Microsoft is announcing plans to make changes to Windows that will help CrowdStrike and other security vendors operate outside of the Windows kernel. The announcement stems from a Microsoft-hosted security summit<\/a> earlier this week at the company\u2019s Redmond, Washington headquarters, where it discussed changes to Windows in the wake of the disastrous CrowdStrike incident in July.<\/p>\n<\/div>\n Windows kernel access has been a hot topic ever since the CrowdStrike catastrophe<\/a> took down 8.5 million Windows PCs and servers. CrowdStrike\u2019s software runs at the kernel level of Windows \u2014 the core part of an operating system that has unrestricted access to system memory and hardware. That\u2019s what allowed a faulty update to generate a Blue Screen of Death as soon as affected systems started up.<\/p>\n<\/div>\n In the months since, Microsoft has called for changes to Windows<\/a>\u00a0to improve resiliency and dropped hints about moving security vendors out of the Windows kernel to prevent this from happening again. But there\u2019s been pressure on Microsoft, from both partners and regulators, to not move unilaterally in making that change.<\/p>\n<\/div>\n Microsoft says it has<\/a> now \u201cdiscussed the requirements and key challenges in creating a new platform which can meet the needs of security vendors\u201d with partners like CrowdStrike, Broadcom, Sophos, and Trend Micro.<\/p>\n<\/div>\n \u201cBoth our customers and ecosystem partners have called on Microsoft to provide additional security capabilities outside of kernel mode which, along with safe deployment practices, can be used to create highly available security solutions,\u201d says David Weston, vice president of enterprise and OS security at Microsoft. <\/p>\n<\/div>\n Microsoft has discussed performance needs and the challenges for security vendors to operate outside of kernel mode, along with the need for anti-tampering protection for security products and security sensor requirements. \u201cAs a next step, Microsoft will continue to design and develop this new platform capability with input and collaboration from ecosystem partners to achieve the goal of enhanced reliability without sacrificing security,\u201d says Weston.<\/p>\n<\/div>\n While Microsoft isn\u2019t directly saying it\u2019s going to close off access to the Windows kernel, it\u2019s clearly at the early stages of designing a security platform that can eventually move CrowdStrike and others out of the kernel. Microsoft last tried to close off access to the Windows kernel in Windows Vista in 2006, but it was met with\u00a0pushback from cybersecurity vendors<\/a>\u00a0and regulators.<\/p>\n<\/div>\n This time around, security vendors are a lot more open to it. \u201cIt was a welcome opportunity to join industry peers in an open discussion of advancements that will serve our customers by elevating the resilience and robustness of both Microsoft Windows and the endpoint security ecosystem,\u201d says Sophos CEO Joe Levy in a statement provided by Microsoft.<\/p>\n<\/div>\n \u201cI applaud Microsoft for opening its doors to continue collaborating with leading endpoint security leaders,\u201d says Kevin Simzer, chief operating officer at Trend Micro. Even CrowdStrike, the catalyst for this entire summit, was also appreciative of Microsoft\u2019s efforts. \u201cWe appreciated the opportunity to join these important discussions with Microsoft and industry peers on how best to collaborate in building a more resilient and open Windows endpoint security ecosystem that strengthens security for our mutual customers,\u201d says Drew Bagley, vice president of privacy and cyber policy at CrowdStrike.<\/p>\n<\/div>\n Not everyone involved in the security world is happy about Microsoft\u2019s potential changes, though. \u201cRegulators need to be paying attention,\u201d said CloudFlare CEO Matthew Prince on X last month<\/a>, referencing Microsoft\u2019s Windows security summit. \u201cA world where only Microsoft can provide effective endpoint security is not a more secure world.\u201d<\/p>\n<\/div>\n Prince says<\/a> he\u2019s not concerned about Microsoft potentially locking down the Windows kernel, but more that the company could lock it down \u201cfor everyone else\u201d while still giving its own offering \u201cprivileged access.\u201d Microsoft also invited government officials from the US and Europe to its security summit, because it\u2019s clearly aware of concerns like Prince\u2019s.<\/p>\n<\/div>\n The summit comes right in the middle of a broader cybersecurity overhaul inside Microsoft, following years of\u00a0incidents and criticisms<\/a>. Microsoft employees are now being\u00a0judged directly on their security work<\/a>, with the company tying those efforts to employee performance reviews.<\/p>\n<\/div>\n<\/div>\n