WHITE PAPERS SPONSORED PROFILES JOB BOARD WEBINAR CENTER FREE SOFTWARE BZ RESEARCH ALMSHAREPOINT EVENTS CALENDAR PRINT/PDF EDITION PRINT/PDF BACK ISSUES

SUBSCRIBE TODAY CUSTOMER SERVICE EDITORIAL CALENDAR EDITORIAL BEATS GUEST VIEW GUIDE SD TIMES 100 GUIDE EVENTS CALENDAR ADVERTISING ARTICLE REPRINTS REPORT A BUG SITE MAP

ABOUT US BZ MEDIA NEWS BZ RESEARCH NEWS ON MONDAY SPTECHREPORT SPTECHWEB SPTECHCON IPHONE/IPAD DEVCON ANDROID DEVCON PRIVACY POLICY CONTACT US

HOME >> LATEST NEWS

Microsoft's Midori to sandbox apps for increased security

By David Worthington

August 5, 2008 — (Page 1 of 2)
Security is a watchword for Midori, the operating system that Microsoft is incubating in hopes of freeing itself from its legacy Windows software architecture.

SD Times has viewed internal Microsoft documents that detail Midori’s security proposition. The highlights include memory safety and type safety, and a least-privileged mode. As well, hardware support may enable a secure boot mechanism and a remote chain of trust on top of secure booting.

For additional coverage on Midori, read "Microsoft maps out migration from Windows" and "Microsoft's plans for post-Windows OS revealed."

Midori’s memory safety and type safety features will eliminate the potential for buffer overruns, perform heap deletes more frequently to avoid stack and heap corruption, and possibly offer some guarantees around fine-grained locking to prevent data race conditions, the documents indicate.

Applications and system services in Midori will run with the least authority necessary for their purposes. A standard declarative policy will be used for configuring component isolation, elevating code privileges, evaluating code identity and managing system state.

“From a software architecture standpoint,” wrote Yankee Group program manager Andrew Jaquith in an e-mail, Midori’s approach “is a very good one. The big idea here is to enumerate, and then enshrine in policy, all of the things a program can and cannot do. By combining declarative security policies with runtime enforcement mechanisms, Midori should be able to effectively ‘sandbox’ applications in a fairly bulletproof way.”

Jaquith noted that what Microsoft is doing is a form of mandatory access control, a concept that intelligence agencies adopted many years ago.

Microsoft is trying to keep up with the Joneses, Jaquith noted, pointing out that Apple’s Mac OS X Leopard, Novell’s AppArmor (which ships with Ubuntu) and SELinux (which ships with Red Hat Enterprise Linux) all provide implementations of mandatory access control.

Another Midori design objective is to reduce the risk of cross-process elevation attacks by using application manifests and eliminating dynamic code loading, in order to regulate what execution is possible in a process.

Related Search Term(s): security, Microsoft

Pages 1 2

Share this link: http://sdt.bz/32662

Most Read Latest News Blog Resources

Branching and merging: the heart of version control
Providers hold their own views of the landscape, but the Git SCM system is drawing looks from them all

Not so fast when it comes to testing in the cloud
Developers face outsourcing, virtual lab management and mobile devices as obstacles

Microsoft pivots toward business intelligence
The goal is to make business intelligence accessible "to the masses"

From the Editors: Node.js is unruly, but that’s where the fun is
The time to get involved with Node.js is now; Hadoop is about to break its own barriers

Top five apps to manage your workload
Web applications offer new ways to track your “to-do” lists

Not so fast when it comes to testing in the cloud
Developers face outsourcing, virtual lab management and mobile devices as obstacles

Xceed releases UX-focused suite for Microsoft’s WPF
"Blendables" helps match user experiences to developer visions

Microsoft pivots toward business intelligence
The goal is to make business intelligence accessible "to the masses"

GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.

Bloomberg opens its API
Bloomberg's APIs could lead to a future standard for accessing market data.

The Hidden Costs of Software Licensing Moving beyond paper-based software licensing to more flexible, software-based licensing is a business decision. There is a growing trend tow...

Case Study: You May Need a Development Mechanic As a contractor for a major financial player in Germany, SOBEGE, a German-based consultancy specializing in embedded IT and web services, wa...

Ensuring Software Quality at a Major International Bank One of the world’s leading international banks has adopted AgitarOne technology for delivering generated unit tests for their Java software...

Load Testing Adobe Flex Applications Adobe Flex applications may be different from applications you’ve worked with before. For classic HTML web applications, the server does all...

Technorati

Digg

Slashdot

Facebook

Friendfeed

Twitter

del.icio.us

Cigital Develops Ready-to-Use Tools for Securing the Smart Grid Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan.

Microsoft focuses on security development life cycle A change from the previous ways of handling application security, Microsoft is embracing the security development life cycle in its products and launching a series of programs to let customers take part in this new security method.

Microsoft adapts SDL to agile development Changes to the SDL facilitate security testing during development, but experts warm about disruption to agile teams

Comments

09/29/2011 04:40:40 AM EST

hi.... i am arti midori is a good operating system.

Indiaarti

Add comment

Name*
Email*
Country

Comment

Cigital Develops Ready-to-Use Tools for Securing the Smart Grid
Cigital Inc. announced the release of the Guide to Developing a Cyber Security and Risk Mitigation Plan Read More...

News on Monday
more>>
SharePoint Tech Report
more>>

Download Current Issue
FEBRUARY 2012 PDF ISSUE

Need Back Issues?
DOWNLOAD HERE

Want to subscribe?

GitHire: Use Headhunters to Find Your Perfect Programmer
Are you a hiring manager tired of scouring the job boards? Check out this new service that will find 5 people interested in your jobs.
02/03/2012 12:17 PM EST

Facebook claims hacker cred
Facebook's SEC S-1 filing form includes a short essay on the Hacker Way by Mark Zuckerberg himself.
02/02/2012 08:26 AM EST

Ryan Dahl steps down
Ryan Dahl, creator of Node.js, steps back from his position as gatekeeper for the project.
02/01/2012 04:58 PM EST

Bloomberg opens its API
Bloomberg's APIs could lead to a future standard for accessing market data.
02/01/2012 04:41 PM EST

The case for piracy
In the aftermath of SOPA and PIPA, some copyright holders have begun to embrace piracy as inevitable...and even beneficial.
01/30/2012 02:39 PM EST

Tablet sales boom, but applications lag
The installed base of tablet computers and e-book readers is growing rapidly, but no killer app has yet emerged -- hint, hint.
01/28/2012 05:48 PM EST