Microsoft Details Windows 10 Security Enhancements

In a densely-worded blog post aimed at enterprises, Microsoft has laid out its plans to improve Windows 10 security and information protection. This is obviously a hot-button topic in today's post-Snowden world, but parsing through this post, I see a fairly evolutionary and even obvious set of improvements. Which doesn't do a thing to diminish their usefulness or necessity. Or the fact that these improvements apply to consumers too.

If you're feeling brave, you can read the full post, Windows 10: Security and Identity Protection for the Modern World. But here, I'm going to try and distill this down into plain English where possible.

The mile-high view

Microsoft says it is actively addressing modern security threats in Windows 10. It will strengthen identity protection and access control, information protection, and threat resistance.

The future

Windows 10 is not the end of passwords, but it's a step in that direction, and improvements to Microsoft account and Microsoft's enterprise management solutions will help get us there too. "With this release we will have nearly everything in place to move the world away from the use of single factor authentication options, like passwords," Microsoft's Jim Alkove writes in the post.

Identity and access control

In Windows 10, Microsoft will provide what it calls "a very modern approach to identity and user credentials," something that is very important now that we're using connected accounts—Microsoft accounts for individuals, domain accounts for business users—to identify ourselves on multiple devices and web sites.

Basically, Microsoft is pursuing a multi-factor security strategy—which makes sense—but doing so without requiring smart cards or other hardware peripheral devices. Instead, Windows 10 and the secure PC on which it runs will be able to provide this authentication, meaning that the PC becomes one of the two factors in user authentication. The second factor will be a PIN (typically just four characters) or a fingerprint or other biometric reader. (As we see on many Lenovo ThinkPads and, of course, Apple's i-Device TouchID sensor.)

So how will this work? Basically, you will enroll a device—like a smartphone—as one of your factors. (You can consider this your mobile credential.) Then, as long as that phone is nearby, you can simply sign in elsewhere—on other PCs or tablets, on web sites—without having to go through the currently-painful two-factor authentication sign-in that secure users endure today. Your phone behave will behave like a remote smartcard, offering two-factor authentication for both local sign-in and remote access.

If you're in a Microsoft infrastructure—with Active Directory, Azure Active Directory, or, as a consumer, Microsoft Accounts—this means you will be able to—as an enterprise or individual—move away from using passwords. (And yes, it will be supported immediately in Microsoft's platforms.) "This technology is intentionally being designed so that it can be adopted broadly across other platforms, the web, and other infrastructures," Alkove says.

Information protection

As you may know, Microsoft offers BitLocker on-disk encryption capabilities in Windows and cloud- and datacenter-based information protection technologies such as Azure Rights Management Services, Windows Rights Management Services, and Information Rights Management (IRM). These are all designed to ensure that private, sensitive documents cannot be seen by prying eyes. But they require work to enable or, in the case of the cloud/enterprise stuff, some serious infrastructure.

Windows 10 addresses this with a proactive data loss prevention (DLP) solution that separates corporate and personal data and helps protect it using containers.

Under this scheme, corporate apps, data, email, website content and other sensitive information will be automatically encrypted in Windows 10 (including Windows Phone), and that encryption will occur as it arrives on the device from corporate network locations. If you create new original content, DLP will "help users define which documents are corporate versus personal," though it's unclear how that will work. But companies will be able to ensure that all new content created on the device is corporate, and thus protected, by policy. Companies can also use policy to prevent users from copying data in corporate content to non-corporate documents or external locations on the web such as social networks.

Mitigating other threats

Windows 10 will continue to offer in-box anti-virus and anti-malware technologies, of course. But because this is such a troubling area—users often install malware inadvertently—Microsoft will extend the app sandboxing capabilities from Windows 8 so that any app—desktop, whatever—can be signed as trustworthy, and only trustworthy apps will be allowed on Windows 10 PCs and phones. This control can be provided by the hardware maker and by corporate policy. Obviously, Windows Store apps are all vetted and known good. But extending that capability to the desktop is the big news here.

"This lockdown capability in Windows 10 provides businesses with an effective tool in the fight against modern threats, and with it comes with the flexibility to make it work within most environments," Alkove writes.

This is all very dense stuff. And it's hard to arrive at any intelligent opinion about most of it until we can see the implementation. I'm eager to do so. Just as I'm eager to kiss passwords goodbye forever.