Moving Beyond EMET

EMET – Then and Now EMET – Then and Now

Microsoft’s Trustworthy Computing initiative was 7 years old in 2009 when we first released the Enhanced Mitigation Experience Toolkit (EMET). Despite substantial improvements in Windows OS security during that same period, it was clear that the way we shipped Windows at the time (3-4 years between major releases) was simply too slow to respond quickly to emerging threats. Our commercial customers were particularly exposed since it often took years to deploy new OS versions in large scale environments. And thus, EMET was born as a stop-gap solution to deliver tactical mitigations against certain zero-day software vulnerabilities.

For Microsoft, EMET proved useful for a couple of reasons. First, it allowed us to interrupt and disrupt many of the common exploit kits employed by attackers at the time without waiting for the next Windows release, thus helping to protect our customers. Second, we were able to use EMET as a place to assess new features, which directly led to many security innovations in Windows 7, 8, 8.1, and 10.

But EMET has serious limits as well - precisely because it is not an integrated part of the operating system. First, many of EMET’s features were not developed as robust security solutions. As such, while they blocked techniques that exploits used in the past, they were not designed to offer real durable protection against exploits over time. Not surprisingly, one can find well-publicized, often trivial bypasses, readily available online to circumvent EMET.

Second, to accomplish its tasks, EMET hooks into low-level areas of the operating system in ways they weren’t originally designed. This has caused serious side-effects in both performance and reliability of the system and the applications running on it. And this presents an ongoing problem for customers since every OS or application update can trigger performance and reliability issues due to incompatibility with EMET.

Finally, while the OS has evolved beneath it, EMET hasn’t kept pace. While EMET 5.5x was verified to run on Windows 10, its effectiveness against modern exploit kits has not been demonstrated, especially in comparison to the many security innovations built-in to Windows 10.

Windows 10 – A New OS for a Dangerous World Windows 10 – A New OS for a Dangerous World

Not surprisingly, the top customer feedback on EMET has consistently been to build such protections directly into the operating system. But to do that, Microsoft first had to change how we shipped Windows so that customers won’t have to wait years for new protections to come online.

Beginning with Windows 10, that’s exactly what we did with the move to Windows as a Service. Since its initial launch in July 2015, there have already been two major updates released and that pace is expected to continue. More importantly, each major update of Windows 10 has brought with it substantial new innovations in security. For example, the Microsoft Edge browser was built from the start with security as a top feature_._ Revolutionary new Windows 10 features like Device Guard, Credential Guard, and Windows Defender Application Guard (coming soon) use hardware virtualization to protect against vulnerability exploits and malware. Windows Defender Advanced Threat Protection (ATP) provides post-breach detection and response for Windows 10 enterprise users. And of course, Windows 10 includes numerous mitigation features to help protect Windows against the entire exploit attack chain, including DEP, ASLR, Control Flow Guard (CFG), and many new mitigations that prevents bypasses in UAC and the browser.

With the types of threats enterprises face today, we are constantly reminded of this simple truth: modern defense against software vulnerabilities requires a modern platform. That platform is Windows 10 – an always up-to-date version of Windows that is continually improved to help protect against the latest threats. To help make the transition to Windows 10, we will publish a detailed guide for administrators currently using EMET.

Updated Support End Date for EMET 5.5x Updated Support End Date for EMET 5.5x

Finally, we have listened to customers’ feedback regarding the January 27, 2017 end of life date for EMET and we are pleased to announce that the end of life date is being extended 18 months. The new end of life date is July 31, 2018. There are no plans to offer support or security patching for EMET after July 31, 2018. For improved security, our recommendation is for customers to migrate to Windows 10.

- Jeffrey Sutherland