Windows 10: Microsoft announces new Secured-core PCs running Windows 10

Brink · Oct 21, 2019

Recent developments in security research and real-world attacks demonstrate that as more protections are proactively built into the OS and in connected services, attackers are looking for other avenues of exploitation with firmware emerging as a top target. In the last three years alone, NIST’s National Vulnerability Database has shown nearly a five-fold increase in the number of firmware vulnerabilities discovered.

To combat threats specifically targeted at the firmware and operating system levels, we’re announcing a new initiative we’ve been working on with partners to design what we call Secured-core PCs. These devices, created in partnership with our PC manufacturing and silicon partners, meet a specific set of device requirements that apply the security best practices of isolation and minimal trust to the firmware layer, or the device core, that underpins the Windows operating system. These devices are designed specifically for industries like financial services, government and healthcare, and for workers that handle highly-sensitive IP, customer or personal data, including PII as these are higher value targets for nation-state attackers.

In late 2018, security researchers discovered that hacking group, Strontium has been using firmware vulnerabilities to target systems in the wild with malware delivered through a firmware attack. As a result, the malicious code was hard to detect and difficult to remove – it could persist even across common cleanup procedures like an OS re-install or a hard drive replacement.

Why attackers and researchers are devoting more effort toward firmware

Firmware is used to initialize the hardware and other software on the device and has a higher level of access and privilege than the hypervisor and operating system kernel thereby making it an attractive target for attackers. Attacks targeting firmware can undermine mechanisms like secure boot and other security functionality implemented by the hypervisor or operating system making it more difficult to identify when a system or user has been compromised. Compounding the problem is the fact that endpoint protection and detection solutions have limited visibility at the firmware layer given that they run underneath of the operating system, making evasion easier for attackers going after firmware.

What makes a Secured-core PC?

Secured-core PCs combine identity, virtualization, operating system, hardware and firmware protection to add another layer of security underneath the operating system. Unlike software-only security solutions, Secured-core PCs are designed to prevent these kinds of attacks rather than simply detecting them. Our investments in Windows Defender System Guard and Secured-core PC devices are designed to provide the rich ecosystem of Windows 10 devices with uniform assurances around the integrity of the launched operating system and verifiable measurements of the operating system launch to help mitigate against threats taking aim at the firmware layer. These requirements enable customers to boot securely, protect the device from firmware vulnerabilities, shield the operating system from attacks, prevent unauthorized access to devices and data, and ensure that identity and domain credentials are protected.

The built-in measurements can be used by SecOps and IT admins to remotely monitor the health of their systems using System Guard runtime attestation and implement a zero-trust network rooted in hardware. This advanced firmware security works in concert with other Windows features to ensure that Secured-core PCs provide comprehensive protections against modern threats.

Removing trust from the firmware

Starting with Windows 8, we introduced Secure Boot to mitigate the risk posed by malicious bootloaders and rootkits that relied on Unified Extensible Firmware Interface (UEFI) firmware to only allow properly signed bootloaders like the Windows boot manager to execute. This was a significant step forward to protect against these specific types of attacks. However, since firmware is already trusted to verify the bootloaders, Secure Boot on its own does not protect from threats that exploit vulnerabilities in the trusted firmware. That’s why we worked with our partners to ensure these new Secured-core capabilities are shipped in devices right out of the box.

Using new hardware capabilities from AMD, Intel, and Qualcomm, Windows 10 now implements System Guard Secure Launch as a key Secured-core PC device requirement to protect the boot process from firmware attacks. System Guard uses the Dynamic Root of Trust for Measurement (DRTM) capabilities that are built into the latest silicon from AMD, Intel, and Qualcomm to enable the system to leverage firmware to start the hardware and then shortly after re-initialize the system into a trusted state by using the OS boot loader and processor capabilities to send the system down a well-known and verifiable code path. This mechanism helps limit the trust assigned to firmware and provides powerful mitigation against cutting-edge, targeted threats against firmware. This capability also helps to protect the integrity of the virtualization-based security (VBS) functionality implemented by the hypervisor from firmware compromise. VBS then relies on the hypervisor to isolate sensitive functionality from the rest of the OS which helps to protect the VBS functionality from malware that may have infected the normal OS even with elevated privileges. Protecting VBS is critical since it is used as a building block for important OS security capabilities like Windows Defender Credential Guard which protects against malware maliciously using OS credentials and Hypervisor-protected Code Integrity (HVCI) which ensures that a strict code integrity policy is enforced and that all kernel code is signed and verified.

