Microsoft’s Windows Resiliency Initiative against incidents like CrowdStrike

Microsoft has announced a new initiative called the Windows Resiliency Initiative, which is designed to improve the security and stability of the Windows operating system after the CrowdStrike incident in July that affected millions of devices. The initiative includes a number of key changes that will make it easier to recover from similar outages.

Microsoft has developed a new Quick Machine Recovery feature that will allow IT administrators to remotely patch computers even if they cannot start correctly. This will be possible thanks to improvements made to the Windows Recovery Environment (Windows RE).

David Weston, Microsoft's vice president of enterprise and OS security, told The Verge that in the future, the company will be able to use Windows Update to push an update to Windows RE that will remove the problematic file. If there's a common issue that needs to be addressed across multiple customers, Windows RE will allow that to be done in a centralized location.

In addition, Microsoft works with partners in the Microsoft Virus Initiative (MVI) to ensure that antivirus software works outside the OS kernel. The problem with CrowdStrike was that their software ran at the Windows kernel level, with full access to system memory and hardware. An incorrect update resulted in a "blue screen of death" during the OS startup process.

Finally, Microsoft is gradually moving from C++ to Rust when developing Windows components, which will significantly improve the security of the operating system by reducing risks associated with memory management.

Source