Microsoft reveals audacious plans to tighten security with Windows 10

ZDNet ^ | 10/22/2014 | Ed Bott

[SeekAndFind]

Summary: Windows 10 will build in standards-based two-factor authentication to every device, effectively neutering most phishing attacks and password database breaches. The company also announced new features aimed at securing corporate machines from malware attacks and data leaks.

Most of the early coverage of the Windows 10 Technical Preview has focused on the new Start menu, virtual desktops, and other highly visible parts of the user experience. But even in these early builds there are hints of much more momentous changes to come, especially in the crucial realm of security.

The most tantalizing hint so far has been a new service called Next Generation Credentials, which is installed but not started in the most recent preview builds.

Today, Microsoft revealed more details about its plans to "move the world away from the use of single factor authentication options, like passwords." The feature, which isn't currently enabled in Windows 10 Technical Preview builds, will allow the owner of a Windows 10 device (PC, tablet, or phone) to enroll that device as trusted for the purposes of authentication. In combination with a PIN or biometric proof, such as a fingerprint, the user will be able to sign in to any supported mobile service.

The PIN, Microsoft says, can be any combination of alphanumeric characters--it doesn't have to be restricted to a short numeric code. If that PIN is stolen in a database breach or phishing attack, the thief will be unable to access any services, because the hardware part of the two-factor authentication requirement isn't present. Likewise, a stolen device without the necessary PIN will be useless.

• Read more

The authentication scheme isn't proprietary. Instead, it's based on standards from the FIDO Alliance, whose membership includes a who's who of computing giants (Google, Microsoft, Lenovo, and more), banking and payments companies (BofA, PayPal, Visa and MasterCard), and established security firms like RSA and IdentityX.

On the device itself, the required public and private keys can be issued by an enterprise using its existing PKI infrastructure, or for consumer devices they can be generated and securely stored by Windows 10 itself.

According to Microsoft, Windows 10 users will be able to enroll any or all of their devices with these new credentials. As an alternative, they can choose to enroll a single device, which then serves as a virtual smart card. A mobile phone, for example, can offer two-factor authentication using Bluetooth or WiFi for signing in on local devices or accessing remote resources.

The user access tokens themselves will be stored in a virtualized secure container (running on top of Hyper-V technology), eliminating the effectiveness of common attacks such as Pass The Hash.

In today's announcements. Microsoft also laid out two new features in Windows 10 that will tighten security for its enterprise customers. 

The first is a set of information-protection capabilities that make it possible to protect corporate data even on employee-owned devices. Windows 10, the company says, will allow network administrators to define policies that automatically encrypt sensitive information, including corporate apps, data, email, and the contents of intranet sites.

Because support for this encryption will be built into the APIs for common Windows controls, such as Open and Save dialog boxes, it will be available to all Windows apps that use those controls. For tighter security, administrators can create lists of apps that are allowed to access encrypted data as well as those that are denied access—a network administrator might choose to deny access to cloud services such as Dropbox, for example.

A final security measure is potentially a big winner for organizations with high-security needs, such as banks and other regulated industries as well as defense contractors and government agencies concerned about online espionage. With Windows 10 Enterprise edition and specially configured OEM hardware, administrators will be able to completely lock down devices so that they're unable to run untrusted code.

In this configuration, the only apps that will be allowed to run are those signed by a Microsoft-issued code-signing certificate. That includes any app from the Windows Store as well as desktop apps that have been submitted for approval through Microsoft. Enterprises with internal line of business apps can get their own key generator, which will allow those apps to run on their network but won't work outside the network.

For more details on the changes, see this blog post from Microsoft.

[Jeff Chandler]

if Microsoft quits automatically giving superuser privilege to ALL user accounts by default

Is there a way to configure a W7 or W8 account like that?

[Extremely Extreme Extremist]

Some folks set their sights pretty low I guess.

Not all of us are gamers, use their computers as music stations, or worship the Apple God.

I use my desktop for basic computer functions and applications, and XP fitted the bill. IMO, it was the best OS Microsoft has ever developed.

That's fine that Microsoft is developing new OSs, but XP should have been sold as a second-tier or budget OS.

[TexasRepublic]

Is Window 10 being marketed for home use as well? All that security mumbo-jumbo sounds too complicated for the average person to use, much less to configure. Will an on-site IT person be included with every purchase?

