Windows 7 / Security and Privacy

Credential Manager Enhancements

Windows Vista and Windows 7 include new tools to enable administrators to better support credential management for roaming users, including the Digital Identity Management Services (DIMS) and a new certificate enrollment process. Among other improvements, users can now reset their own smart card PINs without calling the support center. Additionally, users can now back up and restore credentials stored in the Stored User Names And Passwords key ring.

To improve the security of Task Scheduler, Windows Vista and Windows 7 can use Servicefor- User (S4U) Kerberos extensions to store credentials for scheduled tasks instead of storing the credentials locally, where they might be compromised. This has the added benefit of preventing scheduled tasks from being affected by password expiration policies.

Architectural and Internal Security Improvements

Whenever possible, Windows Vista and Windows 7 security features have been designed to be transparent to end users and to require no administration time. Nonetheless, administrators and developers can benefit from understanding the architectural improvements. This section describes these architectural and internal improvements, as well as improvements that require additional applications or infrastructure. Table below describes these features originally introduced in Windows Vista and also included in Windows 7.

Architectural and Internal Security Improvements in Windows Vista and Windows 7
ImprovementDescription
Code IntegrityDetects malicious modifications to kernel files at startup.
Windows Resource ProtectionPrevents potentially dangerous changes to system resources.
Kernel Patch ProtectionBlocks potentially malicious changes that might compromise the integrity of the kernel on 64-bit systems
Required Driver SigningRequires drivers to be signed, which improves reliability and makes it more difficult to add malicious drivers. Mandatory on 64-bit systems.
Windows Service HardeningAllows system services to access only those resources they normally need to access, reducing the impact of a compromised service.
Network Access Protection clientWhen used together with Windows Server 2008, helps to protect your network from clients who do not meet your security requirements.
Web Services for ManagementReduces risks associated with remote management by supporting encryption and authentication.
Crypto Next Generation servicesAllows the addition of custom cryptographic algorithms to meet government requirements.
Data Execution PreventionReduces the risk of buffer overflow attacks by marking data sections of memory as nonexecutable.
Address Space Layout RandomizationReduces the risk of buffer overflow attacks by assigning executable code to random memory locations.
New Logon ArchitectureSimplifies development of custom logon mechanisms.
Rights Management Services clientProvides support for opening Rights Management Services protected documents when the proper applications are installed and the necessary infrastructure is in place.
Multiple Local Group Policy ObjectsAllows administrators to apply multiple Local Group Policy Objects to a single computer, simplifying security configuration management for workgroup computers.
[Previous] [Contents] [Next]

In this tutorial:

  1. Windows 7 Security
  2. Addressing Specific Security Concerns
  3. Help Desk Calls Related to Malware
  4. Protecting Against Bundling and Social Engineering
  5. Protecting Against Browser Exploit Malware Installations
  6. Protecting Against Network Worms
  7. Data Theft
  8. Security Features Previously Introduced in Windows Vista
  9. Windows Defender
  10. Windows Firewall
  11. Encrypting File System
  12. Credential Manager Enhancements
  13. New Security Features of Windows 7