Microsoft Introduces Secured Core PCs W. Firmware Protection

Microsoft Introduces Secured Core PCs W. Firmware Protection

CLICK HERE - https://tiurll.com/2thWb5

Certified Secured-core server hardware from an OEM partner provides more security protections that are useful against sophisticated attacks. Certified Secured-core server hardware can provide increased assurance when handling mission critical data in some of the most data sensitive industries. A Secured-core server uses hardware, firmware, and driver capabilities to enable advanced Windows Server security features. Many of these features are available in Windows Secured-core PCs and are now also available with Secured-core server hardware and Windows Server 2022. For more information about Secured-core server, see Secured-core server.

Firmware executes with high privileges and is often invisible to traditional anti-virus solutions, which has led to a rise in the number of firmware-based attacks. Secured-core servers measure and verify boot processes with Dynamic Root of Trust for Measurement (DRTM) technology. Secured-core servers can also isolate of driver access to memory with Direct Memory Access (DMA) protection.

The role of the Windows PC and trust in technology are more important than ever as our devices keep us connected and productive across work and life. Windows 10 is the most secure version of Windows ever, built with end-to-end security for protection from the edge to the cloud all the way down to the hardware. Advancements like Windows Hello biometric facial recognition, built-in Microsoft Defender Antivirus, and firmware protections and advanced system capabilities like System Guard, Application Control for Windows and more have helped Microsoft keep pace with the evolving threat landscape.

During UEFI boot phase, the SMM Supervisor is loaded as a UEFI driver. This driver is signed by AMD and authenticated by the Platform Security Processor (PSP) at the time of DRTM launch. Failure of authentication will fail DRTM. (It is also under firmware anti-rollback protection by PSP.)

AMD Ryzen PRO processors fully support the Microsoft Secured-core PC initiative, which helps to boot securely, protect device from firmware vulnerabilities, shield the operating system from attacks, and prevent unauthorized access to devices and data with advanced access controls and authentication systems.

This feature (or platform secure boot) helps defend against threats to firmware. It is designed to provide protection in response to growing firmware-level remote attacks being seen across the industry. AMD Secure Boot extends the AMD silicon root of trust to help protect the system by establishing an unbroken chain of trust from the AMD silicon root of trust to the BIOS. The UEFI secure boot helps continue the chain of trust from the system BIOS to the OS Bootloader. This feature helps defend against remote attackers seeking to embed malware into firmware.

Secured-core PCs feature another layer of security underneath the operating system to protect the boot process from firmware attacks. A key Secured-core PC device requirement is Windows Defender implementing System Guard Secure Launch using new hardware capabilities from AMD, Intel, and Qualcomm. System Guard leverages firmware to start the hardware and then shortly after reinitialize the system into a trusted state. Using the OS boot loader and processor capabilities, it sends the system down a well-known and verifiable code path.

Another requirement of Secured-core PCs is Trusted Platform Module (TPM) 2.0, which lets admins measure the components used to verify that a device booted securely. Additionally, Windows monitors and restricts the functionality of potentially dangerous firmware through System Management Mode (SMM).

Secured-core is a new feature of Microsoft Windows Server 2022 that brings powerful threat protections together to provide multi-layer security across hardware, firmware, and the operating system. It uses the Trusted Platform Module 2.0 and System Guard to boot up Windows Server securely and minimize risks from firmware vulnerabilities.

To be certified for Secured-core, new server firmware protection features are required. Currently only ThinkSystem servers with 3rd Gen Intel Xeon Scalable processors and AMD EPYC 7003 Series processors are certified. The ThinkSystem servers with newer processors are also planned in the near future.

This document introduces Secured-core feature, and shows users how to enable it on supported Lenovo ThinkSystem servers. This paper is intended for IT specialists and IT administrators who are familiar with security features of Windows Server and want to enable Secured-core on applicable Lenovo servers running Windows Server 2022.

The software giant's Secured-core PC (opens in new tab) initiative first launched back in 2019 and so far Dell, Dynabook, Getac, HP, Lenovo, Fujitsu, Acer, Asus, Panasonic and Microsoft have created ultra-secure laptops designed to protect users against firmware level threats.

While a release date has not yet been set for the new Surface Laptop 4 powered by AMD Ryzen Mobile Processors, the device joins the Surface Pro X (opens in new tab) as the second secured-core PC offering in the Surface portfolio.

1 Secured-core PCs use hardware-based security components like Trusted Platform Module 2.0 (TPM) and modern CPUs along with virtualization-based security (VBS) and Windows hypervisor code integrity (HVCI) service to create a secure, hardware-isolated environment that effectively isolates memory and critical components to prevent attacks and unauthorized access to critical parts of the operating system. The Secured-core PC relies on advanced security capabilities built into modern CPUs to protect the integrity of Windows and its boot process from advanced attacks at the firmware level. Requires specialized hardware, including fingerprint reader, illuminated IT sensor or other biometric sensors and capable devices.

Secure Boot is a security feature found in the UEFI standard, designed to add a layer of protection to the pre-boot process: by maintaining a cryptographically signed list of binaries authorized or forbidden to run at boot, it helps in improving the confidence that the machine core boot components (boot manager, kernel, initramfs) have not been tampered with.

Although Microsoft introduced Advanced Threat Protection in Windows Server 2019, new threats posing increased risks for organizations keep emerging. In response, Microsoft further improved security in Windows Server 2022, including new key security features such as hardware root-of-trust, firmware protection, and virtualization-based security.

It is important to note that Pluton is very much like the Secure Enclave or TrustZone systems on macOS/iOS/Android systems, with a full (secure) CPU core, its own small onboard RAM, ROM, RNG, fuse bank, and so forth. For (obvious) security reasons, Pluton only boots officially-signed Microsoft firmware and carries anti-downgrade protections inherited from the Xbox. On non-Windows systems like Linux, Pluton quietly degrades into only a generic TPM 2.0 implementation.

The minimum hardware requirements to run both Windows 11 Pro and 11 Home are identical. These system requirements include a minimum of 4 GB of RAM, 64 GB of hard-drive storage, a 1 GHz dual-core CPU from either AMD, Intel, or Qualcomm, TPM 2.0, Secure Boot capable firmware, and a DirectX 12-compatible GPU. 153554b96e

https://www.chezleonidas.com/group/mysite-200-group/discussion/7e4d5ca8-2fcd-4eb2-8825-c8b1974e1b34

https://www.grantey.com/group/grantey-group/discussion/2bcd40ba-3a70-4e0f-b3a3-07d1ca36a8dc

https://www.spiritbuildersinc.com/group/spiritbuildersinc-group/discussion/59929d04-fb21-432d-8093-588cb6402f6c