deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-14 14:27:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix broken link to ESC content in Windows privacy content

Browse Source
This commit is contained in:
Paolo Matarazzo 2024-07-24 07:33:11 -04:00
parent b8ecb196d6
commit 6a687456b1
2 changed files with 60 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
windows/security/book/identity-protection-advanced-credential-protection.md
View File

@ -19,7 +19,7 @@ However, people who are still using passwords can also benefit from powerful cre
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Enhanced phishing protection in Microsoft Defender SmartScreen](/windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection)
- [Enhanced phishing protection in Microsoft Defender SmartScreen][LINK-1]
## Local Security Authority (LSA) protection
@ -31,7 +31,7 @@ End users have the ability to manage their LSA protection state in the Windows S
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Configuring additional LSA protection](/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection)
- [Configuring additional LSA protection][LINK-2]
## Credential Guard
@ -43,7 +43,7 @@ Protections are now expanded to optionally include machine account passwords for
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard)
- [Protect derived domain credentials with Credential Guard][LINK-3]
## Remote Credential Guard
@ -53,7 +53,7 @@ Administrator credentials are highly privileged and must be protected. When Remo
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Remote Credential Guard - Windows Security | Microsoft Learn](/windows/security/identity-protection/remote-credential-guard?tabs=intune)
- [Remote Credential Guard][LINK-4]
## VBS Key Protection
@ -65,16 +65,12 @@ Token protection attempts to reduce attacks using Microsoft Entra ID token theft
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Token protection in Entra ID Conditional Access](/azure/active-directory/conditional-access/concept-token-protection)
- [Token protection in Entra ID Conditional Access][LINK-5]
## Sign-in session token protection policy
### Sign-in session token protection policy
At the inaugural Microsoft Secure event in March 2023, we announced the public preview of token protection for sign-ins. This feature allows applications and services to cryptographically bind security tokens to the device, restricting attackers' ability to impersonate users on a different device if tokens are stolen.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Conditional Access: Token protection (preview)](/azure/active-directory/conditional-access/concept-token-protection)
## Account lockout policies
New devices with Windows 11 installed will have account lockout policies that are secure by default. These policies mitigate brute-force attacks such as hackers attempting to access Windows devices via the Remote Desktop Protocol (RDP).
@ -83,7 +79,7 @@ The account lockout threshold policy is now set to 10 failed sign-in attempts by
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Account lockout policy](/windows/security/threat-protection/security-policy-settings/account-lockout-policy)
- [Account lockout policy][LINK-6]
## Access management and control
@ -95,10 +91,20 @@ IT administrators can refine the application and management of access to:
- Protect a greater number and variety of network resources from misuse
- Provision users to access resources in a manner that is consistent with organizational policies and the requirements of their jobs. Organizations can implement the principle of least-privilege access, which asserts that users should be granted access only to the data and operations they require to perform their jobs
- Update users' ability to access resourcesregularly, as an organization's policies change or as users' jobs change
- Update users' ability to access resources regularly, as an organization's policies change or as users' jobs change
- Support evolving workplace needs, including access from hybrid or remote locations, or from a rapidly expanding array of devices, including tablets and mobile phones
- Identify and resolve access issues when legitimate users are unable to access resources that they need to perform their jobs
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Access control](/windows/security/identity-protection/access-control/access-control)
- [Access control][LINK-7]
<!--links-->
[LINK-1]: /windows/security/operating-system-security/virus-and-threat-protection/microsoft-defender-smartscreen/enhanced-phishing-protection
[LINK-2]: /windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
[LINK-3]: /windows/security/identity-protection/credential-guard
[LINK-4]: /windows/security/identity-protection/remote-credential-guard
[LINK-5]: /azure/active-directory/conditional-access/concept-token-protection
[LINK-6]: /windows/security/threat-protection/security-policy-settings/account-lockout-policy
[LINK-7]: /windows/security/identity-protection/access-control/access-control

71
windows/security/book/identity-protection-passwordless-sign-in.md
View File

@ -21,7 +21,7 @@ The secure, convenient sign-in experience can augment or replace passwords with
Using asymmetric keys provisioned in the TPM, Windows Hello protects authentication by binding a user's credentials to their device. Windows Hello validates the user based on either a PIN or biometrics match and only then allows the use of cryptographic keys bound to that user in the TPM.
