Feeds

Share the Vista vision, Microsoft tells security rivals

Build it like you mean it

Top 5 reasons to deploy VMware with Tegile

Microsoft has called on security software firms to provide more than just "basic" products for Windows Vista.

Partners must deliver more than "baseline" protection and support for Windows Vista's new security architecture to address future threats to computers, it says.

Its cry comes in response to a barrage of complaints from security software vendors, such as Symantec and McAfee, which slam Microsoft for taking "unnecessary security risks" and for potentially damaging the industry by releasing Windows Vista.

In an open letter published in the Financial Times, McAfee chief executive George Samenuk said Microsoft has "shut off" independent access to the Windows Vista kernel.

His comments follow claims from Symantec that Microsoft had withheld information about APIs for the Windows Defender anti-spyware product. Last week, Symantec representatives, with one eye to European Commission anti-trust officials, briefed the press in Brussels over its concerns. This was good timing on Symantec's part as it coincided with the commission's decision to widen its investigation into Vista's encryption and handwriting technology.

In August, Symantec highlighted problems with PatchGuard, software from Microsoft designed to thwart hackers by preventing the execution of unassigned kernel-level code, and so helping to stop denial of service attacks.

By blocking kernel extensions PatchGuard also denies security firms anything other than temporary access to the kernel. "These new technologies, along with Microsoft's unwillingness to make compromises in this area have serious implications for the security industry as a whole," Oliver Friedrichs, director of emerging technologies in the Symantec security response team, blogged.

Microsoft first floated the idea of a hardened kernel when Windows Vista was still a glint in Bill Gates's jeans. Unpopular then, security vendors were being forced to work through Palladium, the Digital Rights Management (DRM) technology subsequently renamed Next Generation Secure Computing Base (NGSCB).

Picking up the Windows Vista baton, Samenuk wrote in his FT letter: "Microsoft is embracing the flawed logic that computers will be more secure if it stops cooperating with the independent security firms. For the first time, Microsoft shut off security providers' access to the core of its operating system.

"At the same time, Microsoft has firmly embedded its own Windows Security Center - a product that cannot be disabled even when the user purchases an alternative security solution. This approach results in confusion for customers and prevents genuine freedom of choice."

Microsoft says it has supplied adequate documentation and support to partners, which should continue to work with PatchGuard. "The security threat landscape has evolved and Microsoft has to continue to evolve Windows to provide a safer, more secure computing experience," the company said.

"The solutions these partners provided yesterday need to evolve to address the threats of today, tomorrow, and go beyond the baseline protection that Microsoft needs to provide to its customers through technologies like Kernel Patch Protection [PatchGuard]." ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Be real, Apple: In-app goodie grab games AREN'T FREE – EU
Cupertino stands down after Euro legal threats
Download alert: Nearly ALL top 100 Android, iOS paid apps hacked
Attack of the Clones? Yeah, but much, much scarier – report
Microsoft: Your Linux Docker containers are now OURS to command
New tool lets admins wrangle Linux apps from Windows
Bada-Bing! Mozilla flips Firefox to YAHOO! for search
Microsoft system will be the default for browser in US until 2020
Facebook, working on Facebook at Work, works on Facebook. At Work
You don't want your cat or drunk pics at the office
Soz, web devs: Google snatches its Wallet off the table
Killing off web service in 3 months... but app-happy bonkers are fine
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.