New Windows 11 Security Feature Will Require a PC Reset
- Paul Thurrott
- Apr 07, 2022
-
44
I didn’t pay enough attention to the security announcements that came out of this week’s Windows 11 hybrid work event. Because at least one of the new security-related features that I didn’t write up does deserve a mention.
It’s called Smart App Control.
Windows Intelligence In Your Inbox
Sign up for our new free newsletter to get three time-saving tips each Friday — and get free copies of Paul Thurrott's Windows 11 and Windows 10 Field Guides (normally $9.99) as a special welcome gift!
"*" indicates required fields
“Smart App Control is a major enhancement to the Windows 11 security model that prevents users from running malicious applications on Windows devices that default blocks untrusted or unsigned applications,” Microsoft vice president David Weston explains. “It goes beyond previous built-in browser protections and is woven directly into the core of the OS at the process level. Using code signing along with AI, our new Smart App Control only allows processes to run that are predicted to be safe based on either code certificates or an AI model for application trust within the Microsoft cloud. Model inference occurs 24 hours a day on the latest threat intelligence that provides trillions of signals.”
Smart App Control is interesting because it will be enabled by default on new Windows PCs in the future. But if you upgrade to whatever version of Windows 11 that enables this feature on an existing install, you will have to use Reset this PC to reset Windows 11 and clean install it. That is, I believe, unprecedented.
The problems with Microsoft’s other security announcements this past week, of course, are that we don’t know when these updates will occur, which customers will be impacted, and whether they require a commercial Microsoft 365 account or upgrade. That doesn’t excuse ignoring it, I guess, but it makes it hard to know which features will apply to all Windows 11 users. Including this one, actually.
Tagged with
Conversation 44 comments
-
dftf
<p>Be a waste-of-time getting 16-bit apps signed, as no version of <em>Windows 11</em> natively supports them… they only run 32-bit code. <em>Windows 10 </em>is the last version to offer the 32-bit kernel variants, which did support 16-bit code. ;)</p>
-
dftf
<p>(Should have said "they only run 32-bit code, in-addition-to 64-bit code", to be exact.)</p>
-
dftf
<p>Is this new-feature really much-different from the current option in <em>Windows 10</em> to "only allow apps from the Microsoft Store", which then blocks anything-else (aside from apps built-into the OS) from running?</p><p><br></p><p>Also, if you look at the recent ransomware attack on <em>Nvidia</em>, where they had their internal certificates stolen, a combination of malware signing itself with a stolen, but valid, certificate, and a device having no Internet connection, so no AI cloud-scan can be ran, would surely allow for a bypass?</p>
-
blue77star
<p>It is general idea of USA, EU and Western world to completely control resources and people. Those who resist, they get sanctions and marked as hostile territories. We are in era of corporate fascism, western imperialism…</p>
-
dftf
<p>Did you not read this article or something? It literally warns you if you want to use it, you have you reset your PC, and yet you sound surprised that happened?</p>
-
dftf
<p><em>This </em>might be a good new thing, sure, but otherwise most of the "new" security in <em>Windows 11</em> is simply stuff that already exists in <em>Windows 10 — </em>BitLocker or "Device Encryption" (in the <em>Home</em> version), use of a TPM, use of SecureBoot, "Core isolation" — but the difference being there are now <em>enabled by-default.</em></p><p><br></p><p><em>Windows 11</em> is also available in 64-bit kernels only (so as to have a wider address-space for ASLR), but seriously, how-many people actually install the 32-bit kernel versions of <em>Windows 10 </em>today? Even if you were to do that PAE hack, which then allows up-to, what, 36GB of RAM to be addressed, you’re still limited to 2GB of RAM per-app beyond the first 4GB boundary. Which is pointless for most modern apps that use more than that, such-as AAA games, CAD editing, RAW photo editing, video-editing and so-on.</p><p><br></p><p>And even in <em>Windows 11</em>, some security settings still aren’t enabled by default: the <em>Ransomware Protection </em>isn’t (mostly as it’s a pain-in-the-arse to setup), nor is extending <em>DEP</em> to all processes: it still defaults to "Turn on DEP for essential Windows programs and services only". (I’d probably take a guess too that even in <em>W11</em>, TLS 1.0 and 1.1 still come enabled by-default too; they do as of a fresh-install of <em>Windows 10 Version 21H2</em>, anyway.<span class="ql-cursor"></span>)</p>