Microsoft to review Windows kernel access policy after massive outage

After a major IT outage caused by the CrowdStrike driver, Microsoft is considering restricting third-party antivirus software's access to the core of the Windows operating system. This is reported by The Verge.

The kernel of the operating system is its central part, which gives software unlimited access to system memory and hardware. Such an opportunity allows effective detection of threats, but at the same time becomes the cause of serious IT failures. This is exactly what happened with the CrowdStrike driver, which caused a massive system crash.

Microsoft already tried to limit access to the kernel in 2006 with the release of Windows Vista, but faced strong resistance from antivirus software developers and EU regulators. Meanwhile, Apple successfully implemented kernel access restrictions in its macOS operating system in 2020.

Microsoft's vice president of program management for Windows maintenance and delivery, John Cable, said the CrowdStrike incident revealed the need for changes to make Windows more resilient to failures. While details of future improvements have yet to be released, Cable pointed to the new VBS enclaves feature and the Azure Attestation service as potential solutions to strengthen the system's security.

"These examples use modern Zero Trust approaches and show what can be done to encourage development practices that do not rely on access to the kernel," Cable emphasized.

Therefore, Microsoft may revise its policy regarding access to the Windows kernel, trying to find a balance between security and system functionality. While full kernel isolation like Apple's may not be possible, the company is committed to making changes that will reduce risks and increase the overall reliability of the operating system.

These steps indicate Microsoft's desire to increase the security level of its products, taking into account modern cyber security challenges and the need to protect users from potential threats. The company continues to work on innovations to ensure the maximum resistance of its systems to external influences and failures.