I’m still learning my way around Windows driver development, and I’ve noticed that security is becoming a bigger part of the conversation—even at the driver level. I’m curious how many of you actively think about or apply security best practices when writing drivers?
I’ve been exploring how to learn cybersecurity alongside my systems programming studies, but I’m not sure where to focus for low-level Windows work. Should I be looking more into secure coding practices, driver signing, kernel isolation, or something else entirely?
Also, are there any tools or test environments you’d recommend for checking a driver’s behavior from a security standpoint—maybe fuzzing or threat modeling for kernel drivers?
Would love to hear how experienced folks here balance performance, stability, and security in real-world projects. Any reading or resource suggestions (even outside Microsoft docs) would be super helpful.
I am glad that you started by telling us that you are a student and that you want to learn. You will get much better responses than simply asking for someone to do your homework
cyber security is a very large topic and it means different things to different people. In the broadest possible sense, cyber security - just like all other kinds of security - is all about making sure that people 'do the right thing' and what happens when they don't. Those who don't could err through ignorance, or might have malice, but in any case the biggest emphasis is on prevention. The second most important aspect being logging or evidence generation
When it comes to systems programming a robust security model is essential. By virtu of the collaboration with IBM on OS/2, Windows has a good security model based on security principals, ACLs and privileges - with enforcement on a single machine by the hardware between KM and UM. There are a lot more details of course; and almost all discussions of security now imply networked computers.
When it then comes to the engineering choices of systems programmers, when working in a mature environment like Windows drivers, security is almost an automatic consequence of program correctness. But mature programming environments have a lot of pitfalls for the next generation of programmers who didn't participate in the problems of the creators. That represents a significant risk to security
to your actual question, every one of those things are important to some degree. The better question is how much would you like to know about effective coding? How much do you want to know about ring levels and hardware privileged instructions? cryptography? driver signing (a very sore spot at the moment)? or testing methodology?
more smaller questions will get better answers since all of us here have day jobs
I would dispute that "security is becoming a bigger part of the conversation". Because drivers run in a privileged environment without a lot of operating system protections, security has ALWAYS been a huge part of the kernel developer's task. It's similar to multiprocessing, which was a key concern of driver developers from the beginning, LONG before it became an issue for user-mode programmers.
