Securing Windows Server 2003

Driver Signing

Device drivers represent a significant security vulnerability, because drivers run in a very privileged, powerful level of the Windows operating system. Poorly written drivers are behind most operating system crashes. Drivers can be infected with viruses as easily as other software and can do much more damage than regular software because of the driver’s privileged relationship with the operating system.

Microsoft provides a special software signing program for device drivers. Device driver authors can submit their drivers to Microsoft, which tests the drivers for operating system compatibility and overall software integrity. Microsoft then applies its own digital signature to the driver, assuring recipients that the driver is compatible and has not been altered since it was tested.

You can configure your computers to reject any device drivers that do not contain a Microsoft digital signature. This is a powerful feature that may help reject a significant number of malicious or poorly written device drivers before they’re installed.

Configuring Driver Signing

We’ll now take a look at how to put security measures in place that restrict the use of unsigned drivers. This can help both stabilize your environment and increase security. We’ll look at these configuration changes exclusively from a security perspective, but you should remember that there may be other benefits to these configuration changes.

Example: Warning When Installing Unsigned Drivers

David Loudon has a laptop ...