Microsoft announces new Windows 11 security, encryption features

[MMT]

Microsoft says that Windows 11 will get more security improvements in upcoming releases, which will add more protection against cybersecurity threats, offer better encryption, and block malicious apps and drivers.

"In a future release of Windows 11 you're going to see significant security updates that add even more protection from the chip to the cloud by combining modern hardware and software," said David Weston, VP for Enterprise & OS Security.

One of the new security features Microsoft is adding in Windows 11 is enhanced phishing protection against targeted phishing attacks with the help of Microsoft Defender SmartScreen, a cloud-based anti-phishing and anti-malware service.

With SmartScreen integrated into the OS, Windows users will be warned when entering their credentials into malicious applications or hacked websites.

As proof of SmartScreen's efficiency, Weston said Microsoft has blocked over 25.6 billion Azure Active Directory brute force authentication attacks and was able to intercept more than 35.7 billion phishing emails before landing in the recipients' inboxes just in the last year alone.

"These enhancements will make Windows the world's first operating system with phishing safeguards built directly into the platform and shipped out of the box to help users stay productive and secure without having to learn to be their own IT department," he added.

Windows 11 enhanced phishing protection (Microsoft)

Protection for user data and against malicious drivers 

Weston also said Windows 11 users would get additional layers of security that protect their data and act as a defense against malicious drivers.

The newly planned Personal Data Encryption feature, for instance, protects users' files and data when they are not signed into the device by blocking access until they authenticate via Windows Hello.

"To access the data, the user must first authenticate with Windows Hello for Business, linking data encryption keys with the user's passwordless credentials so even if a device is lost or stolen, data is more resistant to attack and sensitive data has another layer of protection built in," Weston said.

Windows 11 customers will also be able to enable a vulnerable driver blocklist that uses Windows Defender Application Control (WDAC) to block drivers with known vulnerabilities automatically.

It hardens Windows systems against third party-developed drivers with any of the following attributes:

• Known security vulnerabilities that attackers can exploit to elevate privileges in the Windows kernel
• Malicious behaviors (malware) or certificates used to sign malware
• Behaviors that are not malicious but circumvent the Windows Security Model and can be exploited by attackers to elevate privileges in the Windows kernel

Microsoft Vulnerable Driver Blocklist (David Weston)

Windows 11 app, enterprise security improvements

Smart App Control is another crucial security enhancement planned for Windows 11 that will be integrated with the OS at the process level to block users from running malicious apps using code signing coupled with an AI model.

"When a new application is run on Windows 11, its core signing and core features are checked against this model, ensuring only known safe applications are allowed to run," Weston added.

"This means Windows 11 users can be confident they are using only safe and reliable applications on their new Windows devices."

Windows 11 Smart App Control (Microsoft)

Microsoft also wants to enable Credential Guard by Default and additional protection for Local Security Authority (LSA) for organizations using Windows 11 Enterprise to improve security in enterprise environments further.

The company's engineers have also added other security enhancements to secure Windows 11 users' accounts, devices, and apps since this new version's release in October 2021.

Probably the most important of them, named Config Lock, locks security settings to have them automatically reverted if end-users or attackers try to modify them.

 

 

 

 

ARTICLE

It utilizes MDM policies to monitor and revert registry keys to the original states if users are altering them, likely rendering their devices insecure and exposed to attacks.