Recently, David Weston, Microsoft’s Vice President of Enterprise and OS Security, shared details about security improvements the company plans to introduce in upcoming Windows 11 releases, aiming to protect people against common cybersecurity threats. “Microsoft has made groundbreaking investments to help secure our Windows customers with hardware security innovations like secured-core PCs,” wrote Weston on the Microsoft Security blog. “In upcoming releases of Windows, we are advancing security even further with built-in protections to help defend from advanced and targeted phishing attacks.”
Go Phish
In the post, Weston shared several protection mechanisms to protect everything, including your apps, personal data, and other connected devices. Many of the changes, such as the Personal Data Encryption feature, are designed to protect remote workers. Then there are others, such as the vulnerable driver blocklist, that’ll help prevent attacks that take advantage of known weaknesses in drivers. Phishing protection, which guards users against fraudulent communications designed to trick people and extract sensitive information like login credentials, remains one of the most useful ones. Weston says the new protection will be rolled in with the help of Microsoft Defender SmartScreen, which is Microsoft’s cloud-based anti-phishing and anti-malware service. It’ll alert people as soon as it catches them entering their credentials into malicious applications or hacked websites. SmartScreen helped Microsoft block over 25 billion brute force authentication attacks and was able to intercept more than 35.7 billion phishing emails in the last year alone, Weston shared in the post. “[The phishing protection] will make Windows the world’s first operating system with phishing safeguards built directly into the platform and shipped out of the box to help people stay productive and secure,” added Weston. Romain Basset, Director of Customer Services with phishing detection and protection experts at Vade Secure, believes Microsoft’s latest improvements are certainly a positive development. However, he cautioned that today’s cybercriminals are well established, sophisticated, and one step ahead of the measures put in place to stop them. “SmartScreen, for example, checks email attachments against a list of known malware. This will certainly protect users against malware that has already been reported, but for those threats that are new, the user may not be protected,” Basset told Lifewire over email.
Bigger Fish
In the same vein, Roger Grimes, data-driven defense evangelist at KnowBe4, welcomed the changes but with some reservations. “I applaud what Microsoft has added here, but these features are fairly evolutionary and not revolutionary, like what is needed,” Grimes told Lifewire over email. Grimes opined that because of its size, anything Microsoft does to improve computer security will have a far-reaching impact. The flip side to its size, however, is that to ensure the changes it introduces don’t disrupt the user experience, the company can’t make bold, revolutionary changes. To prove his point, he cites the example of the User Account Control (UAC) component in Windows Vista, which he said caused widespread operational disturbances, forcing many people to switch to other operating systems. In fact, Grimes believes the biggest problems with cybersecurity these days has to do with the way the internet is structured, and new Microsoft cybersecurity features will never be able to fix these by themselves. “Everything any single vendor does, be it Microsoft, Google, Apple, RedHat, or whoever, is just one long failing game of whack-a-mole where the adversary can move far quicker into a new avenue of attack that takes vendors years to respond,” shared Grimes. Going one step further, Grimes shared that the problem with weak cybersecurity isn’t as much technical as it is human. “You cannot get the people in your household to agree on how to do something,” opined Grimes. “So, how do you get the whole global world of the internet to agree to do something a particular way?”
