Ozone (Legacy)

Ozone is Security Architects’ heritage product: a Host Intrusion Prevention System (HIPS) for Windows 2000, XP, and Server 2003 that protected server and client machines from both known and unknown attacks — including the worm epidemics of its day (Blaster, Sasser, MyDoom, Witty).

The idea

Unlike reactive products such as anti-virus and intrusion detection systems, Ozone did not rely on constantly updated databases of “bad behaviour” signatures. Instead it enforced good behaviour: explicit policy describing what each computer, application, and user is allowed to do — and nothing else. A web server may listen on port 80 and serve pages; it may not execute arbitrary programs or open connections to arbitrary hosts.

That least-privilege, policy-driven approach — mandatory access control at the process level — anticipated what the industry now calls zero trust and application allowlisting.

The architecture

Ozone consisted of software agents administered from a central management console. Each agent layered four integrated protection rings:

Memory Protection Ring — transparent protection against memory corruption attacks such as buffer overflows.
System Protection Ring — protection against low-level attacks such as privilege escalation and rootkit installation.
Process Protection Ring — every process confined to a virtual sandbox enforcing the principle of least privilege.
Application Protection Ring — application-specific protection against high-level attacks such as cross-site scripting and SQL injection.

Open release

In 2004 the Ozone agent was released free of charge, kernel source code included — you can still browse it today:

Status

Ozone targeted the Windows NT 5.x kernel line and is preserved here as history, not offered for production use. Its ideas, however, aged well — and we are evaluating what a modern incarnation could look like. Get in touch if that interests you.