From 13646c768ad95ba5c9a71e9c36c81338e2547137 Mon Sep 17 00:00:00 2001 From: Paolo Matarazzo <74918781+paolomatarazzo@users.noreply.github.com> Date: Thu, 11 Apr 2024 07:56:11 -0400 Subject: [PATCH] Add hardware root-of-trust and silicon-assisted security features to security book --- .../book/images/hardware-root-of-trust.svg | 19 ------------------- .../book/includes/hardware-root-of-trust.md | 3 ++- .../includes/silicon-assisted-security.md | 8 ++++++-- 3 files changed, 8 insertions(+), 22 deletions(-) delete mode 100644 windows/security/book/images/hardware-root-of-trust.svg diff --git a/windows/security/book/images/hardware-root-of-trust.svg b/windows/security/book/images/hardware-root-of-trust.svg deleted file mode 100644 index 1ef4ebad7c..0000000000 --- a/windows/security/book/images/hardware-root-of-trust.svg +++ /dev/null @@ -1,19 +0,0 @@ - - - - - - - - - - - - - - - - - - - diff --git a/windows/security/book/includes/hardware-root-of-trust.md b/windows/security/book/includes/hardware-root-of-trust.md index 4e97d12816..5b303f9b2d 100644 --- a/windows/security/book/includes/hardware-root-of-trust.md +++ b/windows/security/book/includes/hardware-root-of-trust.md @@ -7,7 +7,8 @@ ms.topic: include ## Hardware root-of-trust -:::image type="content" source="..\images\hardware-root-of-trust.svg" alt-text="Diagram containing a list of features." border="false"::: +- [Trusted Platform Module (TPM)](#trusted-platform-module-tpm) +- [Microsoft Pluton security processor](#microsoft-pluton-security-processor) ### Trusted Platform Module (TPM) diff --git a/windows/security/book/includes/silicon-assisted-security.md b/windows/security/book/includes/silicon-assisted-security.md index 7e29c7831a..d07b2992ab 100644 --- a/windows/security/book/includes/silicon-assisted-security.md +++ b/windows/security/book/includes/silicon-assisted-security.md @@ -7,10 +7,14 @@ ms.topic: include ## Silicon assisted security -:::image type="content" source="..\images\silicon-assisted-security.svg" alt-text="Diagram containing a list of features." border="false"::: - In addition to a modern hardware root-of-trust, there are numerous other capabilities in the latest chips that harden the operating system against threats by protecting the boot process, safeguarding the integrity of memory, isolating security-sensitive compute logic, and more. +- [Secured kernel](#secured-kernel) +- [Hardware-enforced stack protection](#hardware-enforced-stack-protection) +- [Kernel Direct Memory Access (DMA) protection](#kernel-direct-memory-access-dma-protection) +- [Secured-core PC](#secured-core-pc) + - [Secured-core configuration lock](#secured-core-configuration-lock) + ### Secured kernel To secure the kernel we have two key features: virtualization-based security (VBS) and hypervisor-protected code integrity (HVCI). All Windows 11 devices will support HVCI and most new devices will come with VBS and HVCI protection turned on by default.