Windows 11 Security

This chapter covers all aspects of Windows 11 security. While we have covered some aspects of security in some of the previous chapters of this book, we will look at them collectively and in more detail in this single security-focused chapter. If you are a security professional, this chapter is dedicated to your role and responsibilities in securing Windows 11 in a company.

The attacker’s chain of events can be prevented and disrupted through a zero-trust and defense-in-depth approach. We need to put multiple obstacles in the attacker’s way and increase their attack costs so that they will move on to launching an easier attack elsewhere that offers the least resistance. We will look at both of these approaches in subsequent sections of this chapter and understand why it is important to implement a good security posture to address these threats.

In this chapter, we’ll learn about the following:

• Introducing security posture
• Zero...

Introducing security posture

A security strategy must start from an inward look at a company’s current security position and secure score. A secure score is like a credit-rating score, but it looks at your positioning on the attack vulnerability scale of 1 to 10.

A security posture refers to an organization’s current threat-protection and threat-response capabilities. This ensures that an organization has the ability for systems, data, and identities to be recoverable and operational should an attack be successful.

It is critical to understand that we cannot prevent or eliminate threats and attacks, and the fact is that an attacker only has to be successful once, while you must protect everything all the time.

A security posture’s goal should be to reduce exposure to threats, shrinking attack surface areas and vectors while building resilience to attacks, as they cannot be eliminated.

A security strategy and security posture should use the guiding principles...

Zero trust

With many companies embracing a hybrid workforce, a new security model mindset is required more than ever. We need to adopt a holistic approach to security, a model that thinks beyond traditional network-perimeter-based security. The traditional firewalls and security-service-controlled network perimeters have vanished due to this hybrid workforce.

Zero trust, which uses the never trust, always verify approach, is not a service or solution but a wider security strategy and framework to be adopted. It ensures compliance and securing of access to the resources rather than the location or network it is on. We must not assume trust because of the device or resource’s network or location. We can no longer assume trust based on identity or self-attestation.

The zero-trust framework is built upon the following foundational principles:

• Assume breach: From the start, we must adopt the mindset that there is a breach; it is all about damage limitation. As it is...

Defense in depth

When considering securing Windows 11 in our enterprises, we should take a defense-in-depth (DiD) approach. This means we should not rely on a single security layer solution.

Adopting a DiD strategy allows an organization to adopt a strong security posture and helps ensure that all systems, data, and users are better protected from threats and compromise. A DiD strategy means no single layer of protection or security service is solely responsible for protecting resources. Still, you can slow down an attack path by implementing many different types of defense at individual layers. It may successfully breach one defensive layer but be halted by subsequent protection layers, preventing the protected resource from being exposed. The following figure shows that DiD as a concept is nothing new as a strategy; it can be considered the medieval castle concept of protecting resources:

Figure 8.2 – Medieval castle defense approach

The medieval...

Ensuring hardware security

We need to secure our hardware through device protection. Hackers have historically easily compromised a device before it is booted by dropping in rootkit malware without it even being noticed. It remains undetected after the device starts.

Trusted Platform Module (TPM), the Microsoft Pluton security processor, Hypervisor-Protected Code Integrity, and Windows Defender System Guard are all measures that can be used to provide the integrity of the device and OS before it even starts up. We will look at these measures in detail in the following sections.

TPM

TPM is a hardware-based security measure that provides tampering protection and can provide device health attestation. At the heart of TPM is a secure crypto-processor chip used for actions such as cryptographic key generation, storing, and use limitation.

Device health attestation enables trust to be established for a managed device based on the hardware and software components under the control...

Ensuring that we operate system security

As a part of our defense-in-depth look at securing Windows 11 systems, this section looks at the security measures we can take to protect the OS. These include Secure Boot and Trusted Boot, the Windows Security app, encryption, security baselines, and Defender, which we will discuss in the following sections.

Introducing Secure Boot and Trusted Boot

Secure Boot and Trusted Boot work together to provide OS-level protection of a Windows device during startup, preventing the loading of malware and corrupted components.

The initial boot-up protection is carried out by Secure Boot. The firmware is verified that it is digitally signed, and then all code that runs before the OS is checked by Secure Boot.

The digital signature of the OS bootloader is then checked to ensure the Secure Boot policy will trust it and that there has been no tampering.

Trusted Boot then picks up the process. The digital signal of the Windows kernel is verified...

Ensuring user identity security

In our defense-in-depth look at securing Windows 11 systems, this section looks at the security measures we can take to protect user identity security. This section will cover Windows Hello for Business and Microsoft Defender Credential Guard.

Windows Hello for Business

Windows Hello for Business is a secure authentication solution that uses two-factor authentication on devices to replace passwords. The two factors used for authentication are a device-tied user credential and a biometric or PIN. A PIN is more secure than a password as it is tied to the device.

The following problems with passwords are addressed with Windows Hello:

• It’s difficult to remember strong passwords, leading to reuse across sites
• Passwords can be exposed upon breach/phishing attacks
• Replay attacks on passwords

Windows Hello authenticates user identities to allow them access to the following:

• Microsoft Account
• Microsoft Active...

Summary

We should reiterate the relevance of what has been learned in this chapter by understanding that an attack chain of events can be prevented and disrupted through a zero-trust and defense-in-depth approach. We covered various aspects of hardware security and OS security, particularly Windows 11 security. We concluded the chapter with a section on user identity security, where we looked at Windows Hello for Business and Microsoft Defender Credential Guard.

By implementing these measures and adopting security posture management, we can make an attacker consider an easier attack elsewhere that offers the least resistance by putting multiple obstacles in the attacker’s way and increasing their attack costs.

In the next chapter, we will cover advanced topics of configuration for use cases in the enterprise.