PIN and biometric data stay on the device and cannot be stored or accessed externally. Since the data cannot be accessed by anyone without physical access to the device, credentials are protected against replay attacks, phishing, and spoofing as well as password reuse and leaks.
PIN and biometric data stay on the device and can't be stored or accessed externally. Since the data can't be accessed by anyone without physical access to the device, credentials are protected against replay attacks, phishing, and spoofing as well as password reuse and leaks.
Windows Hello can authenticate users to a Microsoft account (MSA), identity provider services, or the relying parties that also implement the FIDO2 or WebAuthn standards.
@ -31,7 +31,7 @@ Windows Hello can authenticate users to a Microsoft account (MSA), identity prov
## Windows Hello for Business
Windows Hello for Business extends Windows Hello to work with an organization's Active Directory and Microsoft Entra ID accounts. It provides single sign-on access to work or school resources such as OneDrive for Business, work email, and other business apps. Windows Hello for Business also give IT admins the ability to manage PIN and other sign-in requirements for devices connecting to work or school resources.
Windows Hello for Business extends Windows Hello to work with an organization's Active Directory and Microsoft Entra ID accounts. It provides single sign-on access to work or school resources such as OneDrive, work email, and other business apps. Windows Hello for Business also give IT admins the ability to manage PIN and other sign-in requirements for devices connecting to work or school resources.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
@ -41,7 +41,7 @@ Windows Hello for Business extends Windows Hello to work with an organization's
Windows 11 devices with Windows Hello for Business can protect user identities by removing the need to use passwords from day one.
IT can now set a policy for Microsoft Entra ID joined machines so users no longer see the option to enter a password when accessing company resources<sup>[\[12\]](conclusion.md#footnote12)</sup>. Once the policy is set, passwords are removed from the Windows user experience, both for device unlock as well as in-session authentication scenarios via CredUI. However, passwords are not eliminated from the identity directory yet. Users are expected to navigate through their core authentication scenarios using strong, phish-resistant, possession-based credentials like Windows Hello for Business and FIDO2 security keys. If necessary, users can leverage passwordless recovery mechanisms such as Windows Hello for Business PIN reset or Web Sign-in.
IT can now set a policy for Microsoft Entra ID joined machines so users no longer see the option to enter a password when accessing company resources<sup>[\[12\]](conclusion.md#footnote12)</sup>. Once the policy is set, passwords are removed from the Windows user experience, both for device unlock and in-session authentication scenarios via CredUI. However, passwords aren't eliminated from the identity directory yet. Users are expected to navigate through their core authentication scenarios using strong, phish-resistant, possession-based credentials like Windows Hello for Business and FIDO2 security keys. If necessary, users can leverage passwordless recovery mechanisms such as Windows Hello for Business PIN reset or Web Sign-in.
During a device's lifecycle, a password may only need to be used once during the provisioning process. After that, people can use a PIN, face, or fingerprint to unlock credentials and sign into the device.
@ -52,9 +52,9 @@ Provisioning methods include:
Windows Hello for Business replaces the username and password by combining a security key or certificate with a PIN or biometric data and then mapping the credentials to a user account during setup. There are multiple ways to deploy Windows Hello for Business depending on an organization's needs. Organizations that rely on certificates typically use on-premises public key infrastructure (PKI) to support authentication through Certificate Trust. Organizations using key trust deployment require root-of-trust provided by certificates on domain controllers.
Organizations with hybrid scenarios can eliminate the need for on-premises domain controllers and simplify passwordless adoption by using Windows Hello for Business cloud Kerberos trus<sup>[\[13\]](conclusion.md#footnote13)</sup>. This solution uses security keys and replaces on-premises domain controllers with a cloud-based root-of-trust. As a result, organizations can take advantage of Windows Hello for Business and deploy passwordless security keys with minimal additional setup or infrastructure.
