From 011de9478eb9e5b8a6f4801ad2184b9b6ca94402 Mon Sep 17 00:00:00 2001 From: annashott-msft <97127709+annashott-msft@users.noreply.github.com> Date: Mon, 15 Jul 2024 11:14:32 -0600 Subject: [PATCH] Update identity-protection-advanced-credential-protection.md update VBS key protection verbiage to include developer action --- .../book/identity-protection-advanced-credential-protection.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/book/identity-protection-advanced-credential-protection.md b/windows/security/book/identity-protection-advanced-credential-protection.md index 83606ffc5d..8c803c6252 100644 --- a/windows/security/book/identity-protection-advanced-credential-protection.md +++ b/windows/security/book/identity-protection-advanced-credential-protection.md @@ -57,7 +57,7 @@ Administrator credentials are highly privileged and must be protected. When Remo ## VBS Key Protection -VBS key protection helps secure Windows keys using virtualization-based security (VBS). VBS uses the virtualization extension capability of the CPU to create an isolated runtime outside of the normal OS. When in use, VBS keys are isolated in a secure process, allowing key operations to occur without ever exposing the private key material outside of this space. At rest, private key material is encrypted by a TPM key which binds VBS keys to the device. Keys protected in this way cannot be dumped from process memory or exported in plain text from a user’s machine, preventing exfiltration attacks by any admin-level attacker. +VBS key protection enables developers to secure cryptographic keys using virtualization-based security (VBS). VBS uses the virtualization extension capability of the CPU to create an isolated runtime outside of the normal OS. When in use, VBS keys are isolated in a secure process, allowing key operations to occur without ever exposing the private key material outside of this space. At rest, private key material is encrypted by a TPM key which binds VBS keys to the device. Keys protected in this way cannot be dumped from process memory or exported in plain text from a user’s machine, preventing exfiltration attacks by any admin-level attacker. ## Token protection