Microsoft points finger at EU for failing to lock down Windows

A Wall Street Journal article today ended with an interesting comment from a Microsoft spokesperson regarding the security of the Windows operating system. The spokesperson, though not quoted verbatim, reportedly told the WSJ that a 2009 agreement with the European Commission is the reason Microsoft cannot further lock down its operating system to enhance security.

Following a complaint, the spokesman said, Microsoft agreed in 2009 with the European Commission to give security software vendors the same level of access to Windows that Microsoft enjoys. The move means security software vendors have a greater ability to disrupt systems, as CrowdStrike did this week, crippling 8.5 million Windows PCs worldwide. Microsoft has since come to the rescue with an automatic repair tool for affected users.

The document describing the agreement between Microsoft and the European Commission is available as a Doc file on Microsoft’s website.

The document states that Microsoft is required to make available to third-party security software vendors the APIs of its Windows Client and Server operating systems used by its security products. The document also specifies that Microsoft must document the APIs on the Microsoft Developer Network, unless they create security risks.

Giving security software vendors access to these APIs, while beneficial for level playing field, which was what the EU was concerned about, is not good for security, as we saw this week when CrowdStrike took very important machines offline, causing chaos around the world.

Ironically, while the EU has been trying to level the playing field, Apple and Google, which make macOS and ChromeOS, aren’t subject to the same restrictions… yet. According to the WSJ, Apple told developers in 2020 that its operating system would no longer give them access to the kernel level. While the change forced developers to modify their software, it also reduced the risk of problems.

The European Union has in recent years stepped up measures to combat anticompetitive behavior by big tech companies, so it is unlikely to take a path that would allow Microsoft to further lock down Windows, despite the benefits that would offer.

Source: The Wall Street Journal