Windows 8 takes security to the next level

Say what you like about the new Windows 8 GUI, the new security features put Windows 8 way ahead of the competition

Windows 8 is meeting mixed reviews, to put it mildly -- just ask InfoWorld's Woody Leonhard or J. Peter Bruzzese. Most of the negative reviews I've read talk about the frustrations of Metro on the desktop and the lack of a Start button.

From a security perspective, that bad press is too bad, because security improvements in Windows 8 make it one of the most secure operating systems on the planet. That might sound like hyperbole -- until you consider all the new stuff that's been rolled in. Check them out below. (Note: I am a full-tiime employee of Microsoft.)

[ Also on InfoWorld: The Microsoft faithful will find lots of helpful tips in the diehard's guide to making the most of Windows 8. | Get ready for Windows 8 with the Windows 8 Deep Dive PDF special report, which explains Microsoft's bold new direction for Windows, the new Metro interface for tablet and desktop apps, the transition from Windows 7, and more. | Find out how to secure your systems with InfoWorld's Security Central newsletter. ]

Secure Boot
Windows 8's Secure Boot feature builds on the open standard UEFI (Unified Extensible Firmware Interface) specification to make Windows incredibly resistant to malicious modification from preboot to full OS booting, preventing firmware attacks. The risk of firmware-attacking malware is rising, if you believe the National Institute of Standards and Technologies, the military, and many Fortune 100 CSOs.

Prior to UEFI and Secure Boot, you would be notified about malicious firmware and OS boot code modification in Windows only if you enabled BitLocker Drive Encryption with the Platform Configuration Registers (PCRs) configured (the default). However, enabling drive encryption to get a boot integrity solution was considered overkill by many.

UEFI and Windows Secure Boot only allow code signed by pre-approved digital certificates to run during the firmware and OS boot process. If anything unsigned tries to modify the boot process (think rootkit), the UEFI-based firmware will undo the change, as does the OS. After receiving a healthy and validated handoff from the firmware, it continues to ensure that only pre-approved, digitally signed code can be run.

Although other OSes can and will use UEFI secure boot, Windows 8 and Windows Server 2012 are the only OSes in which it will be enabled by default. Other than Google's Chromium OS, few other popular OSes have plans to implement UEFI-like protections or are still arguing about how to pull it off and when to implement.

Early-launch antimalware
Windows 8 extends its safe boot protection by ensuring that pre-approved antimalware software gets loaded before malware can take control. Previously, malware could "walk the interrupt vector chain" and get in front of the OS or antimalware software. Once that happened, it wasn't Microsoft's or your OS anymore. Now pre-approved antimalware software always gets loaded ahead of the malicious programs, which improves the chances of detection and removal.

SmartScreen
SmartScreen is the feature that has made Internet Explorer one of the safest browsers you can run. It has prevented millions of IE users from being infected each day. It does so using a combination of application reputation and website reputation and by looking for malicious behaviors.

1 2 Page
From CIO: 8 Free Online Courses to Grow Your Tech Skills
Join the discussion
Be the first to comment on this article. Our Commenting Policies