Cyber Spaces: PatchGuard and Windows security circus

While some oversight is needed, we have to let Microsoft do its job

Here's a metaphor for the future of Windows security: Microsoft and the industry are two acrobats on a tightrope with no net. The trick is to meet in the middle, shake hands and manoeuvre around each other.

PatchGuard, a feature that causes 64-bit Windows versions of Vista to blue-screen if the kernel code is modified unexpectedly, is the first of possibly many flashpoints as Microsoft adds new security features to its product line. Also called kernel patch protection, PatchGuard may stop some attack programs from infecting a system by embedding themselves in the kernel. However, PatchGuard also gets in the way of security vendors that "hook the kernel" to ensure their routines are called at the right times to monitor the system for unauthorized activity.

At first glance, PatchGuard seems like a desirable feature. It doesn't cost anything, and none of us wants malware messing with our kernels. Nor does hooking the kernel do much for system stability. Unfortunately, vulnerability researchers have demonstrated PatchGuard isn't a silver bullet and Vista isn't bullet-proof. Much as we don't want to pay security taxes to independent software vendors (ISV), we still need them.

Microsoft must protect the operating system, but it should not deny customers a choice of security products. And given that Microsoft is competing with ISVs by selling its own Live OneCare antivirus package, it would be difficult for the company to be completely even-handed with PatchGuard, Windows Security Center and all the features that integrate security with the operating system.

Fortunately, European Union regulators assumed an oversight role, demanding even-handedness to protect customer choice. Bowing to the inevitable, Microsoft has initiated talks on PatchGuard with ISVs and now says 95 percent of ISV requirements boil down to three issues: monitoring/controlling process and thread launching; protecting the ISVs' programs from malware; and monitoring/controlling cross-process memory manipulation.

Microsoft says it is working to complete a new design in 90 days and will ship new application program interfaces (API) for security ISVs with Vista Service Pack 1. With these APIs, most host intrusion-prevention systems and other types of products should be able to protect systems without having to hook the kernel.

Microsoft is manoeuvring well on the tightrope, but how about the industry?

PatchGuard may be only the first of many security-vs.-compatibility issues as Vista, User Account Control, Longhorn, Forefront and other Microsoft offerings roll out. Will Microsoft engineers have to jump through hoops or disable security features each time an ISV howls in protest? I hope not, because there are enough loopholes in Vista with ActiveX still enabled and all the vagaries that millions of lines of code can bring. The industry has demanded that Microsoft improve security, and while some oversight is needed, we have to let the company do its job. If it doesn't, the tigers -- er, hackers -- are waiting in the ring below.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Daniel Blum

Network World
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?