Security firms wait for Microsoft's PatchGuard response

18.10.2006
Despite its public statements, Microsoft Corp. so far has not given security vendors any specifics on its plans to release code that will allow them to work around a kernel protection technology called PatchGuard in the upcoming Vista operating system.

Even if Microsoft eventually releases such code, it's likely to be too little too late, according to executives at several computer security companies.

The issue is important for enterprises because many relatively advanced functions that are available in third-party security products are likely to be crippled in a 64-bit Vista environment unless the issue is resolved or vendors find a way to bypass PatchGuard.

PatchGuard has been at the center of a simmering dispute between Microsoft and several security vendors, most notably Symantec Corp. and McAfee Inc. Microsoft maintains that PatchGuard would increase operating system reliability by protecting the Vista kernel from unauthorized modification by third parties, including security vendors and malicious attackers.

But vendors such as Symantec and McAfee argue that PatchGuard would prevent them from delivering certain key functions in their products. This includes capabilities such as behavior-based virus detection, host-based intrusion prevention and software tamper protection, all of which work by making modifications to the operating system kernel.

Last week, in an apparent bid to assuage broader antitrust concerns related to Vista in the European Union, Microsoft announced that it would make security application programming interfaces (API) available that would let vendors get around PatchGuard.