Microsoft has been prioritizing security in Windows, as they introduced Secured-Core PCs to protect from hardware to cloud attacks and expanded passwordless offerings with passkeys for better identity protection.
Passkeys are protected by Windows Hello technology, and to further enhance security, Microsoft announced the Secure Future Initiative (SFI) to ensure secure product and service delivery, by implementing new security features in Windows 11 and enabling more security features by default.
It is partnering with OEMs to offer secured-core PCs with enhanced security features by default, as these PCs leverage hardware security features like Pluton security processors and firmware safeguards to protect user credentials, identities, and data from cyberattacks, even with physical access to the device.
Free Webinar on Live API Attack Simulation: Book Your Seat | Start protecting your APIs from hackers
Windows Hello ESS is another security measure that utilizes hardware and software components to secure biometric sign-ins, eliminating the need for passwords on these secure-core PCs.
Windows 11 prioritizes security by enabling default features like credential safeguards and application protection, which reduce security incidents and firmware attacks.
Multi-factor authentication with Windows Hello and passkeys protects against credential theft, and to further enhance security, Windows 11 employs Local Security Authority (LSA) protection to prevent unauthorized access to credentials.
Additionally, the deprecation of NTLM and Virtualization Security (VBS) for key protection is planned to improve user authentication and key security, which harden Windows Hello and protects against advanced attacks.
Microsoft is improving Windows security with a focus on application trust and user control. Smart App Control leverages AI to block unknown or malicious apps, while Trusted Signing simplifies the process for developers to sign their apps for better reputation and compatibility with Smart App Control.
Win32 app isolation helps contain damage from compromised apps. Just-in-time administrative access requires user approval for actions needing admin privileges, reducing the attack surface.
VBS enclaves, previously exclusive to Windows security features, are now available for developers to use within their applications for enhanced protection of sensitive tasks.
Microsoft has made several changes to improve Windows security. Windows Protected Print Mode is a new secure printing system that will be the default in the future, while tooltips are being reworked to be managed by applications instead of the kernel, mitigating memory access vulnerabilities.
TLS server authentication is being strengthened by no longer trusting weak 1024-bit RSA encryption keys, which address common attacker strategies and enhance overall system security.
Windows 11 offers improved management features for commercial customers, as Config Refresh allows administrators to set a schedule for devices to reapply for security policies automatically.
Firewall enforcement ensures all rules within a block are applied successfully or rolled back entirely to avoid partial deployment. Personal Data Encryption provides two levels of data protection depending on user lock status and complements BitLocker for enhanced security.
Zero Trust DNS (in preview) restricts outgoing traffic to approved network destinations resolved by trusted DNS servers by empowering IT administrators to manage and enforce security configurations on devices centrally.
ANYRUN malware sandbox’s 8th Birthday Special Offer: Grab 6 Months of Free Service