Being able to measure that the device booted securely is another critical piece of this additional layer of protection from firmware compromise that gives admins added confidence that their endpoints are safe. That’s why we implemented Trusted Platform Module 2.0 (TPM) as one of the device requirements for Secured-core PCs. By using the Trusted Platform Module 2.0 (TPM) to measure the components that are used during the secure launch process, we help customers enable zero trust networks using System Guard runtime attestation. Conditional access policies can be implemented based on the reports provided by the System Guard attestation client running in the isolated VBS environment.

In addition to the Secure Launch functionality, Windows implements additional safeguards that operate when the OS is running to monitor and restrict the functionality of potentially dangerous firmware functionality accessible through System Management Mode (SMM).

Beyond the hardware protection of firmware featured in Secured-core PCs, Microsoft recommends a defense-in-depth approach including security review of code, automatic updates, and attack surface reduction. Microsoft has provided an open-source firmware project called Project-Mu that PC manufactures can use as a starting point for secure firmware.

How to get a Secured-core PC

Our ecosystem partnerships have enabled us to add this additional layer of security in devices that are designed for highly-targeted industries and end-users who handle mission-critical data in some of the most data-sensitive industries like government, financial services, and healthcare, right-out-of-the-box. These innovations build on the value of Windows 10 Pro that comes with built-in protections like firewall, secure boot, and file-level information-loss protection which are standard on every device.

More information on devices that are verified Secured-core PC including those from Dell, Dynabook, HP, Lenovo, Panasonic and Surface can be found on our web page.

David Weston (@dwizzzleMSFT)

Partner Director, OS Security
Click to expand...

Source: https://www.microsoft.com/security/b...mware-attacks/

See also: https://www.microsoft.com/en-us/wind...core-computers

Tweet

— Twitter API (@user) View on Twiiter
Click to expand...

:)

CK011885 · Oct 21, 2019

Installing Windows 10 on New PC?

I'm going to be building a new PC on Christmas and want to install Windows 10 on it. I have Windows 10 on my current PC, which I installed upgrading from 8.1 with the files on a USB. How do I go about installing a clean copy of Windows 10 on this new PC? I think I recall something about installing it once makes Microsoft recognize your hardware, but since this will be a PC I'm not sure what steps I need to take. Do I need to go 8.1 -> 10 or is there a method of going directly to 10?

btarunr · Oct 21, 2019

Microsoft Announces Windows 10 Operating System

Microsoft Corp. on Tuesday unveiled its next Windows operating system, Windows 10, and gave a first look at an early technical preview for the PC available Oct. 1. The announcement highlighted advancements designed for business, including an updated user experience and enhanced security and management capabilities. The company also introduced the Windows Insider Program, kicking off its largest-ever open collaborative development effort to change the way Windows is built and delivered to best meet the needs of customers. Program participants will receive the technical preview of Windows 10 and a steady stream of builds through the development cycle to use and give feedback on.

"Windows 10 represents the first step of a whole new generation of Windows, unlocking new experiences to give customers new ways to work, play and connect," said Terry Myerson, executive vice president of the Operating Systems group at Microsoft. "This will be our most comprehensive operating system and the best release Microsoft has ever done for our business customers, and we look forward to working together with our broader Windows community to bring Windows 10 to life in the months ahead."

Windows 10: familiarity and consistency across devices
Windows 10 adapts to the devices customers are using - from Xbox to PCs and phones to tablets and tiny gadgets - and what they're doing with a consistent, familiar and compatible experience, enabling even greater productivity. Windows 10 will run across the broadest range of devices ever from the Internet of Things to enterprise datacenters worldwide. Microsoft is also delivering a converged application platform for developers on all devices with a unified app store. Developers will be able to write an application once and deploy it easily across multiple device types, making discovery, purchase and updating easier than ever for customers.

