Just what is Microsoft’s new Secured-core PC?

The Secured-core PC relies on advanced security capabilities built into modern CPUs to protect the integrity of Windows and its boot process from advanced attacks at the firmware level.

A secured-core PC uses dynamic root of trust measurement (DRTM) to launch the system into a trusted state by transferring control from the CPU directly to the Windows hypervisor loader via a secured and measured handoff.  With the Windows hypervisor securely launched in a state measured by hardware, the VBS environment is then created in memory to isolate critical keys and processes from the regular Windows operating system that will soon be started. The hypervisor code integrity (HVCI) service is started in VBS which protects the Windows kernel by enforcing that all executable kernel code is signed by a trusted authority and by ensuring kernel code always allocates memory safely. This helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers.

All through the boot process a series of integrity measurements are made into the TPM 2.0 to securely record the chain of trust from the CPU to Windows. This process and data are isolated in TPM hardware to ensure that the measurements are not subject to tampering even if the platform was compromised. From here, the measurements are used to determine the integrity of the device’s hardware, firmware, and Windows boot components, thereby ensuring the device is free of persistent malware beneath the operating system. 

Once Windows has started and is running securely and a user signs in with Windows Hello*, Credential Guard ensures that identity and domain credentials are isolated and protected in the VBS secure isolated environment thereby blocking credential theft attack techniques and tools used in many targeted attacks. Even malware running in the operating system with administrative privileges will not be able to extract authentication tokens.

Ultimately, Secured-core PCs are designed to protect against malicious access and malware through multiple layers of defence: a hardware-based root of trust, compartmentalised and isolated critical components, and certificate-based authentication.

Which devices are Secured-core PCs?

The Panasonic TOUGHBOOK 55 is one of the first Secured-core PCs and the first in the rugged Panasonic TOUGHBOOK range to offer this new level of security. As well as the latest security features, the TOUGHBOOK 55 is a semi-rugged notebook in a slim and unique 'honeycomb' design for improved strength and splash resistant design. In terms of flexibility, the TOUGHBOOK 55 is equally outstanding. It offers a huge array of configuration options, making it easier for customers to have exactly the device they want.

*To use Windows Hello with biometrics specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware based protection of the Windows Hello credential/keys requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based.