MICROSOFT_PRESS_EBOOK_INTRODUCING_WINDOWS_10

Locking down enterprise PCs with Device Guard
Device Guard is a new feature that allows IT pros to lock down a device so tightly that it is incapable
of running untrusted software, effectively neutering any attacker or exploit that works by convincing
users to run a malicious program. In this configuration, the only programs allowed to run are those that
are trusted, and even programs that bypass other security layers by exploiting a zero-day vulnerability
are thwarted.
Even if an attacker manages to take over the Windows kernel, that person still won’t be able to run
malicious or unknown executable code, thanks to a key architectural feature of Device Guard. The trust
decision for any application is performed using Windows Code Integrity services, which run in Virtual
Secure Mode, a Hyper-V protected container that runs alongside Windows. This service makes trust
decisions based on signatures that are protected by the UEFI firmware and by antitampering features.
To deploy Device Guard, your hardware and software must meet the following requirements:
■■
■■
■■
■■
■■
The device must be running Windows 10 Enterprise.
The UEFI firmware must be version 2.3.1 or higher, with Secure Boot enabled and a secure firmware
update process. For additional security against physical attacks, Microsoft recommends
locking firmware setup to prevent changes in UEFI settings and to block startup using other
operating systems.
Virtualization-based security features require Hyper-V, which runs only on 64-bit PCs that
support Intel VT-x or AMD-V virtualization extensions and Second Level Address Translation.
A VT-d or AMD-Vi input/output memory management unit is required to provide additional
protection against memory attacks.
A Trusted Platform Module is optional, but highly recommended.
In addition to enabling Hyper-V, you must also enable the Isolated User Mode feature, as shown in
Figure 5-3.
FIGURE 5-3 Enabling the Isolated User Mode feature is a prerequisite to configuring Device Guard mode.
62 CHAPTER 5 Security and privacy in Windows 10