Mark Russinovich

Background and Education

Mark Eugene Russinovich was born on December 22, 1966, in Salamanca, Spain, and is of Croatian descent through his father's side of the family; he is reportedly the grandson of Croatian diplomat Nikola Rušinović. He was raised primarily in Birmingham, Alabama, before his family relocated to Pittsburgh, Pennsylvania, when he was fifteen. Russinovich has said he became interested in computing after a friend's father acquired an Apple II, which he explored by reverse-engineering its ROM. He went on to earn a Bachelor of Science in computer engineering from Carnegie Mellon University in 1989, a Master of Science in computer engineering from Rensselaer Polytechnic Institute in 1990, and a Ph.D. in computer engineering from Carnegie Mellon in 1994, with a dissertation on application-transparent fault management.

Sysinternals and Winternals

After a period as a research associate at the University of Oregon and a stint at IBM's Thomas J. Watson Research Center, Russinovich partnered with Bryce Cogswell to found the company Winternals Software and, alongside it, the website Sysinternals.com. Through Sysinternals, Russinovich and Cogswell published a series of free Windows diagnostic and troubleshooting utilities that documented and exposed internal Windows behavior not otherwise visible to administrators, including Process Explorer, Process Monitor, Autoruns, Filemon, Regmon, TCPView, and RootkitRevealer. These tools became widely used by system administrators, IT professionals, and malware researchers, and are credited with popularizing deep, practical knowledge of Windows internals well beyond Microsoft's own documentation. Russinovich also co-authored multiple editions of the technical reference books "Windows Internals" and "Windows Sysinternals Administrator's Reference," which are widely regarded as authoritative texts on the Windows operating system's architecture.

The Sony BMG Rootkit Discovery

In late October 2005, while examining unusual behavior on his own computer using his own Sysinternals tools, Russinovich discovered that a Sony BMG music CD had covertly installed a piece of software functioning as a rootkit — a program designed to hide its own presence and processes from the operating system and from security software. On October 31, 2005, he published his findings in a blog post titled "Sony, Rootkits, and Digital Rights Management Gone Too Far," detailing how the software, part of Sony BMG's Extended Copy Protection (XCP) digital rights management system, installed itself without meaningful user consent, hid its files and processes using rootkit techniques, and created security vulnerabilities that other malware could exploit. The disclosure quickly drew coverage from major media outlets and other security researchers, including an estimate by researcher Dan Kaminsky that hundreds of thousands of networks worldwide had been affected. Sony BMG initially downplayed the concern; a company executive was widely quoted asking, "Most people don't even know what a rootkit is, so why should they care about it?" Public and regulatory pressure mounted rapidly, leading Sony BMG to recall affected CDs, release removal tools, and face a series of class-action lawsuits, state attorney general investigations, and a Federal Trade Commission settlement. In January 2006, Russinovich also identified a separate rootkit-like component bundled with Symantec's Norton SystemWorks, prompting a swift corrective response from Symantec.

Move to Microsoft and Azure Leadership

In 2006, Microsoft acquired Winternals Software, and Russinovich joined Microsoft as a Technical Fellow, continuing to maintain and expand the Sysinternals tools, which Microsoft has hosted and continued to update since the acquisition. Over the following years he took on increasing responsibility within Microsoft's cloud computing efforts, and in 2014 he was named Chief Technology Officer of Microsoft Azure, a position in which he has continued to represent Microsoft's cloud architecture and security strategy publicly at conferences and in technical media.

Other Work and Legacy

Beyond his technical work, Russinovich is also the author of a series of techno-thriller novels grounded in cybersecurity themes, including "Zero Day" (2011), "Trojan Horse" (2012), and "Rogue Code" (2014). His combined body of work — free diagnostic tooling used by generations of Windows administrators, a defining public exposure of covert DRM rootkit software, and long-running technical authorship on Windows internals — has made him one of the most recognized figures in Windows systems security and cloud computing.

Timeline

• 1966-12-22Born in Salamanca, Spain.
• 1989Earns a B.S. in computer engineering from Carnegie Mellon University.
• 1994Earns a Ph.D. in computer engineering from Carnegie Mellon University.
• 1996Co-founds Winternals Software and the Sysinternals.com website with Bryce Cogswell.
• 2005-10-31Publishes the blog post "Sony, Rootkits, and Digital Rights Management Gone Too Far," exposing the Sony BMG copy-protection rootkit.
• 2006-01Identifies rootkit-like functionality bundled with Symantec's Norton SystemWorks.
• 2006Microsoft acquires Winternals Software; Russinovich joins Microsoft as a Technical Fellow.
• 2011Publishes his first techno-thriller novel, "Zero Day."
• 2014Named Chief Technology Officer of Microsoft Azure.