1. Passwordless Authentication
Released with Windows 10, Microsoft face recognition software also makes an appearance in Windows 11. Windows Hello allows users to keep information protected and to drop passwords entirely in favor of more secure cryptographic identification.
In Windows 10, Windows Hello was disabled by default. In Windows 11, Windows Hello will be on by default, and Windows will prompt you to set it upon your first sign-in.
2. Cloud-Based Zero-Trust Policies
Administrators in large agencies already rely on various security policies to harden devices and communication. Windows 11 brings a method of validating cloud resources at scale, known as Microsoft Azure Attestation.
Microsoft Azure Attestation is a policy-driven service that creates a cryptographic token from a device’s Trusted Platform Module 2.0 chip. That token is then provided to Azure to authenticate an endpoint’s identity. Administrators can create and upload attestation policies via the Microsoft Azure Attestation service in the Azure portal.
EXPLORE: 5 questions to ask before your agency adopts windows 11.
3. Virtualization-Based Security
In response to historic attacks like Spectre and Meltdown, Windows 11 includes the successor to the memory integrity feature known as Hypervisor-protected Code Integrity. HVCI, enabled by default, virtualizes memory and processes data in silos.
Virtualizing and segmenting memory allows devices to adhere to the zero-trust model by executing instructions in complete isolation. Administrators may control this feature via a registry key.
4. Secure Boot by Default
Secure Boot, a Unified Extensible Firmware Interface feature released with Windows 10, makes a comeback in Windows 11. Secure Boot creates a digital signature that prevents malicious binaries from executing on boot-up. Previously an optional feature, Secure Boot now becomes mandatory in Windows 11.
