Feeds

Share the Vista vision, Microsoft tells security rivals

Build it like you mean it

Beginner's guide to SSL certificates

Microsoft has called on security software firms to provide more than just "basic" products for Windows Vista.

Partners must deliver more than "baseline" protection and support for Windows Vista's new security architecture to address future threats to computers, it says.

Its cry comes in response to a barrage of complaints from security software vendors, such as Symantec and McAfee, which slam Microsoft for taking "unnecessary security risks" and for potentially damaging the industry by releasing Windows Vista.

In an open letter published in the Financial Times, McAfee chief executive George Samenuk said Microsoft has "shut off" independent access to the Windows Vista kernel.

His comments follow claims from Symantec that Microsoft had withheld information about APIs for the Windows Defender anti-spyware product. Last week, Symantec representatives, with one eye to European Commission anti-trust officials, briefed the press in Brussels over its concerns. This was good timing on Symantec's part as it coincided with the commission's decision to widen its investigation into Vista's encryption and handwriting technology.

In August, Symantec highlighted problems with PatchGuard, software from Microsoft designed to thwart hackers by preventing the execution of unassigned kernel-level code, and so helping to stop denial of service attacks.

By blocking kernel extensions PatchGuard also denies security firms anything other than temporary access to the kernel. "These new technologies, along with Microsoft's unwillingness to make compromises in this area have serious implications for the security industry as a whole," Oliver Friedrichs, director of emerging technologies in the Symantec security response team, blogged.

Microsoft first floated the idea of a hardened kernel when Windows Vista was still a glint in Bill Gates's jeans. Unpopular then, security vendors were being forced to work through Palladium, the Digital Rights Management (DRM) technology subsequently renamed Next Generation Secure Computing Base (NGSCB).

Picking up the Windows Vista baton, Samenuk wrote in his FT letter: "Microsoft is embracing the flawed logic that computers will be more secure if it stops cooperating with the independent security firms. For the first time, Microsoft shut off security providers' access to the core of its operating system.

"At the same time, Microsoft has firmly embedded its own Windows Security Center - a product that cannot be disabled even when the user purchases an alternative security solution. This approach results in confusion for customers and prevents genuine freedom of choice."

Microsoft says it has supplied adequate documentation and support to partners, which should continue to work with PatchGuard. "The security threat landscape has evolved and Microsoft has to continue to evolve Windows to provide a safer, more secure computing experience," the company said.

"The solutions these partners provided yesterday need to evolve to address the threats of today, tomorrow, and go beyond the baseline protection that Microsoft needs to provide to its customers through technologies like Kernel Patch Protection [PatchGuard]." ®

Beginner's guide to SSL certificates

More from The Register

next story
Preview redux: Microsoft ships new Windows 10 build with 7,000 changes
Latest bleeding-edge bits borrow Action Center from Windows Phone
Google opens Inbox – email for people too thick to handle email
Print this article out and give it to someone tech-y if you get stuck
Microsoft promises Windows 10 will mean two-factor auth for all
Sneak peek at security features Redmond's baking into new OS
UNIX greybeards threaten Debian fork over systemd plan
'Veteran Unix Admins' fear desktop emphasis is betraying open source
Entity Framework goes 'code first' as Microsoft pulls visual design tool
Visual Studio database diagramming's out the window
Google+ goes TITSUP. But WHO knew? How long? Anyone ... Hello ...
Wobbly Gmail, Contacts, Calendar on the other hand ...
DEATH by PowerPoint: Microsoft warns of 0-day attack hidden in slides
Might put out patch in update, might chuck it out sooner
Redmond top man Satya Nadella: 'Microsoft LOVES Linux'
Open-source 'love' fairly runneth over at cloud event
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.