The tech titan Microsoft is marching forward with the public preview of ‘Win32 app isolation’, a novel security feature specially designed for Windows 11. This feature focuses on safeguarding 32-bit desktop applications through a sandboxing method.
Mitigating risks with Win32 app isolation
This feature was unveiled during the recent Build 2023 conference organized by Microsoft. Win32 app isolation is built upon the principle of AppContainer to enhance security. Its main objective is to reduce the potential threats posed by compromised applications, thereby upholding user privacy.
Moreover, it functions by operating applications at a low privilege level and adheres to the principle of least privilege. This approach prevents unauthorized access to user information without proper consent.
Behind the scenes: How it works
Microsoft’s VP for Enterprise & OS Security, David Weston, explains that the Win32 application is run as a low integrity process utilizing AppContainer. This is viewed as a security boundary by Microsoft.
As a result, the process is only allowed a specific set of Windows APIs by default and is restricted from injecting code into any other process operating at a higher integrity level.
Shiftdelete.netIf an application vulnerability is exploited, the AppContainer execution environment makes sure the Win32 app stays within its allocated resources. This restricts malicious apps from taking over the entire system and provides an additional shield against potential compromise attempts.
Empowering developers: Tools for stronger security
Microsoft offers tools for application developers to strengthen their Win32 apps by implementing isolation measures. By doing this, developers can reinforce the security of their software, and the devices it operates on, by minimizing the system’s attack surface.
Developers seeking comprehensive guidance on Win32 app isolation can refer to a GitHub page, created by Microsoft, packed with useful information on getting started and repackaging MSIX applications for isolated operation.
Building on existing security features
David Weston further adds that the Win32 app isolation feature is an extension of existing Windows sandbox options, such as Windows Sandbox and Microsoft Defender Application Guard.
These options rely on virtualization-based security. However, Win32 app isolation is founded on the principles of AppContainers and more. AppContainers are designed specifically to encapsulate and restrict process execution, ensuring they operate at limited privileges, often referred to as low integrity levels.
We invite you, our valued readers, to share your thoughts on this new security feature for Windows 11. Do you think Win32 app isolation will significantly improve security for 32-bit desktop applications? Please share your insights in the comments section below!
