Microsoft pans Chrome, Firefox security

"Design one better," Microsoft tells potential critics of browser test

Microsoft today launched a website that cranks out security scores for the various editions of its own Internet Explorer (IE) as well as browsers built by rivals Google and Mozilla.

The new site -- -- runs a browser through a security feature checklist, then posts a score out of a possible high of four points.

Not surprisingly, Internet Explorer 9 (IE9) comes out on top with a perfect score of 4 out of 4. The older IE8, which debuted in 2009, garnered a 3.

Google's Chrome 14 -- the current "stable" build that launched last month -- kicked back a second-place score of 2.5 out of 4.

Another month-old browser, Mozilla's Firefox 7, generated a ranking of just 2.

And Opera Software's Opera and Apple's Safari -- the two remaining browsers of the top five -- weren't even competitive enough in Microsoft's eyes to warrant a score. Both simply displayed the message "We can't give you a score for your browser."

The new site and its scoring exam are meant to illustrate the insecurity of older browsers, said Microsoft -- its decade-old IE6, an application Microsoft has not been shy about wanting to kill, scored 0 out of a possible 4 -- as well as the prevalence of Web-based threats that try to trick users into making poor decisions.

"Browsers that provide better protection against the most common threats -- such as socially engineered malware -- will receive a higher score," said Roger Capriotti, Microsoft's chief IE marketing executive, in a Tuesday blog.

Microsoft has touted the malware-blocking abilities of IE8 and the newer IE9 for some time, regularly citing studies done by NSS Labs -- some paid for by Microsoft, some not -- that recently announced IE9 stymied 99.2% of all malicious links and Web-hosted malware it faced.

Capriotti also referenced Microsoft's latest Security Intelligence Report, which downplayed the threat posed by "zero-day" vulnerabilities in lieu of their small part in the overall threat theater.

"The biggest threats stem from clever 'socially engineered' malware targeting outdated software, such as older Web browsers," said Capriotti.

Microsoft's two-year-old IE8 scored better on the company's security test than newer browsers from either Google or Mozilla.

According to Microsoft, the company worked up the scoring methodology -- which it published in full on its site ( download PDF ) -- in conjunction with unnamed security researchers and several organizations, including the Anti-Phishing Working Group (APWG), Identity Theft Council and Online Trust Alliance.

Microsoft is a premium member of APWG and on the steering committee of Online Trust Alliance.

Both Capriotti in his blog and Microsoft in the description of the site's scoring methodology anticipated disagreement about the test. "Security scores like this are often the subject of much scrutiny, and there is certainly no single test that can perfectly summarize all aspects of browser security," said Capriotti.

The company went further in its methodology document. "If you still consider the security score to be arbitrary, we encourage you to design one better," said Microsoft.

Google and Mozilla did not immediately reply to requests for comment on Microsoft's test and their browsers' scores.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg's RSS feed . His e-mail address is .

See more articles by Gregg Keizer .

Read more about browsers in Computerworld's Browsers Topic Center.

Join the CSO newsletter!

Error: Please check your email address.

Tags applicationsGoogleopera softwareMicrosoftsecuritybrowserssoftwareinternetmozillaApple

More about AppleGoogleMicrosoftMozillaOpera SoftwareTopic

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Gregg Keizer

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place