Microsoft Eyes New Windows Security Layer To Prevent CrowdStrike Repeat

To prevent another CrowdStrike update fiasco, Microsoft is looking at creating a new platform within the Windows OS specifically designed for antivirus monitoring, nudging security products out of kernel.

The platform is what Microsoft discussed with the antivirus industry during a summit earlier this week on Sept. 10. The event was closed off to journalists, but the company on Thursday decided to share some of the results, which included exploring “new platform capabilities Microsoft plans to make available in Windows.”

“Although this was not a decision-making meeting, we believe in the importance of transparency and community engagement,” Redmond added in the blog post.

The company held the summit in response to July’s infamous Windows outage, which the IT security vendor CrowdStrike accidentally caused through a faulty software update. One reason why the update temporarily bricked millions of computers is because CrowdStrike’s software —like many antivirus programs— has access to the Windows kernel, the essential brains to the operating system.
(Photo by Harun Ozalp/Anadolu via Getty Images)

Antivirus programs will harness the kernel privileges to monitor malicious changes to the deepest parts of the OS. But the same access also acts as a double-edge sword if the antivirus software ever malfunctions. In CrowdStrike’s case, a fault in the company’s validation processes let a buggy update slip through, triggering its security software to crash Windows machines.

The outage initially caused Microsoft to consider revoking the kernel access, potentially turning Windows into a more closed operating system akin to Apple’s macOS. But in Thursday’s blog post discussing the results of the Sept. 10th summit, the company stopped short of clamping down on the Windows kernel.

Instead, Microsoft mentioned how both customers and partners have called on the company to “provide additional security capabilities outside of kernel mode,” which antivirus software can also harness to provide protection.

“At the summit, Microsoft and partners discussed the requirements and key challenges in creating a new platform which can meet the needs of security vendors,” the company said. The areas discussed include the “performance needs and challenges outside of kernel mode,” providing an anti-tampering mechanism for security programs and the “security sensor requirements” for the antivirus monitoring.

Redmond didn’t offer more details to the security layer, which it describes as a longer-term project. But the company added: “As a next step, Microsoft will continue to design and develop this new platform capability with input and collaboration from ecosystem partners to achieve the goal of enhanced reliability without sacrificing security.”

In the same post, Microsoft noted that attendees of the summit all agreed that security vendors and customers “benefit when there are options for Windows and choices in security products.”

:story: PCMag