MICROSOFT_PRESS_EBOOK_INTRODUCING_WINDOWS_10

During the sign-in process, the Windows 10 PC can connect using Bluetooth to access Microsoft
Passport on the user’s Windows 10 Mobile device, which is generally in the user’s possession. The
combination of an enrolled device and a PIN or biometric proof of identity enables sign-in to all
PCs, networks, and web services, locally or remotely. And none of those devices, networks, or services
require that a password be stored or transmitted. That makes it impossible for a thief to steal
credentials using phishing techniques, keyloggers, or other attacks.
Blocking malware
Successfully resisting malware and phishing attacks starts with some fundamental security features that
have protected the core of the operating system for several years. The first two features are designed
to protect against exploits that use vulnerabilities such as buffer overruns in the operating system and
in applications:
■■
Address Space Layout Randomization (ASLR) This feature randomizes how and where
important data is stored in memory, making it more likely that attacks that try to write directly
to system memory will fail because the malware can’t find the specific location it needs to attack.
Windows 8.1 and Windows 10 increase the level of entropy significantly from Windows 7,
making it more difficult for most exploits to succeed. In addition, ASLR is unique across devices,
making it more difficult for an exploit that works on one device to also work on another.
■■
Data Execution Prevention (DEP) This feature substantially reduces the range of memory
that code (including malicious code) can run in. Beginning with Windows 8, hardware-based
DEP support is a requirement; Windows 10 will not install on a device that lacks this feature. DEP
uses the Never eXecute (NX) bit on supported CPUs to mark blocks of memory so that they can
store data but never run code. Therefore, even if malicious users succeed in loading malicious
code into memory, they are unable to run it.
Windows Defender
In Windows 7, Windows Defender is the name of a limited antispyware solution. Beginning with
Windows 8 and continuing in Windows 10, Windows Defender is a full-featured security solution (and
the successor to Microsoft Security Essentials) capable of detecting all sorts of malicious software.
Because it supports the ELAM feature, described earlier in this chapter, it also prevents rootkits that try
to infect third-party boot drivers. In Windows 10, Windows Defender also includes network behavior
monitoring.
Windows Defender is designed to be unobtrusive, updating automatically and providing messages
only when required to do so. It is intended primarily for use in unmanaged PCs. In enterprise settings,
you’ll probably want to use an alternative antimalware solution. Microsoft’s System Center Endpoint
Protection, which uses the same engine as Windows Defender and also includes support for ELAM,
is designed for use with enterprise-management tools. A number of third-party solutions that meet
those same criteria are also available.
CHAPTER 5 Security and privacy in Windows 10 69