While the two biggest security firms, Symantec and McAfee, have vigorously complained about the new security features in Windows Vista (see Vista Kernel – Security Companies Whine), Microsoft has a number of firms and individuals who are defending many of the changes to security in Windows Vista.
We reported earlier this week how a previous rootkit exploit in Windows Vista had been addressed (see Vista Rootkit Exploit Blocked, PatchGuard Explained), and now Microsoft seems to have pleased at least some security experts. While Symantec and McAfee are demanding access to the kernel in order to get their products to work on Vista x64, firms like Sophos and Deepnet have found working solutions by using Microsoft’s security guidelines.
Sophos has stated that its antivirus products will include full protection against malware threats on Vista, and recently the firm commented regarding the current whining of the big two by saying "Symantec and McAfee have recently made high-profile complaints that they are being locked out of the Vista kernel. They argue that this is preventing them from continuing to develop proactive protection against new malware, sometimes referred to as 'host intrusion prevention' or 'HIPS'. CTO of Sophos, Richard Jacobs explained, We've taken a different approach, by focusing on catching bad behaviour before it has a chance to occur. Additionally, we are building our technology by making use of supported Microsoft interfaces rather than by trying to subvert them. That's why we're ready for 64bit Vista, and others aren't"
A representative from Deepnet Security was recently quoted as saying We don’t touch the kernel but we've always had full cooperation from Microsoft regarding API’s. It appears as if Symantec and McAfee may well be driving customers not towards Microsoft, but rather their own competition, who in many eyes already have a superior product.