A computing device for managing cross ring memory accesses by a device driver on the computing device, the computing device comprising: a security module to (i) configure a memory page table associated with the device driver to disable cross ring memory accesses by the device driver and (ii) trap an attempted cross ring memory access by the device driver subsequent to configuration of the associated memory page table; and a malware analysis module to analyze the device driver and the attempted cross ring memory access in response to trapping the attempted cross ring memory access to determine whether the device driver is malicious by comparing a driver fingerprint (154, 222) of a reference device driver stored in a local security database to the device driver from which the attempted cross ring memory access originated, wherein the driver fingerprint is embodied as device driver security data usable to determine whether a device driver is malicious, wherein the driver fingerprint: is a bit mask of a device driver program, and/or identifies at least one of originating addresses or destination addresses of device drivers from which allowed cross ring memory accesses originate, and wherein the security module is further to deny the attempted cross ring memory access in response to a determination by the malware analysis module that the device driver is malicious or update the memory page table associated with the device driver to allow the attempted cross ring memory access in response to a determination by the malware analysis module that the device driver is not malicious. a security module to (i) configure a memory page table associated with the device driver to disable cross ring memory accesses by the device driver and (ii) trap an attempted cross ring memory access by the device driver subsequent to configuration of the associated memory page table; and a malware analysis module to analyze the device driver and the attempted cross ring memory access in response to trapping the attempted cross ring memory access to determine whether the device driver is malicious by comparing a driver fingerprint (154, 222) of a reference device driver stored in a local security database to the device driver from which the attempted cross ring memory access originated, wherein the driver fingerprint is embodied as device driver security data usable to determine whether a device driver is malicious, wherein the driver fingerprint: is a bit mask of a device driver program, and/or identifies at least one of originating addresses or destination addresses of device drivers from which allowed cross ring memory accesses originate, is a bit mask of a device driver program, and/or identifies at least one of originating addresses or destination addresses of device drivers from which allowed cross ring memory accesses originate, and wherein the security module is further to deny the attempted cross ring memory access in response to a determination by the malware analysis module that the device driver is malicious or update the memory page table associated with the device driver to allow the attempted cross ring memory access in response to a determination by the malware analysis module that the device driver is not malicious.