While Windows 10 hasn't been officially released, a security expert of the Slovakian antivirus company ESET warns companies and end-users that Microsoft's patch policy for the new operating system leaves the door wide open for zero-day attacks.
Starting with Windows 10, Microsoft will release updates on a different way. There will be a Long Term Servicing (LTS) branch for companies and important systems. Systems running this version will only receive security updates and no new features. Another branch is "Current Branch for Business". Computers running this version will receive feature-updates that have been extensively tested and validated in the consumer market.
This way systems can be upgraded with a big certainty but only for new features. Security updates will continue to be released straight away to these systems. The last branch is the consumer branch which will receive both security updates and new features immediately. According to expert Aryeh Goretsky it's useful to divide Windows users in different groups to tests patches. He suspects that patches released to consumers that don't work well will be fixed before they're distributed to the other branches.
This method also has disadvantages, according to the expert. Consumers and organisations that don't run the enterprise version of Windows 10 will likely receive less tested patches potentially resulting in crashing systems. Companies, on the other hand, will have to wait till Microsoft considers patches properly and sufficiently rested before they receive them.
Goretsky states he has to wait and see how the new patch policy in Windows 10 will work out and adds, "if the delay in enterprise updates results in the attack surface increasing, you may be better off staying on an older enterprise version of Windows that receives updates sooner than Windows 10's enterprise version."
Also Universal apps, which share code across different devices and introduced in Windows 10, could mean one vulnerability could make the same software vulnerable on all devices on where it runs.
