Security took a backseat at Microsoft's Wednesday Windows 10 event, but that doesn't mean Redmond hasn't made any security tweaks.

Windows 10 has a "very long list of enhanced security features developed into this new codebase along with a massive amount of new attack surface introduced with this new platform," Kurt Baumgartner, a senior researcher at Kaspersky Lab wrote in a blog post.

Project Spartan—New Browser Headaches?

One of the biggest changes is in the Web browser, as most users won't see Internet Explorer on Windows 10. The new browser, currently going by Project Spartan, is a break from Internet Explorer as it comes with a brand-new rendering engine. However, Microsoft understands backwards compatibility, and said Project Spartan would be able to load the IE11 engine if the user is trying to access existing enterprise websites specifically designed for Internet Explorer.

Project Spartan's engine is supposed to feature HTTP Strict Transport Security (HSTS), according to Microsoft. HSTS is an HTTP header that informs the browser to always request a given domain over SSL. This will help reduce the man-in-the-middle attack surface. Microsoft has not disclosed other security features, development practices, or sandboxes for Project Spartan.

Even so, considering that there were over 200 vulnerabilities patched in various versions of IE in 2014 alone, abandoning the codebase and going for a minimalist refresh with Project Spartan seems like a good idea. "Simply put, the IE web browser was hammered in 2014 across all Windows platforms, including their latest," Baumgartner said.

However, what's not to say Project Spartan, with large amounts of new code for communications and data sharing, won't just follow Microsoft's history of having to patch hundreds of vulnerabilities annually? "Hopefully their team won't bring that baggage with them, but the load seems pretty heavy with the new functionality," he said.

The backwards compatibility with the IE engine may also pose some problems. "More features + cross-platform support + backward compatibility = much larger code base (millions of lines of code," said Franklyn Jones, vice-president of marketing at Spikes Security. A much larger code base means there would potentially be many more vulnerabilities and a much larger attack surface for cyber criminals to exploit, he said.

Authentication and Trust

Microsoft will block untrusted applications from installing on the system. Trustworthiness will be verified with the application's digital signature. While this trusted signing model is an improvement, Baumgartner said the way Windows 10 would handle it is "not perfect." Past cyber-espionage attacks have shown that digital certificates are readily stolen and re-used in attacks. Actors share the certificates across groups and break the trust model, he said.

Windows 10 will have identity protection and access control built-in to withstand phishing attacks, two-factor authentication requiring users to use a PIN or a biometric, and a data loss prevention tool to automatically encrypt corporate data saved in pre-determined locations, Microsoft said previously.

The new operating system boasts seamless integration of data-sharing services across computing resources, which means authentication and their underlying credentials and tokens cannot be leaked across services, applications, and devices, Baumgartner noted. But it's not clear Windows 10 has protections to defend against pass-the-hash techniques, attacks against Active Directory using "skeleton keys," or attacks on Hyper-V and the container model to access and abuse tokens. Security researchers should focus on how Microsoft implemented credential provisioning and access token handling, he said.

"The DLP implementation for sharing corporate data securely is encouraging as well, but how strong can it be across energy constrained mobile hardware?" Baumgartner asked.

Further Reading