Chapter 26 · Windows Security Architecture

Knowledge Check

10 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What is a security boundary, and name two examples in Windows.
  2. What is the difference between user mode and kernel mode?
  3. What does Secure Boot check, and where are the keys it uses stored?
  4. What does a TPM PCR hold, and why can it not simply be set to a chosen value?
  5. What is the 48-digit number in BitLocker, and why is it important?
  6. Name the three kinds of detection used by Microsoft Defender Antivirus.
  7. What is the default action of Windows Firewall for inbound and outbound traffic?
  8. What does Credential Guard protect, and which technology does it use?
  9. What two things does a valid code signature prove?
  10. Which feature makes code load at random addresses each time?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Security boundary

A line that code on one side may not cross without permission. Examples: process isolation (private virtual address spaces), the user/kernel split, integrity levels, AppContainer, the VBS secure world.

2. User mode vs kernel mode

User mode (ring 3) is restricted: apps cannot touch hardware or other processes' memory. Kernel mode (ring 0) can do anything: the kernel and drivers run there. Apps reach the kernel only through system calls.

3. Secure Boot

It checks the digital signature of boot loaders, drivers and option ROMs before they run. The keys and lists (PK, KEK, db, dbx) are stored in the UEFI firmware's flash memory.

4. PCR

A PCR holds a running hash of everything measured during boot. It can only be extended (new value = hash of old value plus new measurement), so you cannot set it to a value you choose.

5. The recovery password

It is the BitLocker recovery password: eight groups of six digits. It unlocks the drive when the normal protector (the TPM) refuses. If you lose it and BitLocker asks for it, the data is effectively gone. Back it up.

6. Defender detection

Signature-based (known bad), heuristic / machine-learning (looks suspicious), and behaviour-based (acts suspicious). Cloud lookups and AMSI add extra help.

7. Firewall defaults

Inbound: block unless a rule allows. Outbound: allow unless a rule blocks.

8. Credential Guard

It protects NTLM hashes and Kerberos tickets (domain credentials) by keeping them in an isolated process (LSAIso) in the VBS secure world.

9. Code signature

That the file has not been changed since signing (integrity), and who signed it (origin, if the certificate chain is trusted). It does not prove the program is safe.

10. ASLR

Address Space Layout Randomization.

UNDERSTANDING QUESTIONS

Q1. Why can a hacked browser tab not read your Documents folder, even though the logged-in user can?

Answer Browser tab processes run sandboxed at Low integrity, with very few rights. A lower-integrity process cannot write to higher-integrity objects, and the sandbox gives it no file access except through a broker that checks first. The tab has far fewer rights than the user.

Q2. Secure Boot already blocks unsigned boot code. Why do we also need Measured Boot?

Answer Secure Boot only gives yes or no for each program and leaves no record. Measured Boot records what loaded into the TPM's PCRs. Later, BitLocker and attestation can use that record to decide whether to release a key. The two answer different questions: "is it allowed?" and "what exactly ran?"

Q3. Why is a four-digit Windows Hello PIN with a TPM safer than a four-digit PIN checked by plain software?

Answer The TPM rate-limits wrong guesses (anti-hammering) and locks out after too many, so an attacker cannot try thousands per second. The PIN also only unlocks a key on this one device; it is not sent anywhere.

Q4. Why does BitLocker not need to re-encrypt the whole disk when you change your PIN or add a recovery key?

Answer The disk is encrypted with a key (FVEK) that is locked by a Volume Master Key (VMK). Protectors only unlock the VMK. Changing a protector changes only the small wrapped key, not the data.

Q5. Why does Credential Guard need VBS and not just a normal Windows setting?

Answer Normal Windows protections live inside the same kernel an attacker with admin rights might control. VBS uses the hypervisor to hide the secrets in memory that even the normal kernel cannot map, so taking over Windows still does not reveal them.

SCENARIO QUESTIONS (Troubleshooting)

S1. After a UEFI firmware update, your laptop shows a blue screen asking for a 48-digit key. What happened and what do you do?

Answer The update changed the firmware measurements (PCRs), so the TPM refused to release the BitLocker key. Enter the recovery password (from your Microsoft account, a printout or your IT team). After starting, Windows normally re-seals the key. Next time, suspend BitLocker before a firmware update.

S2. A new PC says "This PC can't run Windows 11" and mentions TPM, but the box says the PC is modern. What would you check?

Answer Run `tpm.msc` or `Get-Tpm`. The firmware TPM (Intel PTT or AMD fTPM, sometimes named "Security Device") may be switched off in UEFI settings. Switch it on there, then check again. Also check Secure Boot capability and UEFI mode.

S3. A user says "Defender keeps blocking my program, so I will turn it off." What do you tell them?

Answer Do not turn it off. Check *Protection history* to see why it was blocked and whether it is a false positive. If you are sure the file is safe, restore it or add a narrow exclusion for that one file, or submit it to Microsoft for analysis. Turning protection off exposes the whole PC.

