Is 64-bit Windows Safer Than 32-bit?

For a while now, many systems have shipped with 64-bit Windows by default. According to Microsoft, most Windows 7 systems ship with the 64-bit version. It's not just something techies get, it's something installed by OEMs in order to sell systems with more than 3GB of usable memory. 32-bit Windows systems can't address much more than that.

For some time Microsoft also has argued that 64-bit Windows is safer than 32-bit Windows. In an article in Computerworld, Alfred Huger, vice president of engineering at security start-up Immunet, says the claims are overblown.

Huger is reacting to a blog from the Microsoft Malware Protection Center that points out a lower incidence of malware infection on 64-bit systems. Microsoft points out features of 64-bit Windows that inhibit malware but acknowledges that there is still malware that can affect it.

Huger emphasizes the latter point, that malware could be much more effective against 64-bit Windows if malware authors targeted it. This is not unlike the argument made about the Mac and other non-Windows platforms: there's little or no malware on them because they are not targeted by the authors. I think there's something to this, but only to a point. There are aspects of 64-bit Windows which do make it a harder environment for malware, at least for malware which exploits system features as opposed to relying on social engineering.

Hardware-based DEP (Data Execution Protection), for example, is turned on for all 64-bit processes. Kernel Patch Protection (a.k.a. PatchGuard) protects access to internal operating system data structures. And device drivers must be digitally signed with a certificate issued by a trusted certificate authority. Finally, none of the large body of malware written as 32-bit drivers or any 16-bit code will run at all on 64-bit Windows.

None of these is a perfect protection against attack. As good as technical solutions can ever get, the system is still as vulnerable as the user is to social engineering attack. But all of them, especially combined with an anti-malware program, should make systems pretty secure.

Computerworld also notes a line from the bi-annual Microsoft Security Intelligence Report to the effect that the lower malware infection incidence in 64-bit Windows may be due to a more sophisticated class of user running that version. This certainly used to be true, but it's nowhere near as true as before and will continue to decline in significance, As I stated at the beginning of this article, many normal users find themselves running 64-bit Windows quite by surprise, and most shipping Windows 7 systems run it. 64-bit Windows is the future, and better security with it.

blog comments powered by Disqus