Ensuring that we operate system security
As a part of our defense-in-depth look at securing Windows 11 systems, this section looks at the security measures we can take to protect the OS. These include Secure Boot and Trusted Boot, the Windows Security app, encryption, security baselines, and Defender, which we will discuss in the following sections.
Introducing Secure Boot and Trusted Boot
Secure Boot and Trusted Boot work together to provide OS-level protection of a Windows device during startup, preventing the loading of malware and corrupted components.
The initial boot-up protection is carried out by Secure Boot. The firmware is verified that it is digitally signed, and then all code that runs before the OS is checked by Secure Boot.
The digital signature of the OS bootloader is then checked to ensure the Secure Boot policy will trust it and that there has been no tampering.
Trusted Boot then picks up the process. The digital signal of the Windows kernel is verified...