S4. A small server program works at home but nobody can connect to it from another PC at the office. At home it was fine. What may be wrong?

Answer Inbound connections are blocked by default, and the rule may only exist for the Private profile. At the office the PC may be on the Public or Domain profile. Check the active profile (`Get-NetConnectionProfile`) and create a narrow allow rule for that program or port on the correct profile.

S5. You download an installer and Windows shows "Unknown publisher" and SmartScreen warns you. What do you do?

Answer Pause. Confirm the download is from the official site, check the file's Digital Signatures tab or `Get-AuthenticodeSignature`, and look at the file's reputation or hash if the vendor publishes one. If you cannot confirm it, do not run it. If you must test it, use Windows Sandbox or a virtual machine.

INTERVIEW QUESTIONS

I1. Explain defence in depth and give four Windows layers.

Answer Defence in depth means stacking independent protections so one failure is not total. Examples: Secure Boot and TPM at boot, BitLocker for data at rest, VBS and kernel signing for the core, integrity levels and sandboxes for apps, Defender and application control for what runs, and the firewall for the network.

I2. Describe the BitLocker key hierarchy and what happens at boot with a TPM protector.

Answer Data is encrypted with the FVEK; the FVEK is locked by the VMK; the VMK is unlocked by protectors (TPM, PIN, USB key, recovery password). At boot the TPM compares PCR values with the sealed ones; if they match, it releases the VMK so the volume decrypts transparently; otherwise Windows shows the recovery screen.

I3. What is the difference between WDAC / App Control and AppLocker?

Answer Both decide which programs may run. WDAC is enforced in the kernel, applies to the whole machine and is harder to bypass; it can be hardened with VBS. AppLocker is enforced by a service, can target users and groups and is easier to write, but is considered weaker. Availability depends on edition; Microsoft recommends WDAC for new designs.

I4. How do DEP, ASLR and CFG each make exploits harder?

Answer DEP stops code from running in data memory. ASLR randomises addresses so the attacker cannot predict where useful code is. CFG checks that indirect jumps land at valid function starts. Used together, an exploit must defeat several at once.

I5. What does a certificate chain prove when Windows validates a driver signature?

Answer The file hash matches the signed hash (unchanged), each certificate is signed by the one above it, the chain ends at a trusted root, each is within its dates (or timestamped), the certificate allows code signing, and none is revoked. It proves origin and integrity, not that the code has no bugs.

PRACTICAL TASK

Write a one-page "security report card" for your PC. Using your Practical Lab results, make a table with these rows: Secure Boot, TPM version, BitLocker / Device Encryption, VBS / Memory integrity, Defender real-time protection, Firewall (all three profiles), Tamper Protection. For each row write On / Off / Not available, and one sentence on what risk that row covers (for example, "Secure Boot: stops bootkits"). Mark one row you would improve first, and say how (without changing anything yet).

Why This Matters

Security is only as strong as its weakest layer. A short report card turns a pile of settings into a clear picture, and shows the first thing worth fixing. It also helps you explain a PC's security to others in plain words.

CHAPTER SUMMARY

  • Boundaries and isolation: processes have private virtual address spaces; integrity levels and tokens limit rights; user mode and kernel mode split the CPU's power; VBS adds a hypervisor-protected secure world.
  • Sandboxing: browser sandboxes, AppContainer for Store/UWP apps, and Windows Sandbox (optional on Pro/Enterprise/Education) fence off risky code.
  • Secure Boot checks signatures against keys in firmware (PK, KEK, db, dbx), building a chain of trust from firmware to Windows; certificates change over time, so follow Microsoft's guidance.
  • TPM keeps keys that cannot be read out, records the boot in PCRs (Measured Boot), seals secrets to a known-good state and limits PIN guessing.
  • BitLocker encrypts the volume with AES; a VMK is unlocked by protectors (TPM, PIN, USB, recovery password). Back up the recovery key.
  • Defender combines real-time protection, signature, heuristic and behaviour detection, and cloud protection; Tamper Protection keeps it on.
  • Firewall is stateful: inbound blocked, outbound allowed by default, with Domain, Private and Public profiles.
  • Credential protection: LSA protection (PPL), Credential Guard, Windows Hello with the TPM, and DPAPI.
  • Code signing (Authenticode, certificate chains) proves origin and integrity; drivers must be signed.
  • Application control (WDAC/AppLocker) limits what runs; exploit protection (DEP, ASLR, CFG, SEHOP) makes bugs harder to use.
  • Related: Chapter 3 (RAM and memory, for virtual memory), Chapter 4 (hardware and DMA protection), Chapter 5 (firmware and boot), Chapter 24 and Chapter 25
  • Microsoft's own documentation on Windows security (search "Windows security overview" on Microsoft Learn) is the best place to check edition and version details.