In the wake of the notorious Windows outage last July, which was triggered by a faulty crowd-sourced update from CrowdStrike, Microsoft is taking significant steps to reshape its approach to security tool integration. This operational shift aims to ensure that these tools can run in a more stable environment, away from the fragile and critical kernel layer of Windows.
By enabling these tools to run in user mode, akin to regular applications, Microsoft aims to significantly reduce the risks associated with kernel-level access. Weston illustrated this strategic pivot by stating that this new capacity promises “easier recovery” and mitigated risks in the event of crashes, wrapping a shiny bow on a long-standing problem.
While many may view the shift as a dramatic overreaction to one massive outage, it represents a necessary evolution in safeguarding user experiences. The industry has long required alternatives to kernel-level access for security applications—after all, the stakes are high when millions of systems are suddenly left vulnerable.
As we await these changes, it’s evident that Microsoft is not only hoping to patch up past mishaps but is also diligently future-proofing Windows against potential pitfalls. We'll have to keep an eye on how this ongoing development unfolds.
For the time being, Windows users are left in anticipation of these features that aim to fundamentally bolster the reliability and security of their operating system. In the words of David Weston, “It’s time for a change,” and change, as we know, often brings about exciting new prospects for users and developers alike.
Source: CRN Microsoft Exec: Windows Will Enable Security Tools To Run ‘Outside Of Kernel Mode’
A Game-Changer For Security Tools
David Weston, the vice president of enterprise and OS security at Microsoft, recently announced that upcoming features will allow security products to operate outside of kernel mode. This is a notable departure from traditional practices, where security applications often required deep access to the Windows kernel—the heart and brain of the operating system. The kernel’s fundamental role makes it a high-stakes environment; any instability can lead to catastrophic failures, as seen during last summer's infamous "blue screen of death" incident, where over 8.5 million devices were affected.Why Does Kernel Access Matter?
The kernel is the core of the operating system, responsible for handing out resources and facilitating interaction between hardware and software. It operates at a privileged level, allowing applications to execute critical functions. However, such access comes with risks. When CrowdStrike’s Falcon update went awry, it exploited this access, causing mass disruptions across devices, highlighting a desperate need for change in how security applications interact with the kernel.By enabling these tools to run in user mode, akin to regular applications, Microsoft aims to significantly reduce the risks associated with kernel-level access. Weston illustrated this strategic pivot by stating that this new capacity promises “easier recovery” and mitigated risks in the event of crashes, wrapping a shiny bow on a long-standing problem.
New Features on the Horizon
While this transition could drastically improve system stability, users and IT administrators will need to be patient. The new capabilities are poised for a private preview rollout in July 2025. The implications of these changes are multifaceted:- Reduced Impact on the OS: Security tools will have the flexibility to operate without putting the operating system at risk of serious failure.
- Swift Recovery Mechanisms: With the anticipated Quick Machine Recovery feature, administrators will be equipped to implement targeted fixes via Windows Update, even on systems that won’t boot—without needing to physically access the machine. This capability, this “magic wand” for IT professionals, is set to arrive in early 2025 as part of the Windows Insider Program.
Collaborative Efforts With Industry Leaders
This announcement follows Microsoft's endpoint security summit, where top security vendors, including CrowdStrike, discussed future strategies. The gathering emphasized Microsoft’s commitment not only to improving internal processes but also to fostering collaborative discussions with key industry players. Sophos CEO Joe Levy indicated a hopeful sentiment towards evolving safety protocols within the endpoint security ecosystem, underlining the industry’s collective responsibility in enhancing cybersecurity measures.Concluding Thoughts: A Balanced Perspective
As Microsoft prepares for these crucial updates, one can’t help but wonder about the broader industry implications. Will this move alter how security products are developed? Will vendors now rethink their strategies in light of this upcoming architectural shift?While many may view the shift as a dramatic overreaction to one massive outage, it represents a necessary evolution in safeguarding user experiences. The industry has long required alternatives to kernel-level access for security applications—after all, the stakes are high when millions of systems are suddenly left vulnerable.
As we await these changes, it’s evident that Microsoft is not only hoping to patch up past mishaps but is also diligently future-proofing Windows against potential pitfalls. We'll have to keep an eye on how this ongoing development unfolds.
For the time being, Windows users are left in anticipation of these features that aim to fundamentally bolster the reliability and security of their operating system. In the words of David Weston, “It’s time for a change,” and change, as we know, often brings about exciting new prospects for users and developers alike.
Source: CRN Microsoft Exec: Windows Will Enable Security Tools To Run ‘Outside Of Kernel Mode’
