Windows 11 Helps State and Local Agencies Achieve Zero Trust

In the early days of the PC, an IT professional could replace components on the motherboard and the OS would use them without flagging that anything had changed. Today, the software and hardware are constantly validating each other. Windows 11 would recognize that something had changed because the original known part would no longer respond. As a result, Secure Boot would flag the issue.

“This adds to Windows’ security because you can no longer bypass the Windows layer and boot into a DOS prompt to make changes to the system,” Brown says. “If someone tries to insert malicious code into the computer, Secure Boot will alert you to an unexpected change and restore to a known state, blocking the change.”

Cybersecurity has changed radically since the advent of the PC, and Windows 11 is a response to the pervasive nature of cyberthreats today. The final version of Windows 10, 22H2, will reach the end of support on Oct. 14, 2025. While the OS will still function, there will be no more version updates unless the date is extended by Microsoft.

To ensure that government IT systems are secure, state and local organizations should consider migrating to Windows 11, Brown says. The new OS can assist government agencies with building a zero-trust security architecture, but state and local IT leaders must understand that migrating to Windows 11 is a journey that requires preparation.

READ MORE: How state and local agencies can transition to Windows 11.

Windows 11 Includes Layers of Security Features

While OSs have become much more secure over the years thanks to firewalls, anti-virus software and malware scans, Brown says, nothing blocked the worst hole in the entire infrastructure: an end user clicking on a link to launch something he or she thought was benign. In fact, the “human element” was a factor in 74 percent of total breaches according to a report from Verizon. Windows 11 could change that.

“Windows is now constantly scanning every internet site that you visit, every document that you open, and running processes to make sure they are legitimate and safe to continue,” Brown says.

Windows 11 does this using a feature called Microsoft Defender SmartScreen, one of several new tools rolled out with the OS update. Here are security features of note that government agencies should be aware of when considering a migration to Windows 11:

• BitLocker: While this feature was included on Windows 10, it was optional. Now, device and drive encryption are built into the OS by default to protect sensitive data from unauthorized access, Brown says.
• Credential Guard: This feature uses virtualization-based security (VBS) to defend systems from credential theft and malware attacks, even if they are running with admin privileges, according to a Microsoft blog.
• Config Lock: Using mobile device management policies, this feature monitors registry keys to detect changes in a government agency’s device ecosystem and reverts changed systems to an IT-desired state. Microsoft notes that the feature also prevents users from altering security settings.
• Hypervisor-Protected Code Integrity: Also known as memory integrity, HVCI is another VBS feature integral to ensuring that all drivers plugged into the OS are safe and trustworthy.
• Microsoft Defender SmartScreen: This program addresses the vulnerability created by end users by protecting against phishing, malware and malicious files. SmartScreen is constantly watching the sites a user browses, no matter which browser is used, Brown says. It will compare each site visited against Microsoft’s known secure databases and alert a user if a site could be malicious. “Before you even move your mouse, that website, link or attachment has been checked and validated,” he adds.
• Microsoft Pluton: This security processor was built on the principle of zero trust. It is integrated into the CPU and OS to protect personal information, credentials and encryption keys, according to Microsoft. Instead of requiring government IT teams to manually update the processor, it can be done via Windows Update, adding another level of security.
• Smart App Control: According to Microsoft, this feature blocks malicious and untrustworthy apps as well as unwanted apps that can slow down devices or that come with unexpected or unwanted properties such as ads or extra software.

All of these security layers and more are in constant communication, prepared to isolate suspicious applications and lock down the system so malicious programs can’t take over and propagate onto other devices, Brown says. It’s all part of a zero-trust architecture.

“Even though your device might be managed, if you have certain things turned off, the system will no longer trust that device. If Microsoft Defender anti-virus isn’t running, it will say, ‘I no longer trust you. You cannot come in until that’s fixed.’ If you don’t have the latest Microsoft patches installed, it won’t trust you until Microsoft Intune finishes pushing the update to you,” Brown says, adding that Microsoft Azure cloud tools and Microsoft Intune work together with the OS to protect the government IT ecosystem.

State and local governments are always worried about cybersecurity and cyber encryption, and with critical infrastructure and citizen data at stake, it’s vital that IT systems be protected at all times. This makes Windows 11 an important security tool for governments.

With Windows 11, a device is completely encrypted as soon as the user clicks the power button, Brown says.

“Hardware manufacturers are working with Microsoft, and they’ve added a second chip onto the processor. It’s a security chip that holds all the encryption keys and token codes,” Brown says. “On older devices, that security chip was somewhere on the motherboard, meaning the system had to leave the processor to go to that chip, which opened a security hole. Now that chip is on the processor itself.”

As soon as the system powers up, it runs an integrity check of all hardware. If something seems off, the OS will stop everything, and that unknown process won’t be allowed to run.

“Now you have complete encryption. You have complete zero trust until validated on the hardware layer, which we’ve never had before in the Windows systems,” Brown says.

For more on the specific security features offered by Windows 11, Brown recommends that government IT leaders read Windows 11 Security Book: Powerful Security by Design.

Click the banner below to learn more about Windows 11 migration.

Windows 11 Migration Requires Partnership and Planning

Migrating to Windows 11 isn’t something that can happen overnight. It requires careful planning and preparation. However, government organizations don’t have to do it alone. Brown says that a technology partner such as CDW can offer an assessment tool to help agencies determine whether their applications and hardware are ready to run Windows 11.

Older devices might not be authorized to run the new OS because the hardware may not support the different credentialing tools and zero-trust capabilities in Windows 11. Brown says that some users have found a way around the credential check to install the OS; however, this leaves organizations without the security benefits of the Windows 11 and hardware integration.

Through an assessment, CDW can help state and local agencies determine whether their systems can support Windows 11, and if not, can recommend compatible hardware to meet their needs.

EXPLORE: State and local governments are addressing threats with zero trust.

“We break down why this device will work and why this one won’t. We walk through your applications and note which ones will require talking to your developers to get the latest version,” Brown says. “You’re not walking into this with your eyes closed. You’re now walking into this with an understanding of what you need to do, the budget you have to build this and the process of how that’s going to happen.”

Brown points out that many organizations are already paying for a mobile device management program such as Microsoft Intune without realizing it. That can be brought to light through an assessment.

Some IT leaders may be interested in a Windows 11 migration but feel that they don’t have the budget for such an investment. Brown notes that CDW can help state and local agencies seek additional funding. However, it’s important to connect with a partner early to determine eligibility.

“If we are brought in later in the project, that may change the funding availability,” Brown says. “We can review all the details and help determine what funding is available for your project.”