3 ms·

I'm curious what you mean -- corporations really require this to control employee machines? I (naively?) thought they can be locked down well enough as-is. I d

I'm curious what you mean -- corporations really require this to control employee machines? I (naively?) thought they can be locked down well enough as-is. I don't know what companies do, so I'd love to hear more about this.

9x39 2y ago
Require might be too strong a word, because they do have the built-in OS policy controls plus all the 3rd party security tools, but TPM-based security enables a lot when you manage PC fleets. https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/how-windows-uses-the-tpm https://learn.microsoft.com/en-us/windows/security/hardware-... https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... Up until recent releases, fleets of PCs were shockingly vulnerable to off-the-shelf toolkits to dump credentials, escalating to root privileges, lateral movement, installation of remote access toolkits, and of course ransomware is the end game du jour recently, but data exfiltration happens as well. That's just one example of a glaringly vulnerable OS that's probably a rough explanation of most ransomware news stories. Ops groups are by and large happy to see Windows gaining hardening features we've been seeing in iOS/Android, which helps both reduce compromise but also authenticate employees easier when there's a chain of trust around identity involving the device the employee's authing from. A benefit is that official Microsoft features like these reduce user friction and security risk in tandem, but the TPM has ended up as the answer when you assume your adversary will get into your kernel without one.
tgma 2y ago
Fundamentally, if you want to make sure the client system that connects to your network service running the software/configuration you want unmodified, you want some help from the client to provide some cryptographic attestation and hope the keys cannot be physically extracted from the TPM chip to forge that proof in some other way. Now, let's say you have a policy that bans USB ports or requires some corporate spyware/antivirus to run and not get disabled by the user or else... this is the sort of stuff that IT desires.

9x39 2y ago

Require might be too strong a word, because they do have the built-in OS policy controls plus all the 3rd party security tools, but TPM-based security enables a lot when you manage PC fleets. https://learn.microsoft.com/en-us/windows/security/hardware-security/tpm/how-windows-uses-the-tpm https://learn.microsoft.com/en-us/windows/security/hardware-... https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-highly-secure-11 https://learn.microsoft.com/en-us/windows-hardware/design/de... Up until recent releases, fleets of PCs were shockingly vulnerable to off-the-shelf toolkits to dump credentials, escalating to root privileges, lateral movement, installation of remote access toolkits, and of course ransomware is the end game du jour recently, but data exfiltration happens as well. That's just one example of a glaringly vulnerable OS that's probably a rough explanation of most ransomware news stories. Ops groups are by and large happy to see Windows gaining hardening features we've been seeing in iOS/Android, which helps both reduce compromise but also authenticate employees easier when there's a chain of trust around identity involving the device the employee's authing from. A benefit is that official Microsoft features like these reduce user friction and security risk in tandem, but the TPM has ended up as the answer when you assume your adversary will get into your kernel without one.

tgma 2y ago

Fundamentally, if you want to make sure the client system that connects to your network service running the software/configuration you want unmodified, you want some help from the client to provide some cryptographic attestation and hope the keys cannot be physically extracted from the TPM chip to forge that proof in some other way. Now, let's say you have a policy that bans USB ports or requires some corporate spyware/antivirus to run and not get disabled by the user or else... this is the sort of stuff that IT desires.