Cyber Spaces: PatchGuard and Windows security circus

While some oversight is needed, we have to let Microsoft do its job

Here's a metaphor for the future of Windows security: Microsoft and the industry are two acrobats on a tightrope with no net. The trick is to meet in the middle, shake hands and manoeuvre around each other.

PatchGuard, a feature that causes 64-bit Windows versions of Vista to blue-screen if the kernel code is modified unexpectedly, is the first of possibly many flashpoints as Microsoft adds new security features to its product line. Also called kernel patch protection, PatchGuard may stop some attack programs from infecting a system by embedding themselves in the kernel. However, PatchGuard also gets in the way of security vendors that "hook the kernel" to ensure their routines are called at the right times to monitor the system for unauthorized activity.

At first glance, PatchGuard seems like a desirable feature. It doesn't cost anything, and none of us wants malware messing with our kernels. Nor does hooking the kernel do much for system stability. Unfortunately, vulnerability researchers have demonstrated PatchGuard isn't a silver bullet and Vista isn't bullet-proof. Much as we don't want to pay security taxes to independent software vendors (ISV), we still need them.

Microsoft must protect the operating system, but it should not deny customers a choice of security products. And given that Microsoft is competing with ISVs by selling its own Live OneCare antivirus package, it would be difficult for the company to be completely even-handed with PatchGuard, Windows Security Center and all the features that integrate security with the operating system.

Fortunately, European Union regulators assumed an oversight role, demanding even-handedness to protect customer choice. Bowing to the inevitable, Microsoft has initiated talks on PatchGuard with ISVs and now says 95 percent of ISV requirements boil down to three issues: monitoring/controlling process and thread launching; protecting the ISVs' programs from malware; and monitoring/controlling cross-process memory manipulation.

Microsoft says it is working to complete a new design in 90 days and will ship new application program interfaces (API) for security ISVs with Vista Service Pack 1. With these APIs, most host intrusion-prevention systems and other types of products should be able to protect systems without having to hook the kernel.

Microsoft is manoeuvring well on the tightrope, but how about the industry?

PatchGuard may be only the first of many security-vs.-compatibility issues as Vista, User Account Control, Longhorn, Forefront and other Microsoft offerings roll out. Will Microsoft engineers have to jump through hoops or disable security features each time an ISV howls in protest? I hope not, because there are enough loopholes in Vista with ActiveX still enabled and all the vagaries that millions of lines of code can bring. The industry has demanded that Microsoft improve security, and while some oversight is needed, we have to let the company do its job. If it doesn't, the tigers -- er, hackers -- are waiting in the ring below.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Daniel Blum

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?