Organizations with hybrid scenarios can eliminate the need for on-premises domain controllers and simplify passwordless adoption by using Windows Hello for Business cloud Kerberos trust<sup>[\[13\]](conclusion.md#footnote13)</sup>. This solution uses security keys and replaces on-premises domain controllers with a cloud-based root-of-trust. As a result, organizations can take advantage of Windows Hello for Business and deploy passwordless security keys with minimal additional setup or infrastructure.
Users will authenticate directly with Microsoft Entra ID, helping speed access to on- premises applications and other resources.
Users will authenticate directly with Microsoft Entra ID, helping speed access to on-premises applications and other resources.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
@ -70,23 +70,27 @@ The TPM protects against threats including PIN brute-force attacks on lost or st
Windows Hello biometric sign-in enhances both security and productivity with a quick, convenient sign-in experience. There's no need to enter a password every time when a face or fingerprint is the credential.
Windows devices that support biometric hardware such as fingerprint or facial recognition cameras integrate directly with Windows Hello, enabling access to Windows client resources and services. Biometric readers for both face and fingerprint must comply with [Microsoft](/windows-hardware/design/device-experiences/windows-hello-biometric-requirements) [Windows Hello biometric requirements](/windows-hardware/design/device-experiences/windows-hello-biometric-requirements). Windows Hello facial recognition is designed to only authenticate from trusted cameras used at the time of enrollment.
Windows devices that support biometric hardware such as fingerprint or facial recognition cameras integrate directly with Windows Hello, enabling access to Windows client resources and services. Biometric readers for both face and fingerprint must comply with Windows Hello biometric requirements. Windows Hello facial recognition is designed to only authenticate from trusted cameras used at the time of enrollment.
If a peripheral camera is attached to the device after enrollment, that camera will only be allowed for facial authentication after it has been validated by signing in with the internal camera. For additional security, external cameras can be disabled for use with Windows Hello facial recognition.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Windows Hello biometric requirements][LINK-4]
## Windows Hello Enhanced Sign-in Security
Windows Hello biometrics also supports Enhanced Sign-in Security, which uses specialized hardware and software components to raise the security bar even higher for biometric sign-in.
Enhanced Sign-in Security biometrics uses virtualization-based security (VBS) and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated.
Enhanced Sign-in Security biometrics uses Virtualization-based security (VBS) and the TPM to isolate user authentication processes and data and secure the pathway by which the information is communicated.
These specialized components protect against a class of attacks that includes biometric sample injection, replay, and tampering. For example, fingerprint readers must implement Secure Device Connection Protocol, which uses key negotiation and a Microsoft-issued certificate to protect and securely store user authentication data. For facial recognition, components such as the Secure Devices (SDEV) table and process isolation with trustlets help prevent additional attack classes.
Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process and is most typically supported in Secured-core PCs. For facial recognition, Enhanced Sign-in Security is supported by specific silicon and camera combinations - please check with the specific device manufacturer. Fingerprint authentication is available across all processor types. Please reach out to specific OEMs for support details.
Enhanced Sign-in Security is configured by device manufacturers during the manufacturing process and is most typically supported in Secured-core PCs. For facial recognition, Enhanced Sign-in Security is supported by specific silicon and camera combinations - check with the specific device manufacturer. Fingerprint authentication is available across all processor types. Reach out to specific OEMs for support details.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Windows Hello Enhanced Sign-in Security](/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security)
- [Windows Hello Enhanced Sign-in Security][LINK-5]
## Windows Hello for Business multi-factor unlock
@ -96,24 +100,24 @@ Multi-factor unlock is useful for organizations who need to prevent information
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Multi-factor unlock](/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock)
- [Multi-factor unlock][LINK-6]
## Windows presence sensing
Windows presence sensing14 provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to a user's presence to help them stay secure and productive, whether they're working at home, the office, or a public environment.
