SUMMARY 

Windows Defender can flag SystemHealth.DataProvider.sys as a security risk and block it running. SystemHealth.DataProvider.sys is part of the Milestone Husky System Health Services.

This is due to Husky System Health using WinRing0 which has been flagged as a Security risk. WinRing0 itself is not malicious but it does have a security vulnerability that allows malicious programs access to the memory in the unit: https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VulnerableDriver:WinNT/Winring0.A

AFFECTED PRODUCTS AND SOLUTIONS 

WORKAROUND AND MITIGATIONS 

Milestone recommends that the Husky System Health Services and its related components (Erlang/OTP and RabbitMQ Server) are uninstalled.

To uninstall everything related to Husky System Health follow these steps:

GENERAL SECURITY RECOMMENDATIONS  

As a general security measure Milestone strongly recommends protecting network access to affected products

with appropriate mechanisms. It is advised to follow the security practices recommended in the Milestone Hardening Guide to run the devices in a protected IT environment.

PRODUCT DESCRIPTION 

Husky System Health is a non-vital component of the Husky IVO and has since been discontinued, is no longer part of current images and will not be updated. Hence the recommendation from Milestone is to uninstall Husky System Health.

ADDITIONAL INFORMATION 

For further inquiries on security vulnerabilities in Milestone Systems products, please contact Milestone PSIRT Team: https://www.milestonesys.com/psirt