No more superglued USB ports: Surface hardware can be locked down in firmware

Windows Hello biometrics come to regular domain-joined systems in the Creators Update.

Windows 10 and Surface hardware are now good enough for government work, even when dealing with classified data. The operating system and the Surface Pro 3 and 4, Surface Book, and Surface Studio have all been added to the NSA's Commercial Solutions for Classified Programs (CSfC) list. This means that, when properly configured and used in a properly designed layered deployment, the hardware and software all provide adequate security for classified data.

To further increase the appeal of the Surface in constrained enterprise environments, today Microsoft is announcing Surface Enterprise Management Mode (SEMM) for Surface Pro 4, Surface Book, and Surface Studio. SEMM enables administrators with physical access to the hardware to lock out integrated peripherals such as webcam, microphone, and USB ports. This locking out is done by the firmware, disabling the devices in question, rendering them wholly inaccessible to the operating system. It's intended as a much more elegant alternative to supergluing the ports or drilling out the cameras.

SEMM is designed to allow not just static configuration, wherein the devices are disabled permanently, but also dynamic configuration that responds to the environment. For example, a SEMM system could be configured so that when it was on a classified network the USB ports and camera were disabled, but when on an open network they were re-enabled. The system uses digital signatures and certificates to manage the configurations, preventing end users from re-enabling devices that they shouldn't have access to.

When they can, companies might want to leave those webcams enabled, however. Windows Hello biometric authentication currently requires systems to have some element of cloud connectivity. For home users, this means using a Microsoft account. For enterprise users, this means either pairing the domain account with a Microsoft account or using Azure Active Directory. Companies that were unwilling to use Microsoft accounts or unable to federate their local Active Directory with Azure were left out. The Windows 10 Creators Update changes that; it enables Windows Hello for any Active Directory organization, even if it's fully on-premises. This means that facial recognition using suitable webcams—including the ones found in the Surface—is available to many more enterprise users.

Later in the year, Microsoft will integrate Windows Hello with Intel Authenticate, a hardware-based authentication system that's part of Intel's vPro platform.

Windows systems currently have two broad sets of management tools: there's the Group Policy system, which remains the most capable farther-reaching setting and configuration tool, and there's also a range of settings that can be controlled by Mobile Device Management (MDM) software. The Creators Update is going to expand the number of settings that MDM can configure to include many of those in the Security Baseline Policies, and the MDM Migration Analytics Tool will help replicate policy settings so that they can be applied to MDM-controlled devices.

Microsoft has described already improvements that the Creators Update is bringing to Windows Defender Advanced Threat Protection (WDATP), and one more piece of data is now coming soon. WDATP users have told Microsoft that they want to gather all security-related reporting in a single place, and so WDATP is going to include reports from anti-malware software, starting with Windows Defender.

The cloud-based Windows Analytics service is also being enhanced to show uptake rates of Windows 10 security and feature updates.