Windows presence sensing<sup>[\[14\]](conclusion.md#footnote14)</sup> provides another layer of data security protection for hybrid workers. Windows 11 devices can intelligently adapt to a user's presence to help them stay secure and productive, whether they're working at home, the office, or a public environment.
Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to sign the user in hands-free and automatically locks the device when the user leaves. With adaptive dimming, the PC dims the screen when the user looks away on compatible devices with presence sensors. It's also easier than ever to configure presence sensors on devices, with easy enablement in the out-of-the-box experience and new links in Settings to help find presence sensing features. Device manufacturers will be able to customize and build extensions for the presence sensor.
Windows presence sensing combines presence detection sensors with Windows Hello facial recognition to sign the user in hands-free and automatically locks the device when the user leaves. With adaptive dimming, the PC dims the screen when the user looks away on compatible devices with presence sensors. It's also easier than ever to configure presence sensors on devices, with easy enablement in the out-of-the-box experience and new links in Settings to help find presence sensing features. Device manufacturers can customize and build extensions for the presence sensor.
## Developer APIs and app privacy support for presence sensing
### Developer APIs and app privacy support for presence sensing
Privacy is top of mind and more important than ever. Customers want to have greater transparency and control over the use of their information. We are pleased to announce new app privacy settings that enable users to allow or block access to their presence sensor information. Users can decide on these settings during the initial Windows 11 setup.
Privacy is top of mind and more important than ever. Customers want to have greater transparency and control over the use of their information. We're pleased to announce new app privacy settings that enable users to allow or block access to their presence sensor information. Users can decide on these settings during the initial Windows 11 setup.
Users can also take advantage of more granular settings to easily enable and disable differentiated presence sensing features like wake on approach, lock on leave, and adaptive dimming. We are also supporting developers with new APIs for presence sensing for thirdparty applications. Third-party applications can now access user presence information on devices with modern presence sensors.
Users can also take advantage of more granular settings to easily enable and disable differentiated presence sensing features like wake on approach, lock on leave, and adaptive dimming. We're also supporting developers with new APIs for presence sensing for third-party applications. Third-party applications can now access user presence information on devices with modern presence sensors.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Presence sensing](/windows-hardware/design/device-experiences/sensors-presence-sensing)
- [Manage presence sensing settings in Windows 11](https://support.microsoft.com/windows/managing-presence-sensing-settings-in-windows-11-82285c93-440c-4e15-9081-c9e38c1290bb)
- [Presence sensing][LINK-7]
- [Manage presence sensing settings in Windows 11][LINK-8]
## FIDO support
@ -123,11 +127,11 @@ Windows 11 can also use passkeys from external FIDO2 security keys for authentic
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Passwordless security key sign-in](/azure/active-directory/authentication/howto-authentication-passwordless-security-key)
- [Passwordless security key sign-in][LINK-9]
## Passkeys
Windows 11 makes it much harder for hackers who exploit stolen passwords via phishing attacks by empowering users to replace passwords with passkeys. Passkeys are the crossplatform future of secure sign-in. Microsoft and other technology leaders are supporting passkeys across their platforms and services.
Windows 11 makes it much harder for hackers who exploit stolen passwords via phishing attacks by empowering users to replace passwords with passkeys. Passkeys are the cross-platform future of secure sign-in. Microsoft and other technology leaders are supporting passkeys across their platforms and services.
A passkey is a unique, unguessable cryptographic secret that is securely stored on the device. Instead of using a username and password to sign in to a website or application, Windows 11 users can create and use a passkey from Windows Hello, an external security provider, or their mobile device.
@ -135,15 +139,13 @@ Passkeys on Windows 11 are protected by Windows Hello or Windows Hello for Busin
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Passkeys (passkey authentication)](https://fidoalliance.org/passkeys/)
- [Passkeys][LINK-10]
## Microsoft Authenticator
The Microsoft Authenticator app, which runs on iOS and Android devices, helps keep
The Microsoft Authenticator app, which runs on iOS and Android devices, helps keep Windows 11 users secure and productive. Microsoft Authenticator can be used to bootstrap Windows Hello for Business, which removes the need for a password to get started on Windows 11.