Windows 10: designed for the challenges of modern business
Windows 10 builds nearly everything that businesses need right into the core of the product - including enterprise-grade security, identity and information protection features - in ways that can reduce complexities and provide better experiences than other solutions. One area of advancement is in the work Microsoft has done with user identities to improve resistance to breach, theft or phishing. Windows 10 will also help advance data loss prevention by using containers and data separation at the application and file level, enabling protection that follows the data as it goes from a tablet or PC to a USB drive, email or the cloud.

Management and deployment have been simplified to help lower costs, including in-place upgrades from Windows 7 or Windows 8 that are focused on making device wipe-and-reload scenarios obsolete. Businesses will also have the flexibility to choose how quickly they adopt the latest innovations and influence continued improvements. In addition, organizations will be able to customize an app store specific to their needs and environment. The intent is an app store that will allow for volume app licensing, flexible distribution, and the ability for organizations to reclaim or reuse licenses when necessary.

Technical preview PC productivity
The early technical preview of Windows 10 demonstrates new levels of flexibility, navigation and familiarity through the Windows experience. Features include these:

Expanded Start menu. The familiar Start menu is back, providing quick one-click access to the functions and files that people use most, and it includes a new space to personalize with favorite apps, programs, people and websites.

Apps that run in a window. Apps from the Windows Store now open in the same format that desktop programs do. They can be resized and moved around, and have title bars at the top allowing users to maximize, minimize and close with a click.

Snap enhancements. Working in multiple apps at once is easier and more intuitive with snap improvements. A new quadrant layout allows up to four apps to be snapped on the same screen. Windows will also show other apps and programs running for additional snapping, and it will even make smart suggestions on filling available screen space with other open apps.

New Task view button. The new Task view button on the task bar enables one view for all open apps and files, allowing for quick switching and one-touch access to any desktop created.

Multiple desktops. Instead of too many apps and files overlapping on a single desktop, it's easy to create and switch between distinct desktops for different purposes and projects - whether for work or personal use.

Open and collaborative development
The introduction of the Windows Insider Program demonstrates Microsoft's continued commitment to working closely with customers to help shape the future of Windows. Windows Insiders will be able to give feedback on early builds of the product throughout the development cycle. The program will include various ways for Windows Insiders to engage in a two-way dialogue with Microsoft, including a Windows Feedback app for sharing suggestions and issues and a Windows Technical Preview Forum for interacting with Microsoft engineers and fellow Insiders. More information on the Windows Insider Program and the technical preview can be found here.

r.h.p · Oct 21, 2019

Installing Windows 10 on New PC?

I'm going to be building a new PC on Christmas and want to install Windows 10 on it. I have Windows 10 on my current PC, which I installed upgrading from 8.1 with the files on a USB. How do I go about installing a clean copy of Windows 10 on this new PC? I think I recall something about installing it once makes Microsoft recognize your hardware, but since this will be a PC I'm not sure what steps I need to take. Do I need to go 8.1 -> 10 or is there a method of going directly to 10?
Click to expand...

What's your intended PC specs ??

Windows 10: Microsoft announces new Secured-core PCs running Windows 10

Microsoft announces new Secured-core PCs running Windows 10

Microsoft announces new Secured-core PCs running Windows 10

Microsoft announces new Secured-core PCs running Windows 10

Microsoft announces new Secured-core PCs running Windows 10 - Similar Threads - Microsoft announces Secured

Microsoft Windows 11 new announcements?

Microsoft Windows 11 new announcements?

Microsoft announces Windows 10 PCs for Education and Classroom Pen 2

New Microsoft Pluton security processor for future Windows PCs

Microsoft announces the new Secured-core PCs

Microsoft announces a new Office app for Windows 10

Microsoft announces the public preview of Windows 10 IoT Core Services

Mobile World Congress 2018: Lenovo announces two new Windows 10 PCs

CES 2018: iBUYPOWER, MSI and ORIGIN announce new Windows 10 gaming PCs