Jul 07 2022

Microsoft Windows 11 Starts from Zero-Trust Positions

The popular operating system’s security features enable many defensive measures by default.

According to Microsoft, the company invests $1 billion annually in cloud security and employs over 3,500 security professionals. With such resources, it’s not going to ignore the security of its flagship product, Windows. In Windows 11, rather than simply offering new features, Microsoft is requiring them and stepping up the hardware security requirements for PCs running Windows 11.

In a zero-trust environment, a device trusts nothing. It demands authentication for as many tasks, both hardware and software, as possible and ensures the device grants access to the least amount of information required. Here are some ways Windows 11 enforces zero trust.

Click the banner below to get access to customized content by becoming an Insider.

Passwordless Authentication

Released with Windows 10, Microsoft facial recognition software again makes an appearance in Windows 11. Windows Hello allows users to keep information protected and to drop passwords entirely in favor of more secure, cryptographic identification.

In Windows 10, Windows Hello was disabled by default. In Windows 11, Windows Hello will be on by default, and Windows will prompt you to set it upon first signing in.

LEARN ABOUT: Zero-trust security for state and local governments.

Cloud-Based Zero-Trust Policies

Administrators in large agencies already rely on various security policies to harden devices and communication. Windows 11 brings a method of validating cloud resources at scale known as Microsoft Azure Attestation.

Microsoft Azure Attestation is a policy-driven service that creates a cryptographic token from a device’s Trusted Platform Module 2.0 chip. That token is then provided to Azure to authenticate an endpoint’s identity. Administrators can create and upload attestation policies via the Microsoft Azure Attestation service in the Azure portal.

In a zero-trust environment, a device trusts nothing."

Virtualization-Based Security

In response to historic attacks like Spectre and Meltdown, Windows 11 includes the successor to the memory integrity feature known as hypervisor-protected code integrity. HVCI, enabled by default, virtualizes memory and processes data in silos.

Virtualizing and segmenting memory allows devices to adhere to the zero-trust model by executing instructions in complete isolation. Administrators may still control this feature via a registry key.

EXPLORE: What you need to know before adopting Windows 11.

Secure Boot by Default

Secure Boot, a Unified Extensible Firmware Interface feature released with Windows 10, makes another comeback in Windows 11. Secure Boot creates a digital signature that prevents malicious binaries from executing on boot.

Previously an optional feature, Secure Boot now becomes mandatory in Windows 11.

sanchesnet1/Getty Images

Learn from Your Peers

What can you glean about security from other IT pros? Check out new CDW research and insight from our experts.