• United States




Windows 8 takes security to the next level

Aug 21, 20125 mins
Access ControlData and Information SecurityEncryption

Say what you like about the new Windows 8 GUI, the new security features put Windows 8 way ahead of the competition

Windows 8 is meeting mixed reviews, to put it mildly — just ask InfoWorld’s Woody Leonhard or J. Peter Bruzzese. Most of the negative reviews I’ve read talk about the frustrations of Metro on the desktop and the lack of a Start button.

From a security perspective, that bad press is too bad, because security improvements in Windows 8 make it one of the most secure operating systems on the planet. That might sound like hyperbole — until you consider all the new stuff that’s been rolled in. Check them out below. (Note: I am a full-tiime employee of Microsoft.)

[ Also on InfoWorld: The Microsoft faithful will find lots of helpful tips in the diehard’s guide to making the most of Windows 8. | Get ready for Windows 8 with the Windows 8 Deep Dive PDF special report, which explains Microsoft’s bold new direction for Windows, the new Metro interface for tablet and desktop apps, the transition from Windows 7, and more. | Find out how to secure your systems with InfoWorld’s Security Central newsletter. ]

Secure Boot Windows 8’s Secure Boot feature builds on the open standard UEFI (Unified Extensible Firmware Interface) specification to make Windows incredibly resistant to malicious modification from preboot to full OS booting, preventing firmware attacks. The risk of firmware-attacking malware is rising, if you believe the National Institute of Standards and Technologies, the military, and many Fortune 100 CSOs.

Prior to UEFI and Secure Boot, you would be notified about malicious firmware and OS boot code modification in Windows only if you enabled BitLocker Drive Encryption with the Platform Configuration Registers (PCRs) configured (the default). However, enabling drive encryption to get a boot integrity solution was considered overkill by many.

UEFI and Windows Secure Boot only allow code signed by pre-approved digital certificates to run during the firmware and OS boot process. If anything unsigned tries to modify the boot process (think rootkit), the UEFI-based firmware will undo the change, as does the OS. After receiving a healthy and validated handoff from the firmware, it continues to ensure that only pre-approved, digitally signed code can be run.

Although other OSes can and will use UEFI secure boot, Windows 8 and Windows Server 2012 are the only OSes in which it will be enabled by default. Other than Google’s Chromium OS, few other popular OSes have plans to implement UEFI-like protections or are still arguing about how to pull it off and when to implement.

Early-launch antimalware Windows 8 extends its safe boot protection by ensuring that pre-approved antimalware software gets loaded before malware can take control. Previously, malware could “walk the interrupt vector chain” and get in front of the OS or antimalware software. Once that happened, it wasn’t Microsoft’s or your OS anymore. Now pre-approved antimalware software always gets loaded ahead of the malicious programs, which improves the chances of detection and removal.

SmartScreen SmartScreen is the feature that has made Internet Explorer one of the safest browsers you can run. It has prevented millions of IE users from being infected each day. It does so using a combination of application reputation and website reputation and by looking for malicious behaviors.

SmartScreen began life in IE8 and was significantly improved in IE9 and IE10. But that protection wasn’t being applied equally across the entire user experience. For example, what if the user ran a non-IE browser or was downloading content outside of the browser experience? Windows 8 developers worried as well, so SmartScreen was replicated to the entire OS. When you run Windows 8 or Windows Server 2012, you’re getting SmartScreen protection on every network download.

Dynamic Access Control Essentially, Dynamic Access Control is Windows access control (that is, file and folder permissions) on steroids. In the old model, you could limit access only by user or group membership. But with Windows 8 and Windows Server 2012, you can allow or deny access based upon almost any defined claim or attribute.

Claims can be almost any piece of data you store in Active Directory (AD) belonging to a particular security principal (such as a user or a group), including device ID, log-on method, location, and personal information. For example, you can allow access to a particular folder only to local users using a Windows Surface device. Or you can only allow access by the user’s pre-approved, company-issued iPad, but not to their personal, non-approved iPad. I have many customers who desperately want the latter ability without having to purchase third-party software. Microsoft Windows has always had solid, reliable access control; Dynamic Access Control ups the ante.

PC Refresh and Reset Sometimes no matter how many security features you have, you can’t stop end-users from bypassing all warnings and installing malware. It’s going to happen. Now you can reset Windows back to its original, known, clean safe state. You can choose between resetting everything to a blank slate or saving your application settings and data. You could do this in previous versions, but it always took a lot longer than simply clicking on a single button and acknowledging the warning prompt.

Normally, security features don’t sell anything. Features and flashy GUIs do. Many Windows competitors sell briskly despite being continually late to adopt security features Microsoft pushed early on, such as built-in full disk encryption, ASLR, DEP, and more. But Windows 8 takes a big step forward with added security features — out of the box, enabled from the start. Despite quibbles over the GUI, I have little doubt those improvements alone will sell millions of copies of Windows 8 to security-conscious customers.

This story, “Windows 8 takes security to the next level,” was originally published at Keep up on the latest developments in network security and read more of Roger Grimes’ Security Adviser blog at For the latest business technology news, follow on Twitter.


Roger A. Grimes is a contributing editor. Roger holds more than 40 computer certifications and has authored ten books on computer security. He has been fighting malware and malicious hackers since 1987, beginning with disassembling early DOS viruses. He specializes in protecting host computers from hackers and malware, and consults to companies from the Fortune 100 to small businesses. A frequent industry speaker and educator, Roger currently works for KnowBe4 as the Data-Driven Defense Evangelist and is the author of Cryptography Apocalypse.

More from this author