Windows 11 users secure and productive. Microsoft Authenticator can be used to bootstrap Windows Hello for Business, which removes the need for a password to get started on Windows 11.
Microsoft Authenticator also enables easy, secure sign-in for all online accounts using multifactor authentication, passwordless phone sign-in, or password autofill. The accounts in the Authenticator app are secured with a public/private key pair in hardware-backed storage such as the Keychain in iOS and Keystore on Android. IT admins can leverage different tools to nudge their users to set up the Authenticator app, provide them with extra context about where the authentication is coming from, and ensure that they are actively using it.
Microsoft Authenticator also enables easy, secure sign-in for all online accounts using multifactor authentication, passwordless phone sign-in, or password autofill. The accounts in the Authenticator app are secured with a public/private key pair in hardware-backed storage such as the Keychain in iOS and Keystore on Android. IT admins can leverage different tools to nudge their users to set up the Authenticator app, provide them with extra context about where the authentication is coming from, and ensure that they're actively using it.
Individual users can back up their credentials to the cloud by enabling the encrypted backup option in settings. They can also see their sign-in history and security settings for Microsoft personal, work, or school accounts.
@ -151,7 +153,7 @@ Using this secure app for authentication and authorization enables people to be
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Microsoft Authenticator](/azure/active-directory/authentication/concept-authentication-authenticator-app)
- [Authentication methods in Microsoft Entra ID - Microsoft Authenticator app][LINK-11]
## Smart cards for Windows service
@ -165,11 +167,11 @@ Organizations also have the option of using smart cards, an authentication metho
Smart cards can only be used to sign in to domain accounts or Microsoft Entra ID accounts.
When a password is used to sign in to a domain account, Windows uses the Kerberos Version 5 (V5) protocol for authentication. If you use a smart card, the operating system uses Kerberos V5 authentication with X.509 V3 certificates. On Microsoft Entra ID joined devices, a smart card can be used with Entra ID certificate-based authentication. Smart cards cannot be used with local accounts.
When a password is used to sign in to a domain account, Windows uses the Kerberos Version 5 (V5) protocol for authentication. If you use a smart card, the operating system uses Kerberos V5 authentication with X.509 V3 certificates. On Microsoft Entra ID joined devices, a smart card can be used with Microsoft Entra ID certificate-based authentication. Smart cards can't be used with local accounts.
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Smart Card technical reference](/windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference)
- [Smart Card technical reference][LINK-12]
## Federated sign-in
@ -177,11 +179,20 @@ Windows 11 supports federated sign-in with external education identity managemen
:::image type="icon" source="images/learn-more.svg" border="false"::: **Learn more:**
- [Configure federated sign-in for Windows devices](/education/windows/federated-sign-in)
- [Configure federated sign-in for Windows devices][LINK-13]
<!--links-->
[LINK-1]: https://support.microsoft.com/windows/dae28983-8242-bb2a-d3d1-87c9d265a5f0
[LINK-2]: /windows/security/identity-protection/hello-for-business
[LINK-3]: /windows/security/identity-protection/passwordless-experience
[LINK-3]: /windows/security/identity-protection/passwordless-experience
[LINK-4]: /windows-hardware/design/device-experiences/windows-hello-biometric-requirements
[LINK-5]: /windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security
[LINK-6]: /windows/security/identity-protection/hello-for-business/feature-multifactor-unlock
[LINK-7]: /windows-hardware/design/device-experiences/sensors-presence-sensing
[LINK-8]: https://support.microsoft.com/windows/82285c93-440c-4e15-9081-c9e38c1290bb
[LINK-9]: /azure/active-directory/authentication/howto-authentication-passwordless-security-key
[LINK-10]: https://fidoalliance.org/passkeys
[LINK-11]: /entra/identity/authentication/concept-authentication-authenticator-app
[LINK-12]: /windows/security/identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference
[LINK-13]: /education/windows/federated-sign-in