Microsoft starts developing tools to prevent another global IT outage
Add Axios as your preferred source to
see more of our stories on Google.
Illustration: Annelise Capossela/Axios
Microsoft is creating new capabilities that will let security vendors operate outside of the root of Windows operating systems.
Why it matters: The changes should help safeguard against a repeat of the global CrowdStrike outage in July — which bricked roughly 8.5 million Windows devices.
Driving the news: Microsoft hosted a cybersecurity summit Tuesday with government representatives and other security vendors at its Redmond, Washington, headquarters.
- During the event, participants looked at "longer-term steps" Microsoft could take to ensure network resilience and safeguard cybersecurity, according to a blog post published Thursday.
Zoom in: David Weston, Microsoft's vice president of enterprise and operating system security, wrote in the blog post that many of the company's ecosystem partners asked Microsoft to design new tools that would help them operate away from the Windows kernel.
- Broadcom, CrowdStrike, ESET, SentinelOne, Sophos, Trend Micro and Trellix all participated in the summit.
- Weston said Microsoft is now developing tools that should help vendors follow certain secure-by-design principles, provide anti-tampering protections, and meet performance needs outside of the kernel.
Between the lines: Part of the reason the CrowdStrike incident was so detrimental was that the faulty content update was sent straight to the Windows kernel, which manages the operating system's memory, processing power and more.
- Security vendors will often push data to the kernel level to free up space in their own products' storage and help the security tools run faster.
- Microsoft has said certain European Union interoperability rules require it to provide this level of access.
What's next: Microsoft did not provide a timeline for the new security features, but it said it plans to collect feedback from vendors as it develops these tools.
