mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-11 21:07:23 +00:00
System Guard rebranding
This commit is contained in:
Vinay Pamnani
parent
cf80d469d3
commit
b54236dc96
@ -7,13 +7,13 @@ ms.topic: include
|
||||
|
||||
## Windows edition and licensing requirements
|
||||
|
||||
The following table lists the Windows editions that support Windows Defender System Guard:
|
||||
The following table lists the Windows editions that support System Guard:
|
||||
|
||||
|Windows Pro|Windows Enterprise|Windows Pro Education/SE|Windows Education|
|
||||
|:---:|:---:|:---:|:---:|
|
||||
|Yes|Yes|Yes|Yes|
|
||||
|
||||
Windows Defender System Guard license entitlements are granted by the following licenses:
|
||||
System Guard license entitlements are granted by the following licenses:
|
||||
|
||||
|Windows Pro/Pro Education/SE|Windows Enterprise E3|Windows Enterprise E5|Windows Education A3|Windows Education A5|
|
||||
|:---:|:---:|:---:|:---:|:---:|
|
||||
@ -1,16 +1,16 @@
|
||||
---
|
||||
title: How Windows Defender System Guard helps protect Windows
|
||||
description: Learn how Windows Defender System Guard reorganizes the existing Windows system integrity features under one roof.
|
||||
title: How System Guard helps protect Windows
|
||||
description: Learn how System Guard reorganizes the existing Windows system integrity features under one roof.
|
||||
ms.localizationpriority: medium
|
||||
ms.date: 10/25/2023
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
# Windows Defender System Guard: How a hardware-based root of trust helps protect Windows
|
||||
# System Guard: How a hardware-based root of trust helps protect Windows
|
||||
|
||||
To protect critical resources such as the Windows authentication stack, single sign-on tokens, the Windows Hello biometric stack, and the Virtual Trusted Platform Module, a system's firmware and hardware must be trustworthy.
|
||||
|
||||
Windows Defender System Guard reorganizes the existing Windows system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make these security guarantees:
|
||||
System Guard reorganizes the existing Windows system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make these security guarantees:
|
||||
|
||||
- Protect and maintain the integrity of the system as it starts up
|
||||
- Validate that system integrity has truly been maintained through local and remote attestation
|
||||
@ -33,7 +33,7 @@ Also, a bug fix for UEFI code can take a long time to design, build, retest, val
|
||||
|
||||
### Secure Launch—the Dynamic Root of Trust for Measurement (DRTM)
|
||||
|
||||
[Windows Defender System Guard Secure Launch](system-guard-secure-launch-and-smm-protection.md), first introduced in Windows 10 version 1809, aims to alleviate these issues by leveraging a technology known as the Dynamic Root of Trust for Measurement (DRTM). DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state.
|
||||
[System Guard Secure Launch](system-guard-secure-launch-and-smm-protection.md), first introduced in Windows 10 version 1809, aims to alleviate these issues by leveraging a technology known as the Dynamic Root of Trust for Measurement (DRTM). DRTM lets the system freely boot into untrusted code initially, but shortly after launches the system into a trusted state by taking control of all CPUs and forcing them down a well-known and measured code path. This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state.
|
||||
|
||||
|
||||
|
||||
@ -56,15 +56,15 @@ SMM protection is built on top of the Secure Launch technology and requires it t
|
||||
|
||||
## Validating platform integrity after Windows is running (run time)
|
||||
|
||||
While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can't just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device's integrity.
|
||||
While System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can't just trust the platform, which potentially could be compromised, to self-attest to its security state. So System Guard includes a series of technologies that enable remote analysis of the device's integrity.
|
||||
|
||||
As Windows boots, a series of integrity measurements are taken by Windows Defender System Guard using the device's Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch doesn't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device's firmware, hardware configuration state, and Windows boot-related components, to name a few.
|
||||
As Windows boots, a series of integrity measurements are taken by System Guard using the device's Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch doesn't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device's firmware, hardware configuration state, and Windows boot-related components, to name a few.
|
||||
|
||||
|
||||
|
||||
|
||||
After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources.
|
||||
After the system boots, System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Configuration Manager can acquire them for remote analysis. If System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources.
|
||||
|
||||
[!INCLUDE [windows-defender-system-guard](../../../includes/licensing/windows-defender-system-guard.md)]
|
||||
[!INCLUDE [system-guard](../../../includes/licensing/system-guard.md)]
|
||||
|
||||
## System requirements for System Guard
|
||||
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 428 KiB |
Binary file not shown.
|
Before Width: | Height: | Size: 46 KiB |
Loading…
x
Reference in New Issue
Block a user