Ozone, two decades on: we shipped least privilege in 2004

In 2004, the internet was on fire. Blaster, Sasser, MyDoom, and Witty tore through Windows networks faster than signatures could be written, and the industry’s answer was to write signatures faster.

An ozone molecule of three bonded spheres inside four concentric rings, labelled 1999.
Four protection rings, 1999. The industry named it zero trust later.

We took the opposite bet. Ozone, the Host Intrusion Prevention System we built at Security Architects, didn’t try to enumerate bad behaviour at all. It enforced good behaviour: explicit policy describing what each computer, application, and user was allowed to do - and nothing else. A web server may listen on port 80 and serve pages; it may not spawn arbitrary programs or open connections to arbitrary hosts. As we wrote at the time, defining good behaviour is the tractable problem, because programs and people should only be doing a limited number of things.

The industry got there eventually. It just took a while - and a rebrand.

Four rings, 2004 edition

Ozone agents enforced process-level mandatory access control through four integrated protection rings, administered from a central console:

  • a memory protection ring against buffer overflows and memory corruption - years before DEP and ASLR were baseline;
  • a system protection ring against privilege escalation and rootkit installation;
  • a process protection ring that confined every process to a virtual sandbox enforcing least privilege - what containers, pledge, and seccomp profiles do today;
  • an application protection ring against SQL injection and cross-site scripting - the job now split between WAFs and RASP.

Read the language of 2004 next to a modern zero-trust or application-allowlisting datasheet and the resemblance isn’t flattering to 2004 - it’s flattering to the datasheet. The term “zero trust” wouldn’t be popularized for years; default-deny at the process level was simply what made sense to us.

Black Hat, 2005

In July 2005, Eugene Tsyrklevich presented Ozone at Black Hat USA in Las Vegas, under a title that has not aged into modesty: “Ozone HIPS: Unbreakable Windows”. The abstract opened with the state of the world:

Windows is the number one target on the Internet today. It takes less than 5 minutes for an unpatched Windows machine, connected to the Internet, to get owned. Yet the most prevalent security practices still consist of running anti-viruses and constant patching.

Two of the three mechanisms it went on to describe, address-space randomisation and a per-process sandbox, would not arrive in Windows itself until Vista in 2007. The slides are still on Black Hat’s server.

We released it free - source included

In 2004 we made the Ozone agent free to download, kernel source code included. That wasn’t a common move for a commercial Windows security product, and it reflected a belief we still hold: security you can’t audit is a promise, not a control.

The original Ozone product logo: a purple sphere as the letter O, the word zone, and the line 'hole not included'.
The 2004 logo, from the archived site. The parenthetical is original.

The artifacts are still here, preserved:

The same bet, twenty-two years later

Ozone targeted Windows 2000, XP, and Server 2003, and it stays retired with them. But look at what we ship now: Claudette confines AI coding agents to a kernel-enforced sandbox; Cone of Silence runs always-on agents default-deny; Authinator3 keeps firewalls dark until a person authenticates. Different decade, different attack surface - the same bet: enforce good behaviour, and make the mechanism auditable.

We’re also quietly evaluating what a modern Ozone could look like. If that sentence raises your pulse, we should talk.