Schneier on Security

Dale • August 6, 2016 6:04 AM

@sempit

Windows 10 can be hardened but it’s tricky.

A few of the common methods include:

Disabling Cortana
Disabling Telemetry
Using BitlLocker with TPM and PIN (or even TPM + PIN + USB)*
Protecting the UEFI firmware (any changes will kick BitLocker into recovery mode)
Using BitLocker with pre-boot authentication (DMA ports are now locked by default)
Limiting interactive login (too many incorrect attempts will force BitLocker recovery)
Having a strong, separate UAC password
Requiring CTRL + ALT + DEL for login
Disabling update sharing (i.e. receive updates directly from Microsoft)
Using hibernate not sleep
Have a password protected screensaver just in case
Setting the privacy settings to highest
Using a standard/limited user account
Consider EMET mitigations
Keeping it up-to-date (deferred upgrades if necessary; security patches still received)
Using strong anti-virus (perhaps in a default-deny configuration)

*in XTS-AES-256 mode with a 256-bit recovery key (NOT the numeric recovery password which only has 128 bits of entropy!)

There are more but they’re the main ones I can think off the top of my head.

O&O ShutUp10 is a great piece of free software, no install required, that allows you to reign back your privacy.

Sometimes Windows is essential for your job so I can’t blame Bruce for needing to use Windows 10.

Dale • August 6, 2016 11:52 AM

@Evan

I agree.

The benefit of Windows for most users is that the installers are almost always digitally signed nowadays. Putting aside the trust issue of a central certification authority this is a massive step towards usability and security.

Most users don’t/can’t verify hash signatures or detached GPG signatures – even some new Linux users struggle. The in-built installer signature in Windows is a reliable way for the OS to determine what is genuine and when combined with a good internet security package it makes a malware attack much less likely. Many AV’s now check the hash sum in addition to the signature to ensure file integrity.

Using a limited account is a really effective way to mitigate privilege escalation attacks. It’s not foolproof but it goes a long way towards reducing the threat.

Even though I dislike Windows I have to agree with Bruce that the OS now integrates some very advanced security features such as Secure Boot, Early Launch Anti-Malware, ASLR etc. that most Linux distros don’t come anywhere near to matching.

I use Windows only for work because I need access to Office. Whilst LibreOffice is very good the collaborative features are non-existent, email is atrocious (Thunderbird is nowhere near as good as Outlook) and it suffers from regular crashes with large documents. Then there are the compatibility issues…

Windows BitLocker is also more widely accepted (in industry) as being secure, and therefore ‘approved’, compared to LUKS. Some industries won’t allow non-compliant encryption.

For a hobbyist Linux is great but doing serious work on it is difficult unless you’re prepared to expend the time, effort and energy trying to rectify simple problems that have long since been ironed out from Windows.

I use the Current Branch for Business version of Windows which is considered stable because by this stage (having been used by consumers for nearly 4 months on average) it’s been tested internally by Microsoft, sent to be tested by Alpha ‘fast ring’ testers, then used by the Beta ‘slow ring’ testers and then sent out to consumer Guinea pigs. Only after that do Microsoft certify it as being suitable for business. You still get security updates but the non-essential updates/upgrades are deferred until they’re stable.