Part 10 · Windows Security

Chapter 26 · Windows Security Architecture

2 min read

Status: ✅ COMPLETE

Scope: How Windows protects itself and your data: walls between programs, sandboxes, a trusted boot, the TPM chip, disk encryption, antivirus, the firewall, credential protection, code signing and application control
Time to complete: 100–130 minutes of reading + lab
Prerequisites: Chapter 3 (RAM and Memory Internals), Chapter 4 (Motherboard and Hardware Communication), Chapter 5 (Firmware, BIOS/UEFI and the Boot Process), Chapter 24 (Windows sign-in and accounts)
What you'll know after: How the layers of Windows security fit together, what Secure Boot, the TPM and BitLocker each do, and how to check each one on your own PC

INTRODUCTION

A PC holds your photos, passwords, work and money. Attackers want all of it. No single lock can stop them, so Windows uses many layers, each one covering the gaps in the others. This idea is called defence in depth.

This chapter walks through those layers from the hardware up:

  • Boundaries: how Windows keeps programs apart, and how a hypervisor protects secrets
  • Sandboxes: fenced areas for risky programs (browser sandbox, AppContainer, Windows Sandbox)
  • Boot trust: Secure Boot checks signatures, the TPM keeps keys and records the boot
  • Data at rest: BitLocker encrypts the disk so a stolen drive is unreadable
  • Guards: Defender looks for bad files and behaviour; the firewall watches the network door
  • Identity: how your sign-in secrets are protected
  • Trust in code: digital signatures, application control and exploit protection

It uses real photos of TPM hardware where they help, and plain words everywhere else. Every technical term is explained the first time it appears. The lab is read-only: you only look at your own PC and never switch any protection off.

CHAPTER OUTLINE

Chapter Status: Complete
Estimated reading time: 115 minutes
Practical time: 35 minutes
Knowledge check time: 30 minutes