Microsoft Boosts Device Security With Windows Resiliency Initiative

Microsoft is making sweeping changes to its Windows operating system (OS) in the wake of this past summer's flawed CrowdStrike update, which caused millions of commercial devices to crash and cost customers billions of dollars in downtime.

The incident was a major impetus for the new Windows Resiliency Initiative, introduced and outlined during a session at last week's Microsoft Ignite conference. Microsoft officials said the changes are being made based on what they learned from the July 19 event, resulting in what they promised to be a more reliable and secure OS in 2025.

David Weston, Microsoft's vice president of enterprise and OS security, identified three objectives intended to make Windows more secure: faster and simpler recovery times, more resilient drivers, and tools and changes to how the OS kernel is secured to make it "more effective and self-defending."

The changes will also affect software developers and third-party security tool providers.

"We're working together across the industry and will improve reliability, based on lessons from July, with new changes and standards in the OS," said Pavan Davuluri, corporate VP for Windows and devices at Microsoft.

The new Windows release is being designed to resist malware and script attacks with stronger controls for applications and drivers, while improved identity protection aims to prevent phishing attacks. Microsoft is also establishing a new approach to privilege access management, Davuluri said.

Microsoft will release a preview of the new release to Windows Insiders next July. It will include tighter controls over what applications and software drivers are permitted to run, stronger identity management, quick machine recovery, personal data encryption for folders, and improved OS management and configuration capabilities.

The release is poised to arrive just as Microsoft ends support for Windows 10 on Oct. 14, 2025. Although Microsoft has been encouraging customers to upgrade to Windows 11, which was released in 2021, on an ongoing basis, nearly 61% of all PCs worldwide still have Windows 10, according to Statcounter.

Enabling Security Partners to Build Outside the Kernel

Further, tied to its long-term Secure Future Initiative announced a year ago, Microsoft is moving to safer programming languages by incrementally shifting from C++ to Rust. A new Windows Resilient Security Platform will enable third-party security product developers to build their products outside of the kernel, Weston explained.

"We're ensuring this platform will enable security solution providers to have the access they need to detect and respond to threats without introducing complexity into the kernel," he said. "This change will help end-user protection and antivirus products provide a high level of security and easier recovery."

While the moves should make Windows more resilient to attacks, Forrester senior analyst Paddy Harrington would like to see Microsoft tighten access even further.

"I would much prefer it if Microsoft bit the bullet and put the walls back up. That would mean recoding for everyone who messes in the kernel driver world, including Microsoft, but it's a safer method of operation," says Harrington, who first opined on that point in a July blog post.

Post-Incident Security Summit in Redmond

Two months after the CrowdStrike incident, Microsoft hosted its Windows Endpoint Security Ecosystem Summit, in Redmond, Wash., with security vendors and representatives of the US Cybersecurity and Infrastructure Security Agency (CISA) on hand to discuss how to make the OS more resilient.

Leading into the meeting, Weston indicated that an examination of Windows crash reports signaled the need to change how kernel drivers are deployed.

"Since kernel drivers run at the most trusted level of Windows, where containment and recovery capabilities are, by nature, constrained, security vendors must carefully balance needs like visibility and tamper resistance with the risk of operating within kernel mode," Weston wrote in a July 27 post.

Following the summit, CISA last month published its Safe Software Deployment white paper, co-authored by the FBI, the Australian Signals Directorate's Australian Cyber Security Centre, and the Joint Cyber Defense Collaborative.

Omdia principal analyst Andrew Braunberg says that Microsoft is one of numerous vendors that have issued statements of support for CISA's Secure by Design pledge. However, it remains to be seen if it will follow through.

"It will be interesting to see if there is any change in behavior from Microsoft and other large software companies because of [Donald] Trump's win [of the U.S. presidential election]," Braunberg says. "These companies may reassess the external benefits of this support given a reduced, or eliminated, CISA under the new administration. There are international drivers for embracing Secure by Design principles, such as the EU Cyber Resiliency Act, but CISA has been the primary advocate in the US."

Nevertheless, Weston described CISA as playing an essential role in determining Microsoft's revamped security and resiliency standards for Windows endpoints.

"They are providing a framework for the whole IT industry to ensure that all partners, customers, and organizations are able to stay ahead of evolving security threats," he said.

Among the vendors at Microsoft's summit was CrowdStrike, which signaled it is endorsing Microsoft's Windows Resiliency Initiative.

"Microsoft's initiatives build on the discussions CrowdStrike participated in at the Windows Endpoint Security Summit in September, and we welcome innovations that enhance resiliency for our shared customers," a CrowdStrike spokesperson said. "The entire industry benefits when we collaborate to create a more resilient and open ecosystem that strengthens security for all."

Endpoint protection provider ESET is offering conditional support for Microsoft's initiative.

"In general, we support this evolution if it demonstrates measurable improvements to stability and strongly stress this must be on condition that any change must not weaken security, affect performance, or limit the choice and differentiation between cybersecurity solutions for customers," says ESET CTO Juraj Malcho.

Shifting to Trusted Apps and Drivers

Because many attacks result from users who download malicious or unsafe apps and drivers, Microsoft is adding Smart App Control and App Control for Business to Windows. These features use artificial intelligence to let administrators employ policies that require verified applications, according to Weston. He noted that Microsoft already offers this through App Locker, but it is complicated to manage.

A feature called "robust app control" will ensure that only verified apps can run, eliminating attacks from malicious attachments and socially engineered malware, he added.

Thwarting Identity-Based Attacks and Overprivileged Accounts

According to Microsoft's Entra ID data, more than 600 million identity attacks occur every day, 99% of which are password-based. In response, Microsoft has hardened its Windows Hello multifactor authentication capability, which uses biometrics. Microsoft has extended Windows Hello support for passkeys.

As part of its latest Windows Insider build, last week Microsoft released a preview of updates to its implementation of the WebAuthn APIs that will enable plug-in support for passkeys. In the coming months, Microsoft said third-party password managers will work with the native Windows passkey provider using Windows Hello. 

The new Windows release will also aim to reduce attacks resulting from users who have too many privileges and organizations that have insufficient privilege controls, which, according to Microsoft's Digital Defense report, are the cause of 93% of ransomware attacks.

A new feature called "administrator protection" will give employees standard user permissions by default "so they can still make Windows system changes, including app installation, but only when necessary and only after authorizing the change using Windows Hello," Weston said. "Admin protection will be incredibly disruptive to attackers, as they no longer have elevated privileges by default, and it will help ensure that employees do not use malware and remain in control of Windows."

According to Forrester's Harrington, the new app control approach should help organizations lock down their endpoints.

"I think there will be plenty of businesses who still go to third parties because of the flexibility those solutions bring," he says. "But this is a good move by Microsoft to breathe life back into the app control solution. For all those functions, I would have liked to see these moves earlier in the Windows 11 releases, but with Windows 10 going end-of-service next year, the timing works to give more enterprises reasons to move to Windows 11."