Microsoft on Tuesday released a hefty PDF detailing Windows 11’s new security-focused features, with a heavy emphasis on supporting zero trust.
For a couple years now, Microsoft, Google, and Amazon have been working with the US federal government on improving cybersecurity through zero trust, among other techniques. It’s no coincidence that these are the big three cloud service providers, of course; they are best positioned to institute controls to prevent catastrophic cyberattacks.
But Microsoft is also moving security way down the stack to where cloud rivals can’t follow: firmware.
Hardware Security Under Attack
While network-level security is mandatory, it is not sufficient to protect against attackers who target firmware and other low-level elements of a computer.
Flaws in firmware for CPUs, printers, and other hardware can open a door to a corporate network. Malware like TrickBot, MoonBounce, and LoJax
that worms its way into the silicon is difficult to dislodge.
“These new threats call for computing hardware that is secure down to the very core, including hardware chips and processors which store sensitive business information,” Microsoft stated in the new report. “With hardware-based protection, we can enable strong mitigation against entire classes of vulnerabilities that are difficult to thwart with software alone.” Besides the extra strength of the protection, Microsoft touts less slowdown using hardware-based protection versus running it in software.
The foundation of the built-in hardware security is a partnership between hardware root-of-trust and silicon-assisted security.
Hardware Root-of-Trust
Hardware root-of-trust is, by definition, “a starting point that is implicitly trusted.” In the case of a PC, it’s the part that checks BIOS code to ensure it’s legitimate before it boots up. And anyone who’s had to remove malware from a machine with infected BIOS knows how vital that is.
The new security measures include storing sensitive data such as cryptographic keys and user credentials isolated from the operating system within a separate secure area. Microsoft requires a Trusted Platform Module (TPM) 2.0 chip to be installed on both new and upgraded Windows 11 machines. The company had required TPM 2.0 capabilities on all new Windows 10 machines, but the latest version of Windows won’t even run if the PC doesn’t have a TPM 2.0 security chip.
“With hardware-based isolation security that begins at the chip, Windows 11 stores sensitive data behind additional barriers separated from the operating system,” Microsoft wrote in its new report. “As a result, information including encryption keys and user credentials are protected from unauthorized access and tampering.”
To provide TPM 2.0 protection directly on the motherboard, Windows 11 machines include the Microsoft Pluton security processor on the system-on-chip. While Pluton is not brand new – it was previewed back in November 2020 – integrating TPM 2.0 capabilities in this way eliminates one attack vector: the bus interface between the CPU and the TPM chip.
Not all Windows 11 machines will have a Pluton chip, but they will all have a TPM 2.0 chip.
Silicon-Assisted Security
The silicon-assisted security measures in Windows 11 start with a secure kernel carved out using virtualization-based security (VBS). “The isolated VBS environment protects processes, such as security solutions and credential managers, from other processes running in memory,” Microsoft wrote. “Even if malware gains access to the main OS kernel, the hypervisor and virtualization hardware help prevent the malware from executing unauthorized code or accessing platform secrets in the VBS environment.”
Hypervisor-protected code integrity (HCVI) uses VBS to check the validity of code within the secure VBS …….
Source: https://www.darkreading.com/emerging-tech/microsoft-brings-zero-trust-to-hardware-in-windows-11