Blog Don’t Compromise: Secure Your Future With the Cutting-Edge Protections Built Into Windows 11
Windows 11: Secure by design. Secure by default.
By Norm Andersch / 12 Jan 2025 / Topics: Windows 11 Cybersecurity Windows 10
I hear this a lot as I speak to our clients regarding their device security posture: “Windows 10 is nearing end-of-life, but why should I care? I can pay for support after the end date and quite frankly our machines have been running fine, and I might add safe and secure. No breaches here.” I’m quick to remind them that “no news” on cyberattacks is not necessarily indicative of how perilous their device security posture really is, and here’s why.
Windows® 10 became generally available in July 2015. Do you think attackers are relying on 10-year-old software and hardware to perform their malicious activities? Absolutely not, and neither should you nor your organisation. Consider the following statistics:
- Features such as credential safeguards, malware shields, and application protection led to a reported 62% drop in security incidents, including a 3.0x reduction in firmware attacks.
- Enhanced phishing protection increases safety with businesses reporting 2.9x fewer instances of identity theft with the hardware-backed protection in Windows 11.
Windows 11 far surpasses Windows 10 in security with a suite of advanced features that provide comprehensive protection at every level.
- Trusted Boot ensures the integrity of the boot process, preventing rootkits and malware from infiltrating the system from the start.
- Enhanced cryptographic protocols in Windows 11 secure data transmission and storage with cutting-edge encryption standards. Streamlined certificate management and advanced code signing in Windows 11 ensure that only verified software and drivers are executed, reducing the risk of malicious code.
- Device Health Attestation continuously monitors device integrity, ensuring only compliant devices access sensitive resources.
- Windows 11’s granular security policy settings and sophisticated auditing capabilities provide superior control and visibility over security policies and compliance.
With Microsoft® Defender for Endpoint, Windows Security in Windows 11 offers advanced threat detection and response, far exceeding capabilities in Windows 10. Features like Config Refresh and Kiosk Mode add layers of protection for device settings and public-use environments, while Windows Protected Print secures sensitive print jobs. Windows 11’s integration of Rust for system-level code further enhances security by reducing memory-related vulnerabilities.
In essence, Windows 11 brings a fortified, multi-layered defense system that addresses modern threats more effectively than Windows 10, making it the clear choice for a secure computing environment.
So, Windows 11 is the clear choice, but wait… “I can run Windows 11 on any PC that supports Windows 10, so why update the machine?”
Just because you can, doesn’t mean you should.
Why running Windows 11 in relaxed mode isn’t secure.
Running Windows 11 in a relaxed mode, where many of the key security features are disabled or not fully utilized, significantly reduces the overall security of the system. Without these protections, the system becomes more vulnerable to:
- Firmware Attacks: Malicious firmware can persist even after the operating system is reinstalled, allowing attackers to gain deep access to the system.
- Boot Process Hijacking: Without Secure Boot, attackers can load unauthorised software during the boot process, leading to persistent malware infections.
- Memory Access Attacks: Without DMA protection, attackers can use high-speed interfaces to access sensitive data directly from system memory.
- Credential Theft: Without hardware-based security features, attackers can more easily steal credentials and encryption keys.
Windows 11’s enhanced security relies on advanced features like Secured-core PC capabilities, offering hardware-level protection against firmware attacks. These PCs integrate advanced hardware, firmware, and software protections to ensure top-tier security. Here’s a breakdown:
- Hardware Root of Trust: Secured-core PCs use TPM 2.0 (Trusted Platform Module) to ensure system integrity from the moment the device boots. This provides a secure foundation for the operating system and applications.
- Secure Boot: This feature ensures that only trusted software can run during the boot process. It prevents malicious software from hijacking the boot process and gaining unauthorised access to the system.
- Virtualisation-based Security (VBS): VBS leverages hardware virtualisation to protect critical system components and data. It isolates sensitive operations and data from the rest of the system, making it harder for attackers to compromise the system.
- System Guard Secure Launch: This feature protects the boot process from firmware attacks by ensuring that the system starts in a known good state. It uses hardware-enforced security to detect and prevent firmware-level threats.
- Direct Memory Access (DMA) Protection: Secured-core PCs include DMA protection to prevent unauthorised access to system memory through high-speed interfaces like Thunderbolt and PCIe. This helps protect against attacks that try to read or write to system memory without proper authorisation.
- Pluton Security Processor: Some secured-core PCs come with the Pluton Security Processor, which adds an extra layer of protection by isolating sensitive data like credentials and encryption keys. This processor helps protect against sophisticated attacks targeting the firmware.
The advanced security features of Windows 11, especially those provided by secured-core PCs, are essential for protecting against sophisticated attacks. Running Windows 11 in a relaxed mode compromises these protections and leaves the system vulnerable to a wide range of threats.
Time to move forward.
Upgrading to Windows 11 and embracing modern software and hardware isn’t just a preference — it’s critical for maintaining robust security in today’s digital landscape. Attackers are leveraging state-of-the-art hardware and software to exploit vulnerabilities, making it essential to stay ahead with the latest technology. Windows 11’s advanced security features provide unparalleled protection against sophisticated threats that older systems and software cannot match. Clinging to outdated technology exposes you to higher risks of breaches, data theft, and malware attacks. Windows 11 ensures that your defenses are as advanced as the threats you face, safeguarding your data, privacy, and peace of mind.
Start your journey forward. Insight and Windows 11 work together to enhance your workplace experience and protect your critical information.
Sources:
1 Techaisle. (Sept. 2024). Windows 11 Survey Report. Windows 11 results are in comparison with Windows 10 devices.
2 Techaisle, (Sept. 2024). Windows 11 Survey Report. Windows 11 results are in comparison with Windows 10 devices.
Norm Andersch
Sr. Cybersecurity Architect, Insight
Norm Andersch is a senior cybersecurity architect with Insight modern workforce team. His focus is on creating professional and managed services specifically for security and compliance. He holds numerous Microsoft certifications for Azure security, Entra ID and the entire suite of Microsoft Defender solutions.
