experience," said Fred Felman, VP of marketing at Zone Labs, Check Point Software Technologies Ltd's latest division.

Felman said that testing shows ZoneAlarm and Windows Firewall can run simultaneously. But users are presented with two dialog boxes whenever an application tries to listen on a network port, he said. "It might be confusing," he said.

Zone is currently evaluating how its next version will interact with Windows Firewall. Felman did say, however, that the next ZoneAlarm will have boot protection too, by loading the firewall load before the network drivers during bootup.

James Schmidt, a McAfee product manager at Network Associates Inc, said the company is working on a new version of McAfee Personal Firewall that will automatically detect and disable Windows Firewall. There's an API to do this.

"It will disable that feature, so that users that purchase McAfee firewall can use McAfee firewall," he said. "We've done a lot of customer research, and found that most users don't want to be overly alerted."

Microsoft does not appear to have a problem with rivals turning Windows Firewall off like this. During Tuesday's webcast security chief Mike Nash made it clear the firm will not be very aggressively pushing the software (other than bundling it, of course.)

"Evaluate the functionality of your security products to determine what's right for your environment," Nash said. "Understand what's in Windows XP Service Pack 2 but if you already have procedures in place you're comfortable with, that's a fine strategy too."

Rival firewall vendors also claim that this first Windows Firewall is less functional and less secure than their own products. For starters, there's an API that allows programs (benign or otherwise) to add themselves to the firewall exceptions list.

But rivals also think that Microsoft is targeting a less savvy customer base than will be content with the security (or "false sense of security", as one competitor put it) that the bundled firewall offers.

"Customers that are buying Zone Labs or other PC security products are the ones truly concerned about security of their PCs, and not necessarily the ones Microsoft is targeting with their software. They're targeting the ones who don't care about their security and therefore get something bundled in," Check Point CEO Gil Schwed said in the company's quarterly earnings call earlier this week.

Technology aside, there's also the concern that Microsoft will start eating into the market share of existing players, as it did with Netscape in the browser was of the late 1990s and RealNetworks in current hard-fought media player wars.

"I don't think it will have any meaningful effect on what we do, but time will tell," Schwed said when asked about the potential impact of SP2 on the Zone business.