Checklist: Select the Most Secure Hardware to Use with Windows 10
If your organization wants to take advantage of the enterprise level security features in Windows 10, then you must consider purchasing hardware that meets the standards in this checklist.
Over the last two and a half years during the development of Windows 10, Microsoft has continuously added and upgraded security features of the operating system as they have released each new feature update.
While these features benefit consumers with a system that is less vulnerable to attacks such as WannaCry and Petya, enterprise customers have seen even more in depth features added to secure the operating system and the data stored on these devices.
However, some of these new security features require certain types of hardware to fully take advantage of the capabilities.
Using this document at the Microsoft Hardware Development Center, here is a checklist of these key hardware specifications that will allow your business to fully use the security that is a standard part of Windows 10.
Note: These standards apply to the latest feature update for Windows 10, the Fall Creators Update, and the security features that are integrated into this release.
Central Processing Unit (CPU)
Intel (Through 7th Generation Processors)
Intel i3/i5/i7/i9-7x
Core M3-7xxx
Xeon E3-xxxx
Atom, Celeron, Pentium (Current)
AMD (Through 7th Generation Processors)
A Series Ax-9xxx
E Series Ex-9xxx
FX Series (FX-9xxx)
Process Architecture
Virtualization based security requires Windows Hypervisor and that is only supported on 64-bit IA processors or ARM v8.2 CPUs
Virtualization
System Processors have to support Input-Output Memory Management Unit (IOMMU) virtualization with all I/O devices protected by IOMMU/SMMU. Systems must have Intel VT-d, AMD-Vi, or ARM64 SMMUs.
Must have virtual machine extensions with Second Level Address Translation (SLAT). Systems must have Intel Vt-x with Extended Page Tables (EPT), or AMD-v with Rapid Virtualization Indexing (RVI).
These hardware virtualization features must be available to the operating system and reported to system firmware.
Trusted Platform Module (TPM)
Systems must have TPM version 2.0 or higher. This includes Intel (PTT), AMD, or discrete TPM from Infineon, STMicroelectronics, and Nuvoton.
The hardware must also comply with the Trustworthy Computing Group specification.
Platform Boot Verification
Must utilize cryptographically verified platform boot. This includes Intel Boot Guard in Verified Boot mode, AMD Hardware Verified Boot, and any OEM equivalent mode with same functionality.
Random Access Memory (RAM)
Minimum of 8 GB or higher required.
Firmware
There are six areas that a systems firmware must comply to meet these security specifications and take advantage of the enhanced security features in the Windows 10 Fall Creators Update:
Standard: Uses Unified Extension Firmware Interface (UEFI) version 2.4 or higher
Class: Uses UEFI Class 2 or Class 3
Code integrity: Inbox drivers are required to be Hypervisor-based Code Integrity (HVCI) compliant
Secure Boot: Must support UEFI Secure Boot and have it enabled by default
Secure MOR: Must use Secure MOR (Revision 2)
Updates: Must support Windows UEFI Firmware Capsule Update specification
Just to clarify, these specifications go above and beyond the minimum hardware requirements to run the Windows 10 Fall Creators Update.
By insuring your new hardware has the above security specifications you will be able to implement the following security features as part of the Fall Creators Update:
Windows Defender Application Control
Windows Defender Antivirus
Windows Defender Exploit Guard
Windows Defender Application Guard
Windows Defender System Guard
Windows Defender Advanced Threat Protection
Windows Defender Credential Guard
Windows Defender Device Guard
Windows Information Protection
Windows Hello
BitLocker and BitLocker To Go
You can learn more about the enterprise and business related security features for Windows 10 over at the Windows Security Center.
But, wait...there's probably more so be sure to follow me on Twitter and Google+.
About the Author
You May Also Like