As you may have seen, Windows Server 2022 includes a wealth of features.
From a security point of view,
Windows Server 2022 introduces new concepts and features.
This builds onto the previous improvements that's been
introduced in Windows Server 2019.
One of the most notable improvements is secured‑core for servers.
Now Microsoft first introduced the Secured‑core offering
to the world of personal computers.
Of course, that had a lot of benefits from a client side.
From a server side,
it was a no‑brainer for them to release Secured‑core requirements or
server offerings for this server infrastructure.
So what exactly is Secured‑core technology?
Well, let's dive into this.
I have broken this up into three separate pillars.
The first pillar relates to simplified security.
By having simplified security in relation to Secured‑core offerings,
Microsoft requires that OEM manufacturers meet a certain
specification and capability requirement.
This ensures that Secured‑core offerings can be enabled.
How do we enable that?
Well, it's really simple.
With the introduction of Windows Admin Center,
we can enable various Secured‑core offerings directly from the console.
This ultimately allows us to enable advanced security,
and you'll see what this looks like in a bit.
The next component that we have that forms part of the
Secured‑core technology is advanced protection.
Now when you think of modern threats,
these include various types of attacks that range from
firmware‑based attacks all the way up to code‑based attacks
and application‑level attacks.
Using advanced protection,
a Secured‑core server can take advantage of both hardware and
software solutions to counter these types of attacks.
So what exactly is advanced protection?
Well, the first one that we have is a hardware root of trust.
Your hardware root of trust makes use of a Trusted Platform Module,
also known as a TPM module, which comes standard with Secured‑core servers.
Now if you have deployed advanced protections for clients,
such as BitLocker and some of the virtualization‑based security,
you'll be familiar with the need for having a TPM chip.
Now the TPM chip for this hardware root of trust is TPM version 2.0,
which comes as a standard on Secured‑core servers.
This essentially provides a wealth of protection for storing
sensitive keys and data that can be used to protect the
operating system during its boot‑up.
It can also be leveraged to enable functionality such as BitLocker
and the creation of attestation‑based workflows.
The next component that we have of advanced protection is firmware protection.
Now in the last couple of years,
you have noticed there's been an uproar in firmware vulnerabilities,
and attackers have been pushing to this direction because they are aware of the
lack of insight that comes with antivirus or EDR solutions.
Now with firmware protection, you can make use of a dynamic root of trust,
which essentially allows Secured‑core systems to put the
firmware in a hardware‑based sandbox that helps to reduce the
impact of vulnerabilities on that firmware.
Coupled with this, we have the virtualization‑based security.
Now Secured servers support VBS security and hypervisor code integrity.
These type of protections help to protect against various types of
vulnerabilities by isolating critical and privileged parts of the
operating system from the rest of the system.
So if you think of attacks such as Pass‑the‑Hash or any
type of credential access attacks, when virtualization‑based security is enabled,
the key components such as your LSASS, etc,
are virtualized,
making it a lot more difficult for a program to access
that component and obtain credentials.
And then the last component that forms part of the
Secured‑core server is preventative defense.
This enables servers to have mitigations that are built into the
hardware and operating system platform that work in unison to
combat different types of attacks.
Now remember in the beginning I mentioned the ease‑of‑use
of enabling Secured‑core functionality,
and if you take a look at this screenshot,
this is looking at a Secured‑core server being
managed within Windows Admin Center, and essentially,
you can select the different security features and enable them
or disable them on a Secured‑core server.
This comes back to the simplified security about making it super easy to secure your server.