- I'm Richard Dornhart and welcome to another episode
of "7 Minutes of Security".
(upbeat music)
Today I'm here with Mackenzie Jackson,
one of our Microsoft Device Specialist.
I'm actually really excited to have this conversation today
because I'm really interested in understanding
what's happening under the hood from a security perspective
with these Microsoft Surface devices.
Can you maybe give me kind of a high level overview
of what's happening?
- Yeah, definitely.
So Microsoft uses a multi-layered protection strategy
that works from chip to cloud.
And what's great is that every component is built
and maintained by Microsoft so, that gives IT more control,
proactive protection and ultimately peace of mind.
- Is that something that's unique to Microsoft in terms
of the ability to you know, kinda owning that manufacturing
process and all the components inside it?
- [Mackenzie] Yeah, definitely.
So everything is built and maintained by Microsoft,
even down to the device itself.
Every hardware component is built by Microsoft.
- Interesting, interesting.
And you mentioned this concept of chip to cloud.
Maybe you can explain what that means
in a bit of detail for me.
- [Mackenzie] Yeah, so chip to cloud security,
it starts down at the UEFI or the BIOSes,
what most people would call it.
And what's unique about that is again,
it's built by Microsoft so, they can be 100% sure
of every line of code that's running on the device.
- Right and it's normally the organization doesn't own
the BIOS and not building their own BIOS, is that right?
- Yeah so sometimes what other vendors will do is actually
take an off the shelf BIOS from a company such as
American Megatrends and they'll just plop it on the device.
This way Microsoft can be a 100% sure
of every line of code that's running.
- Right that's really cool.
What about the TPM chip?
Maybe explain first off what TPM stands for and then maybe
tell us a little bit about what's going on there.
- So with the trusted platform module chip which is what
a TPM chip is that that actually provides your hard disk
encryption and works with Windows BitLocker.
And that's also where your most sensitive information
is stored like your biometrics that's used
with Windows Hello.
- So how do surface devices integrate with windows 10?
- Well, the great thing is that when you have hardware
and software built together, naturally there's gonna be
some efficiencies.
So with surface devices, the security is built in not bolt
on so, you don't need to install any security agents.
It leverages the security agents that are already in
Windows 10 itself.
- Right, so it probably makes management a lot easier.
I understand and obviously it's gonna increase the security
exponentially, kind of having a single platform to maintain
from a security perspective and the integration of both
the sounds like the operating system and the device itself.
I'm wondering, how do you keep the security current
on the device?
- Well, with surface security, Microsoft invest a ton
of money in making sure that it stays current.
And one of the best things about this is that they actually
leverage the Microsoft security graph.
And with Windows 10, you've got over a billion devices
that are across the globe.
Microsoft is able to use the security graph to see all
of the incoming threats and build patches for them which are
automatically updated for Windows Update for business.
- So it dramatically reduces kind of the overhead
that's put on the ITT?
- Exactly.
- They have enough to worry about.
- Yeah. - These days.
- They don't have to worry about updating drivers
or device firmware when Windows Update for business
will automatically dispute.
- Absolutely and you know one of the,
probably one of the things that IT teams do have to think
about differently today is how the users you know,
where the user is located.
I think traditionally a lot of our users were working
from an office but times have changed.
We've got users working,
a lot of people working at home,
working from a lot of different locations.
How does it make it easier for them in this remote
environment that we're all working in?
- Well in rolling devices into Microsoft Endpoint Manager
Engine is the first step.
With surface that gives you access to DFCI
or Device Firmware Control Interface.
And what that allows IT teams to do is control
OS processes and in OS configuration down
to the firmware level from the cloud.
That means they could be at home or at the office
and be able to manage the device in a way that's down
to the firmware level itself.
- [Richard] Right, which is quite unique I suspect, yeah?
- Definitely.
- Now with the changes and the fact that people are more
mobile, they're moving around a lot more,
working at the office, what happens if I lose the device
or it gets stolen?
- Well, surface devices are natively encrypted BitLocker.
Even to the point that where when the device is updating
its own firmware, it's still encrypted.
So it should give you some piece of mind.
- Fantastic, now here's something that's near and dear
to my heart, the concept of passwords, right?
We have massive challenges around credential theft.
It's probably one of the leading issues when you look
at organizations that do have a security incident,
it's usually related to some sort of password situation.
- [Mackenzie] Yeah.
- What is Microsoft doing to help us remove the requirement
for a password?
- Well, you're completely right in that people tend to cycle
through the same passwords and really what you can do
is build a passwordless solution.
And with the device you've got all the biometrics
with the Windows Hello camera, or a fingerprint reader.
And you can use those biometrics to enable a passwordless
solution with another device such as a YubiKey.
- What's a YubiKey?
- So think of a YubiKey as like a car key for your device
or your M365 account.
It provides a second form of authentication
when you're authenticating to your device
or an M365 application.
- That's really interesting.
So we're getting to that point where we're not gonna need
a password anymore which is fantastic because I know most
people have lots of passwords to try to remember
and the more we can get rid of the safer we're all gonna be.
So Mackenzie, can I demo one of these devices?
- Definitely, we've got a demo program and we ship devices
around the State.
With any demo device right now, we'll even give you some
free YubiKeys.
- [Richard] Really?
- Yeah. - That's fantastic.
In fact, for the first 25 people that get in contact
with us either through our website,
which is www.data3.com.au or get in touch
with the account manager, we'll give you one free YubiKey
with a demo device so, you can test out
how you can go passwordless.
so Mackenzie, thank you very much, mate.
This has been a fantastic conversation.
We learned a lot today about surface and surface security.
And if you'd like to get more information about what
we've talked about here today, please don't hesitate
to reach out to your Data 3 account manager
or get in touch with us at the website.
And thank you very much for your time.
(upbeat music)