diff --git a/windows/security/includes/sections/identity.md b/windows/security/includes/sections/identity.md index 61ad10748b..b31aaf1ca9 100644 --- a/windows/security/includes/sections/identity.md +++ b/windows/security/includes/sections/identity.md @@ -22,7 +22,7 @@ ms.topic: include |:---|:---| | **[Windows LAPS](/windows-server/identity/laps/laps-overview)** | Windows Local Administrator Password Solution (Windows LAPS) is a Windows feature that automatically manages and backs up the password of a local administrator account on your Azure Active Directory-joined or Windows Server Active Directory-joined devices. You also can use Windows LAPS to automatically manage and back up the Directory Services Restore Mode (DSRM) account password on your Windows Server Active Directory domain controllers. An authorized administrator can retrieve the DSRM password and use it. | | **[Account Lockout Policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)** | | -| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take pre-emptive action before their password is used against them or their organization. | +| **[Enhanced phishing protection with SmartScreen](/windows/security/threat-protection/microsoft-defender-smartscreen/phishing-protection-microsoft-defender-smartscreen)** | Users who are still using passwords can benefit from powerful credential protection. Microsoft Defender SmartScreen includes enhanced phishing protection to automatically detect when a user enters their Microsoft password into any app or website. Windows then identifies if the app or site is securely authenticating to Microsoft and warns if the credentials are at risk. Since users are alerted at the moment of potential credential theft, they can take preemptive action before their password is used against them or their organization. | | **[Access Control (ACLs/SCALS)](/windows/security/identity-protection/access-control/access-control)** | Access control in Windows ensures that shared resources are available to users and groups other than the resource's owner and are protected from unauthorized use. IT administrators can manage users', groups', and computers' access to objects and assets on a network or computer. After a user is authenticated, the Windows operating system implements the second phase of protecting resources by using built-in authorization and access control technologies to determine if an authenticated user has the correct permissions.

Access Control Lists (ACL) describe the permissions for a specific object and can also contain System Access Control Lists (SACL). SACLs provide a way to audit specific system level events, such as when a user attempt to access file system objects. These events are essential for tracking activity for objects that are sensitive or valuable and require extra monitoring. Being able to audit when a resource attempts to read or write part of the operating system is critical to understanding a potential attack. | | **[Windows Defender Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)** | Enabled by default in Windows 11 Enterprise, Windows Credential Guard uses hardware-backed, Virtualization-based security (VBS) to protect against credential theft. With Windows Credential Guard, the Local Security Authority (LSA) stores and protects secrets in an isolated environment that isn't accessible to the rest of the operating system. LSA uses remote procedure calls to communicate with the isolated LSA process.

By protecting the LSA process with Virtualization-based security, Windows Credential Guard shields systems from credential theft attack techniques like pass-the-hash or pass-the-ticket. It also helps prevent malware from accessing system secrets even if the process is running with admin privileges. | | **[Windows Defender Remote Credential Guard](/windows/security/identity-protection/remote-credential-guard)** | Window Defender Remote Credential Guard helps you protect your credentials over a Remote Desktop connection by redirecting the Kerberos requests back to the device that is requesting the connection. It also provides single sign-on experiences for Remote Desktop sessions.

