diff --git a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md index 0293f672ae..1c6c64a34a 100644 --- a/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md +++ b/windows/keep-secure/choose-the-right-bitlocker-countermeasure.md @@ -17,20 +17,105 @@ author: brianlic-msft This section outlines the best countermeasures you can use to protect your organization from bootkits and rootkits, brute force sign-in, Direct Memory Access (DMA) attacks, Hyberfil.sys attacks, and memory remanence attacks. You can use BitLocker to protect your Windows 10 PCs. Whichever operating system you’re using, Microsoft and Windows-certified devices provide countermeasures to address attacks and improve your data security. In most cases, this protection can be implemented without the need for pre-boot authentication. -Figures 2, 3, and 4 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default -settings. +Tables 1 and 2 summarize the recommended mitigations for different types of attacks against PCs running recent versions of Windows. The orange blocks indicate that the system requires additional configuration from the default settings. -![how to choose best countermeasures for windows 7](images/bitlockerprebootprotection-counterwin7.jpg) + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+

Windows 8.1
without TPM

 +

Windows 8.1 Certified
(with TPM)

+

Bootkits and
Rootkits

Without TPM, boot integrity checking is not available

Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings

+

Brute Force
Sign-in

Secure by default, and can be improved with account lockout Group Policy

Secure by default, and can be improved with account lockout and device lockout Group Policy settings

+

DMA
Attacks

If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in

If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in

+

Hyberfil.sys
Attacks

Secure by default; hyberfil.sys secured on encrypted volume

Secure by default; hyberfil.sys secured on encrypted volume

+

Memory
Remanence
Attacks

Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication

Password protect the firmware and ensure Secure Boot is enabled. If an attack is viable, consider pre-boot authentication

-**Figure 2.** How to choose the best countermeasures for Windows 7 +**Table 1.**  How to choose the best countermeasures for Windows 8.1 -![how to choose countermeasures for windows 8](images/bitlockerprebootprotection-counterwin8.jpg) + +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+

Windows 10
without TPM

 +

Windows 10 Certified
(with TPM)

+

Bootkits and
Rootkits

Without TPM, boot integrity checking is not available

Secure by default when UEFI-based Secure Boot is enabled and a firmware password is required to change settings

+

Brute Force
Sign-in

Secure by default, and can be improved with account lockout Group Policy

Secure by default, and can be improved with account lockout and device lockout Group Policy settings

+

DMA
Attacks

If policy is deployed, secure by default for all lost or stolen devices because new DMA devices are granted access only when an authorized user is signed in

Secure by default; certified devices do not expose vulnerable DMA busses.
Can be additionally secured by deploying policy to restrict DMA devices:

+ +
+

Hyberfil.sys
Attacks

Secure by default; hyberfil.sys secured on encrypted volume

Secure by default; hyberfil.sys secured on encrypted volume

+

Memory
Remanence
Attacks

Password protect the firmware and disable booting from external media. If an attack is viable, consider pre-boot authentication

Password protect the firmware and ensure Secure Boot is enabled.
The most effective mitigation, which we advise for high-security devices, is to configure a TPM+PIN protector, disable Standby power management, and shut down or hibernate the device before it leaves the control of an authorized user.

-**Figure 3.** How to choose the best countermeasures for Windows 8 - -![how to choose countermeasures for windows 8.1](images/bitlockerprebootprotection-counterwin81.jpg) - -**Figure 4.** How to choose the best countermeasures for Windows 8.1 +**Table 2.**  How to choose the best countermeasures for Windows 10 The latest InstantGo devices, primarily tablets, are designed to be secure by default against all attacks that might compromise the BitLocker encryption key. Other Windows devices can be, too. DMA port–based attacks, which represent the attack vector of choice, are not possible on InstantGo devices, because these port types are prohibited. The inclusion of DMA ports on even non-InstantGo devices is extremely rare on recent devices, particularly on mobile ones. This could change if Thunderbolt is broadly adopted, so IT should consider this when purchasing new devices. In any case DMA ports can be disabled entirely, which is an increasingly popular option because the use of DMA ports is infrequent in the non-developer space.