Ok looking for some really subjective answers. My company has traditionally been a Linux shop, we manufacture and sell purpose built boxes for video security. We recently decided to build an Embedded Windows Standard 7 box because it shortened our development and time to market, and because of all the tools are available off the shelf for windows.

What I am looking for are some solid answers as it relates to the security of WES7 vs. Linux? How stable is WES7, how prone is it to hack attempts, virus attacks etc. From a marketing point of view what could or should one say are the benefits of using WES7 over Linux? Are there any?

What comparisons are there between the security of desktop Windows 7 and Embedded Windows Standard 7?

Any responses would be greatly appreciated. Thanks

  • 1
    For clarification: You're looking for arguments against using WES7, correct? – Steven Evers Oct 8 '10 at 18:43
  • Are there any RT considerations? – Tim Post Nov 6 '10 at 4:21
  • 6
    I'm voting to close this question as off-topic because it is asking for a comparison of operating systems, and is not about programming. It is both too old and too broad to migrate to a more appropriate Stack Exchange site. – user22815 Jun 28 '16 at 19:25

You will need to do a few things, here are some off the top of my head (having been around this a few years ago):

  • You need lots of memory to run Windows Embedded 7. Check the data - you might be surprised at how much RAM you need.

  • Make sure you understand how the write filter works, if you are using CF or similar as your "hard drive". If you have a real spinning HD then its not such a big deal.

  • Do a course on using the tools. ESSENTIAL. I spent a couple of months on the previous generation tools and it was a pretty terrible time learning them. A 1 day course teaches what you will take 1-2 weeks to learn yourself. MS even offer some of these courses for free.

  • Figure out how you want to lock down the platform. To do this you need to do things like disable web browsers, javascript, turn off file sharing and workstation services (about 70% of all the windows services CAN be disabled and probably should be - this will depend on your application though)

  • Some aspects can only be locked down using manual steps on a master "golden" platform where you build the image, as manual steps hand entered, after the image build. WRITE DOWN A PROCEDURE to allow this to be replicated.

  • Do everything (all your target building) in a VM, and check the VM into source control after. It will be between 8 and 10 GB - make sure that your VM splits the virtual disk into 2 GB chunks to make your source control systems life easier. This sounds over the top but it will save your life 2 years later.

  • Check out and understand how the patch / update system works. We had to write our own, the standard one was not good enough. Things have moved on since but you still must understand this.

  • Line up a consultant who has done this MANY times before, and get them in for a day or a week if you need to. Make them document everything they do, and WHY. You may need help, and a few days of an experienced consultant will save you a month. A classic turning of $ into time. MAKE sure they are experienced. There are lot of BS people selling Windows Embedded out there - doing the easy 90% is (surprise) easy. The other 10% is damn hard.

  • Understand the requirements for branding - removing the MS logos and names and putting your own in. Its relatively easy but you must do it. You may need a graphic designer to make splash / start screens.

  • Go through the license agreement 10 times. It is a LOT of fine print. Your legal department will need to look at it. You MUST understand it and the implications it imposes on your AND YOUR SUPPLY CHAIN. The agreement IS onerous.

  • It is probably not a good idea to have windows updates enabled. You don't want your product doing various automatic unknown updates. (which leads to:)

  • Make sure you know how to use and setup the windows firewall so that all ports are blocked except those used only by your application. This reduces the hack-attack surface.

If you get through all this, by all means use it. It is a very powerful platform.

  • What a fantastic answer. There also is a .NET Micro Framework. It is best thing to use if your design can stand a x100 slowdown comparing to native assembler. – user7071 Aug 25 '12 at 2:53

We were able to build OpenSSL for WCE7, same libraries that Linux uses for its application level security. Then we built that into our app. So for your question, we think security wise, it was about the same as Linux.

For us, what also helped were tools for debugging, detecting priority inversion problems, and monitoring CPU and memory usage. We found one Remote Task Monitor (http://www.remotetaskmonitor.com) that helped a lot, whereas for Linux you have top command which does similar stuff, albeit without a fancy UI.

For Linux, you have to consider what windowing system you are using, there are different choices and they are not all free, or there is significant configuration. We didn't have so much problem using Microsoft API's for building our UI.