[haywoodwebb]

"Furthermore, my experience with those piles of security band-aids is that malware finds a way around them every time, and then those “security” band-aids turn into major impediments for removing the malware. In other words, the security measures don’t block the malware, but does block the sys admin efforts."

Yup!

[Resettozero]

Many applications contain code to check the version number of Windows, and assume Windows 95 or 98 if the version number starts with 9.

Rather than break all that old code they went to 10.

That so? Thanks for this explanation, Ken.

[discostu]

Looks like they’re going at it from the wrong side. Windows doesn’t need more front end security with more fancy ways to log in. It needs to separate administrator from root.

[Jack Hydrazine]

Has it been tested by a gaggle of hackurz?

[ken in texas]

At least I think that’s the explanation... have run across it in several other places. I understand the desire to not break something that works — spent many years of my life digging through old code to fix problems introduced by other software changes.

[catnipman]

“Is there a way to configure a W7 or W8 account like that? ‘

Indeed there is via control panel User Accounts -> manage other accounts -> create new account

for existing computers best bet is to create a new account called Admin, and after logging on to Admin, convert your old account to a limited user account, again via manage other account -> change account type.

put a password on Admin (say “password”) to neutralize accidentally clicking yes to any UAC popups on the limited account without first wondering why you got a UAC popup (usually a virus trying to install)

[zeugma]

I use my desktop for basic computer functions and applications, and XP fitted the bill. IMO, it was the best OS Microsoft has ever developed.

True enough, but the big problem with XP was always that it was a single-user mostly non-networtked OS with a decade's worth of bolt-ons and duct tape that would hold the whole mess together for a while, but ultimately was undermined by the fundamental weakness of the structure underneath it all.

I'm not a gamer either, nor do I personally own any apple products with the exception of a hand-me-down iphone 4, twice removed from its original owner.

I use computers to get jobs done, and occasionally to learn with. I want something designed to be multi-user from the ground up because we have more folks here than just me. I also want the OS to not get in the way or self destuct on me over time. For me, the answer has been Linux.  Some folks are apparently willing to accept the headaches and hassles of running windows, (i.e., registry cleanters, virus scanners, malware scanners, having to reload every year to keep any kind of appreciable performance), I'm not.

I've used many different kind of computers, and have supported everything from IBM mainframes, to HP and DEC minicomputers, to small LANs of workstations.  I have a lot of experience with different types of compters, and how they work and manage information. My rather lengthy experince with XP is that it's "OK", but a kludge. Using a "registry" the way that Microsoft does is pretty much broken as far as I'm concerned, for many reasons. People forget how utterly bad it was when it first came out. Most folks don't remember that it was pretty unusable until SP2.

However, because it was around long enough, and eventually became stable enough for most people who didn't know any better, it became familiar. It is the familiarity that people are so attached to IMO.

Personally, I'll never own a microsoft operating system untll two things happen.

1) a file should not be executable based on it's name.

2) the registry really has to go.

My 2 cents. YMMV

 

[Boogieman]

I think you’ve misunderstood me. I’m talking about the user accounts, not the users themselves. Of course the owner of the computer has to have admin privileges by default, every operating system in existence is set up the same way.

[catnipman]

“I think you’ve misunderstood me. I’m talking about the user accounts”

I did misunderstand you. But in response, almost ALL modern software from all but the one-off, rinky-dink software companies works just fine in limited-user accounts when installed system-wide. Very old software can be problematic too, but the big boys, like intuit, adobe, etc. have long since fixed those issues in newer versions.

For 99.99% of home users, limited-user accounts pose little, if any, problems. I’ve set up hundreds of computers this way for business and home and it works just fine, and their instance of malware attack has dropped to nil. Even if malware gets into a limited account, it can’t infect the system, so it’s easy to logoff the limited account, go the the Admin account and delete the malware files by hand or have a program like antimalwarebyes do it for you.

[stevestras]

This adds outrage to the already pathetic state of affairs. They can’t secure our passwords, or our personal machines in our homes and offices, but now they will insist on our biometric data and make it insecure as well.

A simple fact that remains is that it would be quite easy for MS to secure our machines. They choose not to.