Microsoft is building new Windows security features to prevent another CrowdStrike incident

Microsoft is announcing plans to make changes to Windows that will thief CrowdStrike and different information vendors run extracurricular of nan Windows kernel. The announcement stems from a Microsoft-hosted security summit earlier this week astatine nan company’s Redmond, Washington, headquarters, wherever it discussed changes to Windows successful nan aftermath of nan disastrous CrowdStrike incident successful July.

Windows kernel entree has been a basking taxable ever since nan CrowdStrike catastrophe took down 8.5 cardinal Windows PCs and servers. CrowdStrike’s package runs astatine nan kernel level of Windows — nan halfway portion of an operating strategy that has unrestricted entree to strategy representation and hardware. That’s what allowed a faulty update to make a Blue Screen of Death arsenic soon arsenic affected systems started up.

In nan months since, Microsoft has called for changes to Windows to amended resiliency and dropped hints astir moving information vendors retired of nan Windows kernel to forestall this from happening again. But there’s been unit connected Microsoft, from some partners and regulators, to not move unilaterally successful making that change.

Microsoft says it has now “discussed nan requirements and cardinal challenges successful creating a caller level which tin meet nan needs of information vendors” pinch partners for illustration CrowdStrike, Broadcom, Sophos, and Trend Micro.

“Both our customers and ecosystem partners person called connected Microsoft to supply further information capabilities extracurricular of kernel mode which, on pinch safe deployment practices, tin beryllium utilized to create highly disposable information solutions,” says David Weston, vice president of endeavor and OS information astatine Microsoft.

Microsoft has discussed capacity needs and nan challenges for information vendors to run extracurricular of kernel mode, on pinch nan request for anti-tampering protection for information products and information sensor requirements. “As a adjacent step, Microsoft will proceed to creation and create this caller level capacity pinch input and collaboration from ecosystem partners to execute nan extremity of enhanced reliability without sacrificing security,” says Weston.

While Microsoft isn’t straight saying it’s going to adjacent disconnected entree to nan Windows kernel, it’s intelligibly astatine nan early stages of designing a information level that tin yet move CrowdStrike and others retired of nan kernel. Microsoft past tried to adjacent disconnected entree to nan Windows kernel successful Windows Vista successful 2006, but it was met with pushback from cybersecurity vendors and regulators.

This clip around, information vendors are a batch much unfastened to it. “It was a invited opportunity to subordinate manufacture peers successful an unfastened chat of advancements that will service our customers by elevating nan resilience and robustness of some Microsoft Windows and nan endpoint information ecosystem,” says Sophos CEO Joe Levy successful a connection provided by Microsoft.

“I applaud Microsoft for opening its doors to proceed collaborating pinch starring endpoint information leaders,” says Kevin Simzer, main operating serviceman astatine Trend Micro. Even CrowdStrike, nan catalyst for this full summit, was appreciative of Microsoft’s efforts. “We appreciated nan opportunity to subordinate these important discussions pinch Microsoft and manufacture peers connected really champion to collaborate successful building a much resilient and unfastened Windows endpoint information ecosystem that strengthens information for our communal customers,” says Drew Bagley, vice president of privateness and cyber argumentation astatine CrowdStrike.

Not everyone progressive successful nan information world is happy astir Microsoft’s imaginable changes, though. “Regulators request to beryllium paying attention,” said Cloudflare CEO Matthew Prince on X past month, referencing Microsoft’s Windows information summit. “A world wherever only Microsoft tin supply effective endpoint information is not a much unafraid world.”

Prince says he’s not concerned astir Microsoft perchance locking down nan Windows kernel, but much that nan institution could fastener it down “for everyone else” while still giving its ain offering “privileged access.” Microsoft besides invited authorities officials from nan US and Europe to its information acme because it’s intelligibly alert of concerns for illustration nan ones Prince mentioned.

The acme comes correct successful nan mediate of a broader cybersecurity overhaul wrong of Microsoft, pursuing years of incidents and criticisms. Microsoft labor are now being judged straight connected their information work, pinch nan institution tying those efforts to worker capacity reviews.