MICROSOFT_PRESS_EBOOK_INTRODUCING_WINDOWS_10

For each of these policies, you can also require a specific type of encryption for each drive type.
In Windows 8 and later versions, BitLocker supports a new type of storage device, the Encrypted
Hard Drive, which includes a storage controller that uses hardware to perform encryption operations
more efficiently. Encrypted Hard Drives offer Full Disk Encryption (FDE), which means encryption
occurs on each block of the physical drive rather than data being encrypted on a per-volume basis.
Windows 10 is able to identify an Encrypted Hard Drive device, and its disk-management tools
can activate, create, and map volumes as needed. API support in Windows 8.1 and later versions
allows applications to manage Encrypted Hard Drives independently of BitLocker Drive Encryption.
The BitLocker Control Panel allows users to manage Encrypted Hard Drives using the same tools as
on a standard hard drive.
Remote business data removal
In Windows 8.1 and later versions, administrators can mark and encrypt corporate content to distinguish
it from ordinary user data. When the relationship between the organization and the user ends,
the encrypted corporate data can be wiped on command using Exchange ActiveSync (with or without
the OMA-DM protocol). This capability requires implementation in the client application (Mail, for
example) and in the server application (Exchange Server). The client application determines whether
the wipe simply makes the data inaccessible or actually deletes it. This feature includes support for an
API that allows third-party apps to adopt the remote-wipe capability.
Securing identities
Passwords are, to put it mildly, notoriously ineffective at protecting devices and data. They’re too easily
stolen: on the client by keylogging software or phishing attempts, and on the server by data breaches
that give intruders access to large sets of user names and passwords. And because humans frequently
reuse those passwords, a breach on one site can lead to intrusions on other sites that use the same
credentials.
An attacker also can steal a user-access token from a compromised machine and then use that
token to steal additional tokens. The attacker never has the user name or password, but possessing a
stash of hashed credentials is good enough to allow persistent access over time. This technique is called
a “Pass the Hash” attack.
Windows 10 includes major architectural changes designed to fundamentally prevent both forms of
attack.
For starters, beginning with Windows 10 the derived credentials (hashes) that are used in “Pass the
Hash” attacks are moved into Virtual Secure Mode, the same Hyper-V–protected container that is used
for Windows Code Integrity services.
CHAPTER 5 Security and privacy in Windows 10 65