BATTLE OF SKM AND IUM

THREE KEY VBS FEATURES BEING INTRODUCED
• Device Guard [ref: RSA 2015 Microsoft Presentation]
• Device Guard allows enterprises to strictly control the execution of everything from PowerShell scripts, to usermode
DLLs and executables, to kernel-mode drivers – can even include anonymous executable memory
• Credential Guard [ref: BlackHat 2015 Microsoft Presentation]
• Credential Guard allows cryptographic secrets (normally owned by LSA, the Local Security Authority) to be kept
in memory that cannot be read from anyone on the machine, regardless of privilege level or even hardware
access
• Guarded Fabric and vTPM (Virtual TPM) [ref: Microsoft Ignite 2015 Presentation]
• vTPM allows using BitLocker to function on Virtual Machines and to keep data encrypted at all times
• Shielded VMs leverage vTPM and other security features to make memory owned by the VM invisible to Host