Cyber Spaces: PatchGuard and Windows security circus

While some oversight is needed, we have to let Microsoft do its job

Here's a metaphor for the future of Windows security: Microsoft and the industry are two acrobats on a tightrope with no net. The trick is to meet in the middle, shake hands and manoeuvre around each other.

PatchGuard, a feature that causes 64-bit Windows versions of Vista to blue-screen if the kernel code is modified unexpectedly, is the first of possibly many flashpoints as Microsoft adds new security features to its product line. Also called kernel patch protection, PatchGuard may stop some attack programs from infecting a system by embedding themselves in the kernel. However, PatchGuard also gets in the way of security vendors that "hook the kernel" to ensure their routines are called at the right times to monitor the system for unauthorized activity.

At first glance, PatchGuard seems like a desirable feature. It doesn't cost anything, and none of us wants malware messing with our kernels. Nor does hooking the kernel do much for system stability. Unfortunately, vulnerability researchers have demonstrated PatchGuard isn't a silver bullet and Vista isn't bullet-proof. Much as we don't want to pay security taxes to independent software vendors (ISV), we still need them.

Microsoft must protect the operating system, but it should not deny customers a choice of security products. And given that Microsoft is competing with ISVs by selling its own Live OneCare antivirus package, it would be difficult for the company to be completely even-handed with PatchGuard, Windows Security Center and all the features that integrate security with the operating system.

Fortunately, European Union regulators assumed an oversight role, demanding even-handedness to protect customer choice. Bowing to the inevitable, Microsoft has initiated talks on PatchGuard with ISVs and now says 95 percent of ISV requirements boil down to three issues: monitoring/controlling process and thread launching; protecting the ISVs' programs from malware; and monitoring/controlling cross-process memory manipulation.

Microsoft says it is working to complete a new design in 90 days and will ship new application program interfaces (API) for security ISVs with Vista Service Pack 1. With these APIs, most host intrusion-prevention systems and other types of products should be able to protect systems without having to hook the kernel.

Microsoft is manoeuvring well on the tightrope, but how about the industry?

PatchGuard may be only the first of many security-vs.-compatibility issues as Vista, User Account Control, Longhorn, Forefront and other Microsoft offerings roll out. Will Microsoft engineers have to jump through hoops or disable security features each time an ISV howls in protest? I hope not, because there are enough loopholes in Vista with ActiveX still enabled and all the vagaries that millions of lines of code can bring. The industry has demanded that Microsoft improve security, and while some oversight is needed, we have to let the company do its job. If it doesn't, the tigers -- er, hackers -- are waiting in the ring below.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Daniel Blum

Network World
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?