Tag Archive | Cryptography

Windows 8 Security Features Explained (mini-whitepaper)

Windows 8 is apparently more secure than Windows 7. Perhaps this is true, and it is best to learn what security features there are for the new operating system. Some of these security features are verified to help out very well in the security of Windows 8, and some may not be in time, or lastly some may not work at all.

One of the most discussed security features is Secure Boot. Now, Secure Boot is a Unified Extensible Firmware Interface (UEFI) specified in the boot process to check cryptographic signatures of kernel-mode drivers, making sure they aren’t modified or corrupted. In other words, the boot process is now made to check if the operating system has been corrupted by malware or some other issue.

This is all part of a hardware restriction process called Hardware DRM. All non-ARM devices have the option to turn Secure Boot off, however ARM devices must keep it on. Experts state that it will be resistant to rootkits, since the MBR and BIOS cannot be accessed, unless if someone working on the computer penetrates it.

Next, Windows 8 features better built in antivirus software, with a much better improved Windows Defender. The software in Windows 8 is combined with the optional tool Microsoft Security Essentials. Now, with Windows Defender super-powered with MSE, it has much more anti-malware features.

With better anti-malware features, Internet Explorer is now made with better features as well. It has the ability to prevent zero-day exploits much greater than previous versions of Internet Explorer. With the challenges of exploiting Windows 7, there was the issue risen up again for Java and Flash Player, so hackers can gain control over the operating system. Those browser plugins are now easier to exploit than the Internet Explorer’s code.

A new application sandboxing environment called AppContainer provides the ability to run all apps in a controlled environment, where it controls how apps work. This prevents apps from disrupting the operating system. Of course, this is just supplemented by Internet Explorer’s SmartScreen filter, which prevents the download/install of known malicious software. However, Windows 8 now has SmartScreen available for any app, allowing even more prevention. Of course, this means Microsoft employees are going to increase in numbers, if they really want to keep up. Now that hackers know their new challenges, they will be relentless.

The questions are still played on whether Windows 8 will be a repeat of Vista or not. The reality of the situation, is if Windows 8 has big popularity, then the security issues will also light up big time. However, many will stick to Windows 7, so the security issues for Windows users are not close to be over. Feel free to take a look at related articles below for Symantec’s opinions, which aren’t too well on the new OS.

Added October 31, 2012: Trusted Platform Module, read more

Keep up with the latest security tips on our blog here. In addition, please donate to help us continue to write these awesome whitepapers.

The issue in encryption: Why it will not solve our security problems

The issue in discussion today is whether or not encryption is really that important in computer security, when it comes to the issues people face today (in security). The biggest issue faced in encryption is that even if every piece of info in an enterprise, intruders could still access it.

There are many issues faced in encryption. Many speculations occur like the following when it comes to encrypting data (and why there is a need for a backup method):

  • Encrypting every piece of information does not always mean the data is totally secure.
  • If a user can access the data, so can the intruder.
  • Users and even applications must be able to access data in unencrypted form to use it.
  • Web apps will still suffer SQL injection.
  • It will not stop Java exploits.
  • Only if a user can access the device he/she is on, if the device is stolen, the data is no longer secure.
  • If the least bit of personal/business information is leaked, a hacker has at least a small means to try to crack passwords.

So, the biggest concern, it seems, that even if data is encrypted doesn’t make it completely secure. The best way to truly secure data is working with a defense-in-depth method of securing machines, as it seems to be a way of making the hacker work hard to get to the data. By that time, the hacker would question whether the hack would be worth it.

If this post would appear to help you save money, by providing tips to secure your data, please consider a donation.

 

%d bloggers like this: