5 ms·
* Secure Boot * BitLocker: Hard-drive encryption backed by TPM & Secure Boot With the above two and DMA protection, physical access attacks become very diffic
by marcoperaza 10y ago
* Secure Boot
* BitLocker: Hard-drive encryption backed by TPM & Secure Boot
With the above two and DMA protection, physical access attacks become very difficult.
* Virtual Secure Mode (VSM) - separate OS running on the hypervisor that can perform sensitive operations. Which enables:
1. Device Guard - Runs code integrity protection, i.e. only allowing signed code to run, from within the VSM.
2. Credential Guard - Runs user-mode security subsystem (LSA) inside VSM.
- semi-extrinsic 10y agoRegarding hard drive encryption backed by TPM, a) this has been a thing since Win7, and b) google tells me it only works OOTB on Win10 if you sign into Windows with your Microsoft account; how many people do that? If that's the secret sauce that makes Win10 so much better, color me unimpressed. And neither of those features offer additional protection against zero-days (neither does VSM), which are what the TFA discusses.
- marcoperaza 10y agoIt only works OOTB with a Microsoft Account because the OS needs a place to backup the key. The alternative is that if the user forgets their password, they lose their data forever. You can still turn it on manually very easily with a local account.
- chrisper 10y agoI am running Bitlocker without a Microsoft Account. You can just print out the recovery key instead (or you can just configure bitlocker through command line).
- AlexandrB 10y ago> With the above two and DMA protection, physical access attacks become very difficult. Physical attacks aren't part of my threat model on a desktop PC. Indeed these protections feel more like DRM - trying to protect the computer from the (legitimate) user.
- marcoperaza 10y agoPreventing unsigned code from running, and choosing which sources of software you do want to trust, is not just for DRM. It severely reduces the attack surface of a device and makes it much harder for user error to cause a compromise. Accidentally getting compromised is possible for advanced users, let alone the most tech-illiterate person in the company. iOS being totally locked down in this way is no small part of why exploits for that platform sell for so much more money than exploits for other platforms. Of course, it is also used for DRM on that platform.
- marcoperaza 10y agoAnd to add to my previous comment, I can't see why you would want to keep your laptop or desktop unencrypted. If someone steals your computer, they have access to all of your data. And without Secure Boot and/or TPM-backed key management, hard disk encryption becomes vulnerable to someone planting a modified boot loader or firmware on your system.
- lineindc 10y agoWeren't all of those in 8?