Jul 20 2022

Windows 11 Includes Features That Enforce Zero Trust

Microsoft’s new OS requires security features to be used; no opting out.

A zero-trust environment trusts nothing. It demands authentication for as many tasks, both hardware and software, as possible and ensures that devices grant access to the least amount of information required. Microsoft has made sure that its newest OS is compatible with and even helps to enforce that environment.

In Windows 11, rather than simply offering new security features, Microsoft requires that they be used and has stepped up the hardware security requirements for PCs running the new OS. Here are some ways Windows 11 helps enforce zero trust.

Click the banner below to get access to customized content by becoming an Insider.

1. Passwordless Authentication

Released with Windows 10, Microsoft face recognition software also makes an appearance in Windows 11. Windows Hello allows users to keep information protected and to drop passwords entirely in favor of more secure cryptographic identification.

In Windows 10, Windows Hello was disabled by default. In Windows 11, Windows Hello will be on by default, and Windows will prompt you to set it upon your first sign-in.

2. Cloud-Based Zero-Trust Policies

Administrators in large agencies already rely on various security policies to harden devices and communication. Windows 11 brings a method of validating cloud resources at scale, known as Microsoft Azure Attestation.

Microsoft Azure Attestation is a policy-driven service that creates a cryptographic token from a device’s Trusted Platform Module 2.0 chip. That token is then provided to Azure to authenticate an endpoint’s identity. Administrators can create and upload attestation policies via the Microsoft Azure Attestation service in the Azure portal.

EXPLORE: 5 questions to ask before your agency adopts windows 11.

3. Virtualization-Based Security

In response to historic attacks like Spectre and Meltdown, Windows 11 includes the successor to the memory integrity feature known as Hypervisor-protected Code Integrity. HVCI, enabled by default, virtualizes memory and processes data in silos.

Virtualizing and segmenting memory allows devices to adhere to the zero-trust model by executing instructions in complete isolation. Administrators may control this feature via a registry key.

4. Secure Boot by Default

Secure Boot, a Unified Extensible Firmware Interface feature released with Windows 10, makes a comeback in Windows 11. Secure Boot creates a digital signature that prevents malicious binaries from executing on boot-up. Previously an optional feature, Secure Boot now becomes mandatory in Windows 11.

gorodenkoff/Getty Images

Zero Trust–Ready?

Answer 3 questions on how your organization is implementing zero trust.