We're going to have a look at VBS, or virtualization‑based security,
and all the features of it in Windows Server 2022.
How VBS works is it creates and isolates a secure region of
memory from the normal operating system.
It uses something called Credential Guard and Credential
Guard stores the user credentials and any secrets inside of
this virtual container, again,
hidden from the operating system. It has something called user mode
configurable code integrity and what this policy does is it checks the
application before they're even loaded.
What we're trying to do here is protect from the most recent and most
aggressive and most successful attacks in computing today and that is
getting at the kernel, getting at something before the operating
system has a chance to look at it.
VBS uses something called hypervisor‑based code integrity, or HVCI and
what this does is it checks all kernel mode drivers,
it checks all the binaries in a virtualized environment
before they're even started. In your Windows machine, HVCI
is referred to as memory integrity.
If your hardware meets certain requirements,
it is turned on by default and you have to go in there and manually shut it off.
So, with VBS,
what we're looking at here is virtualizing a little section of the memory,
creating a container that the operating system just can't see.
And what we're trying to do is protect from the very sophisticated
attacks by isolating a part of memory to store credentials,
to store secrets, and to check everything that is being loaded inside of
the kernel inside of the operating system so anything installed on the
operating system can't get access to it.
That is a look at VBS With Windows Server 2022. Up next, we'll take a look at some of the security enhancements to networking.