Here’s a metaphor for the future of Windows security: Microsoft and the industry are two acrobats on a tightrope with no net. The trick is to meet in the middle, shake hands and maneuver around each other.
PatchGuard, a feature that causes 64-bit Windows versions of Vista to blue-screen if the kernel code is modified unexpectedly, is the first of possibly many flashpoints as Microsoft adds new security features to its product line. Also called kernel patch protection, PatchGuard may stop some attack programs from infecting a system by embedding themselves in the kernel. However, PatchGuard also gets in the way of security vendors that “hook the kernel” to ensure their routines are called at the right times to monitor the system for unauthorized activity.
At first glance, PatchGuard seems like a desirable feature.Unfortunately, vulnerability researchers have demonstrated PatchGuard isn’t a silver bullet and Vista isn’t bulletproof. Microsoft must protect the operating system, but it should not deny customers a choice of security products. And given that Microsoft is competing with ISVs by selling its own Live OneCare antivirus package, it would be difficult for the company to be completely even-handed with PatchGuard, Windows Security Center and all the features that integrate security with the operating system.
Fortunately, European Union regulators assumed an oversight role, demanding even-handedness to protect customer choice. Bowing to the inevitable, Microsoft has initiated talks on PatchGuard with ISVs and now says 95 per cent of ISV requirements boil down to three issues: monitoring/controlling process and thread launching; protecting the ISVs’ programs from malware; and monitoring/controlling cross-process memory manipulation.
Microsoft says it is working to complete a new design in 90 days and will ship new application program interfaces (API) for security ISVs with Vista Service Pack 1. With these APIs, most host intrusion-prevention systems and other types of products should be able to protect systems without having to hook the kernel.
Microsoft is maneuvering well on the tightrope, but how about the industry?
PatchGuard may be only the first of many security-vs.-compatibility issues as Vista, User Account Control, Longhorn, Forefront and other Microsoft offerings roll out.
The industry has demanded that Microsoft improve security, and while some oversight is needed, we have to let the company do its job. If it doesn’t, the tigers — er, hackers — are waiting in the ring below.
QuickLink: 063306