Administrator credentials are highly privileged and must be protected. When you use Windows Defender Remote Credential Guard to connect during Remote Desktop sessions, your credential and credential derivatives are never passed over the network to the target device. If the target device is compromised, your credentials aren't exposed. | diff --git a/windows/security/introduction/index.md b/windows/security/introduction/index.md index 10953d2fbe..2389e3b4da 100644 --- a/windows/security/introduction/index.md +++ b/windows/security/introduction/index.md @@ -34,7 +34,7 @@ Windows 11 is a natural evolution of its predecessor, Windows 10. We have collab With hardware-based isolation security that begins at the chip, Windows 11 stores sensitive data behind other barriers separated from the operating system. As a result, information including encryption keys and user credentials are protected from unauthorized access and tampering. -In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](/windows/security/operating-system-security/system-security/trusted-boot.md) built-in and enabled by default to contain and limit malware exploits. +In Windows 11, hardware and software work together to protect the operating system. For example, new devices come with [Virtualization-based security (VBS)](/windows-hardware/design/device-experiences/oem-vbs) and [Secure Boot](../operating-system-security/system-security/trusted-boot.md) built-in and enabled by default to contain and limit malware exploits. ### Robust application security and privacy controls diff --git a/windows/security/operating-system-security/system-security/images/dn168167.boot_process(en-us,MSDN.10).png b/windows/security/operating-system-security/system-security/images/boot_process.png similarity index 100% rename from windows/security/operating-system-security/system-security/images/dn168167.boot_process(en-us,MSDN.10).png rename to windows/security/operating-system-security/system-security/images/boot_process.png diff --git a/windows/security/operating-system-security/system-security/images/dn168167.measure_boot(en-us,MSDN.10).png b/windows/security/operating-system-security/system-security/images/measured_boot.png similarity index 100% rename from windows/security/operating-system-security/system-security/images/dn168167.measure_boot(en-us,MSDN.10).png rename to windows/security/operating-system-security/system-security/images/measured_boot.png diff --git a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md index f8d2fd035d..3b84d75971 100644 --- a/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md +++ b/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md @@ -42,7 +42,7 @@ Windows supports four features to help prevent rootkits and bootkits from loadin Figure 1 shows the Windows startup process. -![Windows startup process.](./images/dn168167.boot_process(en-us,MSDN.10).png) +![Windows startup process.](./images/boot_process.png) *Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage*: @@ -117,7 +117,7 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. -![Measured Boot and remote attestation process.](./images/dn168167.measure_boot(en-us,MSDN.10).png) +![Measured Boot and remote attestation process.](./images/measured_boot.png) *Figure 2. Measured Boot proves the PC's health to a remote server*: diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG b/windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.png similarity index 100% rename from windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.PNG rename to windows/security/operating-system-security/system-security/windows-defender-security-center/images/settings-windows-defender-security-center-areas.png diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md index f7347a47de..86a18cc532 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-account-protection.md @@ -34,4 +34,4 @@ You can only configure these settings by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md index 788b0eb298..f3c57f4410 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-performance-health.md @@ -32,4 +32,4 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md index d8c7dc4704..35915c9351 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-device-security.md @@ -27,7 +27,7 @@ You can choose to hide the entire section by using Group Policy. The section won > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Disable the Clear TPM button diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md index 744a0a293c..df1907c2a3 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-family-options.md @@ -32,4 +32,4 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md index 734193578c..0d538dcab3 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -29,4 +29,4 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md index 852c8fc260..f17c9907ba 100644 --- a/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/operating-system-security/system-security/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -40,7 +40,7 @@ This section can be hidden only by using Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Screenshot of the Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Hide the Ransomware protection area diff --git a/windows/security/zero-trust-windows-device-health.md b/windows/security/zero-trust-windows-device-health.md index 248d3513f5..83f888b82d 100644 --- a/windows/security/zero-trust-windows-device-health.md +++ b/windows/security/zero-trust-windows-device-health.md @@ -42,7 +42,7 @@ Attestation helps verify the identity and status of essential components and tha These determinations are made with the help of a secure root of trust using the Trusted Platform Module (TPM). Devices can attest that the TPM is enabled, and that the device hasn't been tampered with. -Windows includes many security features to help protect users from malware and attacks. However, trusting the Windows security components can only be achieved if the platform boots as expected and wasn't tampered with. Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, Early-launch antimalware (ELAM), Dynamic Root of Trust for Measurement (DRTM), Trusted Boot, and other low-level hardware and firmware security features. When you power on your PC until your anti-malware starts, Windows is backed with the appropriate hardware configuration to help keep you safe. [Measured and Trusted boot](/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process.md), implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to a security coprocessor (TPM) that acts as the Root of Trust. Remote Attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper resilient report. Remote attestation is the trusted auditor of your system's boot, allowing specific entities to trust the device. +Windows includes many security features to help protect users from malware and attacks. However, trusting the Windows security components can only be achieved if the platform boots as expected and wasn't tampered with. Windows relies on Unified Extensible Firmware Interface (UEFI) Secure Boot, Early-launch antimalware (ELAM), Dynamic Root of Trust for Measurement (DRTM), Trusted Boot, and other low-level hardware and firmware security features. When you power on your PC until your anti-malware starts, Windows is backed with the appropriate hardware configuration to help keep you safe. [Measured and Trusted boot](operating-system-security/system-security/secure-the-windows-10-boot-process.md), implemented by bootloaders and BIOS, verifies and cryptographically records each step of the boot in a chained manner. These events are bound to a security coprocessor (TPM) that acts as the Root of Trust. Remote Attestation is the mechanism by which these events are read and verified by a service to provide a verifiable, unbiased, and tamper resilient report. Remote attestation is the trusted auditor of your system's boot, allowing specific entities to trust the device. A summary of the steps involved in attestation and Zero Trust on the device side are as follows: