Chapter 12

Accounts and Security

In This Chapter

• Understanding accounts and account types in Windows 8
• Managing accounts with PC Settings
• Using advanced account management with Control Panel
• Using Microsoft Account features with other account types
• Understanding the new security features in Windows 8
• Protecting your PC from malware and viruses with Windows Defender
• Protecting your PC when Windows isn’t running
• Preventing malware downloads with Windows SmartScreen
• Understanding the Windows 8 improvements to Action Center and other security features

Everyone who uses Windows knows that you typically sign in, or “log in” as we used to say, to the PC using an account with which unique settings, documents and files, and even applications are associated. The types of accounts we’ve used in Windows have certainly evolved over the years, but for the most part, there have been two basic kinds of sign-ins: domain accounts, which are used exclusively by corporations, and local accounts, which are specific only to the PC on which they are used; home users and most individuals have always used this latter account type.

In Windows 8, Microsoft is introducing a new type of sign-in that is tied to a Microsoft account, or what used to be called a Windows Live ID. (With Windows 8, Microsoft is eliminating Windows Live as a brand, but is continuing its most popular products and services, often with new names.) As you’ll discover, this new account type is really just a formalization of a capability that debuted in Windows 7, but it takes on new prominence in Windows 8 thanks to this system’s pervasive PC-to-PC sync capabilities.

Windows 8 also provides interesting new choices for signing in, augmenting the long-lived password system with some new choices that may make more sense on today’s modern Windows devices and PCs. As always, securing your PC against electronic and human attack is job one for Windows 8, and in this version of Windows, you have more tools than ever to help ensure that your PC and its valuable data are safe.

But it all begins with your user account. So let’s look at that first.

User Accounts

Once relegated only to the corporate market, where they have always made sense because of their security and permissions boundaries, user accounts are central to today’s PC experience—so central, in fact, that you establish your user account when you first install Windows or set up your new PC.

Of course, user accounts aren’t generally as restrictive at home as they are at work. It’s your PC, after all, and most people rightly feel that they should be able to do anything they want on their PC. So that first user account you create, during Windows Setup, is automatically an administrator-class account, providing the permissions and access control that one would expect.

These local user accounts, or what we used to call workgroup accounts, work well enough for what they are. And they allow for some niceties, even at home. You can create multiple accounts on a single PC, giving users their own sign-in identity, along with its associated custom settings (desktop wallpapers and so on) and Windows and application configurations.

But local user accounts are starting to show the strain of time, and as our PC usage changes, so do the needs we place on them. For example, most people don’t bother to protect their own user accounts with a password, which can have huge ramifications in the event of a stolen PC. Local accounts are literally local to that one PC and thus hard, if not impossible, to replicate across machines; if you have more than one PC, as so many of us do now, making each one look and work the same is tedious. Local accounts make home network sharing difficult, too, which is why Microsoft created the homegroup sharing technique for Windows 7.

What’s interesting is that Microsoft basically solved these issues over a decade ago when they instituted the Active Directory domain services scheme in Windows Server. This system, which is used by corporations around the world, provides a more centralized approach to user accounts (and other things). So instead of signing in to a single PC and locking all of your personalized settings to that one machine, you sign in, instead, to the domain. And if you need to access a different machine, your customized experience can travel with you, so to speak, from PC to PC. With this scheme, the settings you typically think of being associated with an account are no longer locked into a single PC.

Active Directory is powerful and interesting, but it’s also far too complex for a home network and of course requires expensive and complex servers in addition to the PCs that people actually use each day. So this system isn’t well-suited for regular users at home.

So for Windows 8, Microsoft has created a new type of user account, based on your Microsoft account (previously called Windows Live ID) that provides many of the niceties of Active Directory but with none of the complexity. In fact, for most people, signing in to a Windows 8 PC with a Microsoft account is just as easy as doing so with a traditional local account. But there are numerous advantages to doing so.

So let’s examine them as part of a wider discussion about the types of accounts you can use with Windows 8.

Understanding Account Types

Windows 8 lets you sign in using three different types of accounts: domain, local, and Microsoft.

Domain Accounts

Domain accounts are used by corporations that utilize an Active Directory infrastructure running on top of Windows Server. The account is centrally managed by your employer, as are whatever permissions and capabilities you may be able to enjoy.

You connect Windows 8 to a domain as you did with previous Windows versions, using the advanced system control panel. Once the domain is configured, you reboot the PC and then sign in with your domain account’s username and password. In use, Windows 8 works almost identically to a local user account, but you lose some of the integration pieces that are special to Microsoft account sign-ins. As we’ll see in just a bit, there is a simple way to mitigate that issue.

Local Accounts

In Windows XP, Vista, and 7, most home users signed in to their PC using a local account, or an account that is, literally, local to that one PC. Local accounts are typically one of two account types, administrator or standard. An administrator essentially has complete control of the system and can make any configuration changes they want. A standard user can use most application software and many Windows services, but is prevented from accessing features that could harm the system. For example, standard users cannot install most applications, change the system time, or access certain Control Panel applets.

In previous Windows versions, most people simply used an administrator-type account because standard user accounts were so limiting and annoying. But with the move to multi-PC households and the PC-to-PC sync capabilities one gets with using a Microsoft account instead of a local account, our expectation is that the vast majority of Windows 8 users will no longer use local accounts. It’s still supported, of course, but it’s just depreciated.

Microsoft Accounts

Signing in to a Microsoft account is now the default, and preferred, way of doing things. A Microsoft account provides you with all of the benefits of a local account—simplicity and the ability to have both administrators and less privileged users—plus the benefits of the multi-PC settings replication of a domain account, and, of course, integration with Microsoft’s online services and third-party services like Facebook, Twitter, and more.

But the Microsoft account is more than a nicety. It’s required for many of the Metro-style apps that are built into Windows 8, including the productivity apps—Mail, Calendar, People, and Messaging—the digital media and Xbox apps—Xbox Music, Xbox Video, and Xbox LIVE Games—and more. Windows 8 was designed to integrate deeply with a Microsoft account, much like Windows Phone before it. And a Microsoft account is super easy to use.

For these reasons, we believe that signing in with a Microsoft account is the obvious choice for most Windows 8 users. Furthermore, we pretty much assume that you’re using a Microsoft account throughout this book because of the advantages of doing so.

There’s just one problem. In some cases, you can’t sign in to your PC with a Microsoft account the first time you set up Windows 8. For example, if your PC is offline the first time you use Windows 8, a Microsoft account won’t even be offered. But the more obvious example, perhaps, is a work PC: There’s no way that corporate will let you or other users bypass the built-in security features of their carefully crafted policies and sign in with your personal Microsoft account.

If only there was a way around this limitation.

Making the Most of a Domain or Local Account

If you are signing in to a PC with a domain or local account, there are some changes you can make to provide you with the best possible experience. Which you do will depend somewhat on whether you’re currently signing in to Windows 8 with a local account or a domain account. These changes include:

• Switch a local account to a Microsoft account: If you opted out of the Microsoft account sign-in when you first set up Windows 8, perhaps because you were confused by this new account type and simply wanted things to be as close as possible to the way it was in Windows 7, Microsoft actually lets you change your local account after the fact and switch it to a Microsoft account.

Figure 12-1: You can convert your local account to a Microsoft account at any time.

• Connect a domain account to a Microsoft account: If you’re using a domain account, you can’t switch it to a Microsoft account. But you can link your domain sign-in with your Microsoft account, achieving the same benefits as you’d get by simply signing in with a Microsoft account. In the business, this is what we call a “best of both worlds” solution.

• Sign in to app groups with a Microsoft account: There is a third approach, one that provides a more limited way to access some Microsoft account goodness, but without changing your domain or local account in any way. That is, instead of linking or switching your existing sign-in account, you can simply try to run one of the connected apps in Windows 8 and then sign in when prompted by a screen that will resemble Figure 12-3.

Managing Accounts

In previous Windows versions, we managed local user accounts in Control Panel, a desktop user interface that dates back to the earliest days of Windows. But in Windows 8, basic user account management tasks now occur within the Metro-based PC Settings instead, while, confusingly, a few more advanced or esoteric features can still be found in legacy control panels. So you may find yourself moving back and forth between the two environments depending on your needs.

Let’s start with the basics.

Managing Accounts in PC Settings

Like many Metro interfaces, the Users section in PC Settings is almost disarmingly simple. As you can see in Figure 12-4, this UI lets you manage features related to your own and other user accounts. (This figure displays the version of this screen that most users will see, since it depicts a Microsoft account.)

These features, which vary somewhat depending on the type of account you use to sign in, can include:

• Switch to a local account/Switch to a Microsoft account: If you’re signed in with a Microsoft account, there is a Switch to a local account button that will let you do just that, albeit at the expense of losing all of the included functionality one gets with such an account type. If you are signed in with a local account, however, you will see a Switch to a Microsoft account button instead.
• Connect your Microsoft account/Disconnect your Microsoft account: Those who are signed in with a domain account (used only in corporations and other businesses) will see a button, Connect your Microsoft account, as described earlier in this chapter. If you’ve already connected your domain account to a Microsoft account, you will see a Disconnect your Microsoft account button instead.
• Change your password: Those with local or Microsoft account sign-ins can change their password at any time using this button. Domain users will not see this option; instead, you can type Ctrl + Alt + Del and choose the Change a password option from the full-screen menu that appears. However, your ability to actually change your password will be based on corporate policy. (And, in fact, many businesses may require you to change passwords on a regular schedule, whether you want to or not.)
• Create a picture password/Change a picture password: With the advent of touch-based Windows devices, including tablets and other touch screen devices, Windows 8 now offers two fun and efficient new ways to sign in to your computer: picture password and PIN (the latter of which is described next). Neither replaces your normal password. Instead, you can use either to implicitly sign in to the system using your actual password, but using a method that is simpler (and, in this case, a bit more fun) than a normal password. This is especially useful because tapping out a long password on a touch screen can be tedious.

• Create (or change) a PIN: If you’ve ever used a smartphone, you know that four-digit PINs, or personal identification numbers, are the norms for securely signing in on such devices. This sign-in option allows you to use the same convenient sign-in type on your Windows PC or device, and while it’s particularly nice for touch-screen devices, we’ve both switched to using this sign-in type on our traditional desktop PCs, too, since it’s so fast. Setting up a PIN is very straightforward, and each digit must be a number.

• Add a user: If you select the Add a user link under Other users, you’ll be presented with the new full-screen interface shown in Figure 12-6. It’s set up for a Microsoft account by default, but you can click the link titled Sign in without a Microsoft account to configure a traditional local user account instead.

So, yes, you can mix and match Microsoft and local accounts (and even domain accounts) on a single PC, though our general rule about using Microsoft accounts exclusively when possible still applies for your own PCs.

Advanced User Management with Control Panel

PC Settings is cute and everything, but if you want to dive into the nitty-gritty of user account management, you’ll need to visit the old-school Control Panel interface instead. And yes, you still want to know about this interface even if you’re not particularly interested in advanced features. And that’s because there are certain things related to account management that you can only do from Control Panel.

For example, the very first account you create with Windows 8 is always an administrator-class account, and that’s true whether that account is a Microsoft account, as recommended, or a traditional local account. But when you create other accounts, as explained earlier, those accounts are not administrator-type accounts. And the Metro-style PC Settings interface doesn’t offer any way to change them.

But Control Panel does. In fact, Control Panel provides so much additional functionality with regards to user accounts that it seems a shame to ignore it.

Of course, you need to find it first. The easiest way is via Start Search: Display the Start screen, type user, select the Settings filter in the right pane, and then choose User Accounts in the results list. This displays the old-school User Accounts control panel, as shown in Figure 12-7.

Here are some of the user account–related tasks you can only complete using Control Panel:

• Change an account type: As noted previously, the first account you configure on your PC—whether it’s a Microsoft account or a local user account—is an administrator-type account. But what about subsequent accounts? As it turns out, all subsequent account additions—be they Microsoft or local accounts—are created as standard users, not administrators. This may be desirable, but if you’d like to change an account from one type to the other, you can do so.

• Manage User Account Control: In Windows Vista, Microsoft introduced what was then a very controversial feature called User Account Control, or UAC, which took advantage of Microsoft’s efforts to componentize Windows by dividing each of the system’s functional entities, or components, into one of two groups: those that require administrative privileges and those that don’t. Those that don’t would just work and you could just go about your day and not really think about the security implications of anything underpinning the system.

• Enable and configure Family Safety: Microsoft first provided pervasive Windows-based parental controls functionality in Windows Vista, providing parents with a way to create and enforce settings related to computer usage, including a web filter (for allowing and disallowing individual websites and downloading), time limits, games, and applications (including which can and cannot be used).

• Enable the Guest account: While you can go to great lengths to protect standard user accounts with parental controls, sometimes all you’re looking for is a single, temporary user account with standard user privileges that anyone can use. As with previous Windows versions, Windows 8 includes such an account, called the Guest account, and it’s a safe and easy way to let others use your PC without worrying that they’re going to view, modify, or delete any crucial data, uninstall or change an application, or perform other dangerous tasks.

• Reset EAS Policies: When you sign in to a Windows 8 PC or device with a Microsoft account, you’re using a technology called Exchange ActiveSync (EAS) under the covers to provide push-based access to your Hotmail-based e-mail, calendar, contacts, and other data. EAS is a Microsoft-created corporate standard that is used by Hotmail and Microsoft’s Exchange- and Office 365-based services, and also by competing services from Apple, Google, and other companies. (In this way, it’s a de facto standard for all modern mobile devices.) And one of its big advantages is that it supports the notion of EAS policies, which can set restrictions on the device—smartphone, tablet, or PC—that you use to access the underlying services. For example, your workplace may want to ensure that you sign in with an account that has an acceptable password (from a length and complexity standpoint) and then auto-locks after a certain period of inactivity.

Security and Windows 8: Keeping Your PC Safe

While Mac partisans and tech pundits like to present a tortured view of how difficult it is to secure a Windows PC, the truth is far less dramatic. Previous to Windows 8, there were a few simple steps you could take to technically secure your PC—enabling automatic updates and installing an antivirus solution—and that, combined with some good old-fashioned common sense was all that was required.

In Windows 8, you’ll be ecstatic to know, it’s even easier.

Under the hood, of course, Microsoft’s decades-long commitment to system security continues. This version of Windows includes the same anti-malware technology, firewall, User Account Control, and other security features that made Windows 7 the most secure version of Windows yet. And then they turned it up a notch by adding two crucial new features: Antivirus is now included in the OS, finally, so you won’t need to add that separately. And the SmartScreen protection feature that the company debuted in Internet Explorer 9 is now part of Windows, so you’re protected even if you use competing browsers.

You’ll still want to employ common sense. But that’s not a focus of this book.

Windows Defender

Microsoft has included an integrated anti-spyware and anti-malware solution called Windows Defender since Windows Vista. Defender was good at what it did—in fact, most Windows users simply aren’t even aware of its existence, which is proof of its efficiency—but it’s always been lacking one crucial feature: It didn’t include antivirus functionality. So we recommended an external and free utility called Microsoft Security Essentials (MSE) for this purpose: MSE looked and worked just like Defender, but it added that one crucial feature, completing the Windows security picture.

Now, Windows Defender includes the same antivirus functionality that used to be part of Microsoft Security Essentials. It’s built into Windows 8, it’s enabled by default, and you get it for free, just for buying into Windows 8.

This is exciting because both of us have used MSE for years, and we trust it to protect not only our own PCs, but more crucially those of our families and friends. And we’ve experienced no major issues yet. Not once.

So our advice is simple. Assuming you’re not spending your time in the nether regions of the web, downloading illegal software and goodness knows what else, Windows Defender is enough. It’s lightweight and quiet, and it won’t bother you with annoying pop-up dialogs. You won’t need other security applications or even more expensive security suites. You know, assuming that common sense is employed.

But we know you want to know a bit more about Windows Defender.

Shown in Figure 12-15, Windows Defender has a simple interface. From here, you can trigger a malware and virus scan, check for updates, view the history of Defender’s activities, or access various options. It works just as Defender did in Windows 7, except that it’s now checking, in real time, for viruses as well as spyware and other malware.

There’s not a heck of a lot to do here. Configured properly, Defender’s real-time protection against viruses and malware will be enabled, and its virus and malware definitions—part of its ability to detect errant software—should be up to date. You can manually update the definitions from the Update tab, but it’s unlikely there’s an issue here unless the PC has been offline for weeks or longer.

Potentially harmful items that have been found are cataloged on the History tab. Here, you’ll see different buckets for quarantined, allowed, and all detected items. If there are any items here, you can further remediate them if you’d like—perhaps by removing them entirely—but there’s usually no reason to bother.

The Settings tab has, as expected, a number of configuration options and is worth looking at. For example, you can configure Defender to scan removable drives during a full scan. This is desirable if you regularly use an external disk, like a USB hard drive, when you’re home. You can also configure Defender to automatically remove quarantined items after a set time period—by default it does nothing—and determine whether to participate in Microsoft’s Active Protection Service, or MAPS, which is used to make Defender more effective for everyone. Do your part: We recommend at least a basic membership.

Boot-Time Security

Windows Defender, like its predecessor, is great at what it does. But there’s one problem with an integrated antivirus and anti-malware solution like Defender, and that is that Windows 8 must be running for it to work. There are certain situations in which you may wish to secure your PC’s hard disk—just as when it’s booting—or need to run a security scan against the hard disk when Windows isn’t running. And while one might argue that these capabilities aren’t technically Windows 8 features per se, you need to know about them.

First, as PCs have become more sophisticated, the architecture on which Windows runs has evolved. And one of the biggest changes that Windows 8 has been designed to accommodate is the long overdue switch from the primitive BIOS (basic input/output system) environments that have graced (disgraced?) PCs since the 1980s. BIOS is a type of firmware, a tiny bit of software that runs before Windows when the PC first powers on. And while it’s possible to run Windows 8 on a BIOS-based computer—basically every single PC made before 2012—a new generation of more sophisticated PCs and devices are instead using BIOS’s replacement. It’s called UEFI, or the Unified Extensible Firmware Interface.

UEFI provides many advantages over BIOS, but from a security perspective the big deal is that PCs based on this firmware type can support a new technology called Secure Boot. Based on industry standards, Secure Boot ensures that a system hasn’t been tampered with while offline. (That is, while Windows isn’t running.)

It sounds Orwellian but the purpose of Secure Boot is valid: It targets a growing class of electronic attacks that insert code before Windows boots and try to prevent the OS from loading security software like Windows Defender at boot time, leaving the system vulnerable to further attack. Secure Boot ensures that only properly authorized components are allowed to execute at boot time. It is literally a more secure form of booting.

All Windows 8 PCs and devices will be configured from the factory to support Secure Boot and have this firmware feature enabled. But if you are going to install Windows 8 on a previous PC, you can check to see whether this feature is supported and then enable it before installing the OS.

As a feature of the PC firmware, Secure Boot isn’t configured in Windows; it’s configured in the UEFI firmware interface. This interface will vary from PC to PC, but it’s generally available via a Boot or Security screen in the firmware and is toggled via an option that will be labeled UEFI Boot. This can be set to Enabled or Disabled.

The other security issue that arises at boot time occasionally is the need to scan an offline system. That is, you may want to run a Windows Defender security scan against a Windows 8 hard disk, but when Windows isn’t running. This can be a vital capability if your system is infested with a bootkit or rootkit, malicious forms of software that are both hard to detect and almost impossible to remove . . . when Windows is running. But if you can attack bootkits and rootkits while Windows is offline, then voila! Problem solved.

Fortunately, Microsoft makes a standalone version of Windows Defender called the Windows Defender Offline. As you might expect, it is based on Windows Defender, and looks almost identical to that tool. But you install it to a bootable optical disc or USB memory stick and then boot the PC from that. Windows Defender Offline is shown in Figure 12-16.

Strictly speaking, there’s no reason to run Windows Defender Offline unless you know you have a problem. But don’t wait to create a bootable Windows Defender Offline disc or USB key until you have a problem: This is a tool you should have at the ready, just in case. You can download Windows Defender Offline from the Microsoft website at tinyurl.com/defenderoffline.

Windows SmartScreen

Microsoft added an interesting and useful security feature to Internet Explorer 9 called SmartScreen that helps guard your PC against malicious software downloads. IE 9’s SmartScreen feature works very well, but of course it can’t help you if you use a different browser, such as Google Chrome or Mozilla Firefox, or if you download a malicious file through another means, such as an e-mail application or USB storage device.

To help protect you against malicious software more globally, Windows 8 includes a special version of SmartScreen, called Windows SmartScreen, which protects the filesystem against malicious files, no matter where they come from. Windows SmartScreen works exactly like IE 9’s SmartScreen feature, meaning it utilizes both holistic sensing technologies and an Internet-hosted service to determine whether files are malicious or at least suspected of being so.

Configuring Windows SmartScreen

To configure Windows SmartScreen, you’ll need to launch Action Center, which is available via the system tray (it’s the icon that resembles a cute little white flag) or through Start Search.

Using the Action Center route, you’ll see an option on the left of the window called Change Windows Start Screen settings. Click this option to display the window shown in Figure 12-17.

We recommend using the default setting, which is “Get administrator approval before running an unrecognized app from the Internet.” Unless you’re regularly hanging out in torrent sites or other gray areas of the Interwebs, you’ll find this isn’t too annoying.

Using Windows SmartScreen

When Windows SmartScreen fires up, you’ll know it: The full-screen notification shown in Figure 12-18 displays, interrupting whatever you were doing.

As with any full-screen notification, you’ll want to deal with this before proceeding. And while SmartScreen can certainly suffer from false positives, our advice is to think very carefully before just dismissing this. It’s warning you for a reason.

Action Center Improvements

If you’re familiar with Action Center from Windows 7, you know that it’s an improved version of the Security Center that dates all the way back to Windows XP with Service Pack 2. In Windows 8, Action Center carries forward largely unchanged in that it still performs the same function of tracking security and troubleshooting items in the OS and popping up notifications when something goes wrong.

What’s changed is that Action Center now tracks far more items than it did in Windows 7. And while many of the items it tracks are, as you might expect, related to new features in Windows 8, some aren’t. It’s just fleshed out better.

In Windows 8, Action Center now tracks these additional items:

• Windows SmartScreen: This security feature, described earlier, debuted in Windows 8 and provides anti-malware protection directly through the Windows filesystem.
• Windows activation: While activation is hardly new to Windows 8, Microsoft has created an Action Center experience in this release that tracks whether your copy of Windows is activated, and thus valid. You can see this interface in Figure 12-19.

Figure 12-19: Windows is activated

• Microsoft account: The ability to sign in to Windows 8 with a Microsoft account is obviously new to this version of the OS, but the underlying technology that Action Center is actually tracking here is whether your account is working properly and syncing settings from the PC to SkyDrive (and thus to other PCs) and vice versa.
• Automatic maintenance: Like previous Windows versions, Windows 8 will automatically run a scheduled maintenance routine at a set time, 3:00 a.m. What’s changed in Windows 8 is that this activity is now tracked by Action Center to ensure that it completes successfully. But you can use the Start maintenance link to run a manual check or Change maintenance settings to configure a new time.
• HomeGroup: Action Center now checks to see whether you’re part of a homegroup. This is important because signing in with a Microsoft account breaks the normal workgroup-style home network sharing we used to use.

• File History: The new File History feature works with the Push Button Reset functionality in Windows 8 to create a more flexible way of restoring lost data than the old method, a combination of Previous Files (which no one even knew existed) and Windows Backup (which was ponderous and slow).
• Drive status: Action Center now checks to see whether all of the fixed disks attached to your computer are working properly.

When Action Center detects an issue, it provides notifications via its system tray icon. Clicking these, or the associated warnings that appear in the Action Center control panel, brings you to the user interface you need to mitigate the issue. For example, as part of its overall system performance and reliability tracking, Action Center could eventually warn you to disable app[lication]s to help improve performance. This slightly off-base recommendation—it really means, “disable startup applications to improve boot-time performance” and has nothing to do with Metro-style apps—links to the Task Manager. In Windows 8, the Task Manager now provides a Startup tab that lets you enable and disable applications (but not Metro-style apps) that are configured to run at boot time. This can be seen in Figure 12-20.

But Wait, There’s More

In addition to the features discussed previously, Microsoft has improved a number of security features that debuted in previous Windows versions, too. Most of the features don’t require any user interaction. They simply work in the background, ensuring that Windows 8 is as secure as it can be.

A small sampling includes the following:

• Credential Manager: Windows has long included a Credential Manager interface—previously called Windows Vault—that helps you combine the usernames and passwords for the local network and for websites with your Windows user account. New to this release is that you can now tie these other sign-ins with your Microsoft account for the first time, since most people will be signing in to Windows 8 with that account type.
• Windows kernel: The innermost part of Windows has been shored up with protection technologies that were curiously available only to other Windows components in previous OS versions.
• ASLR: Since Windows Vista, Windows has employed a technique called address space layout randomization (ASLR) to randomly load code and data into different memory addresses at run time, cutting down on an entire class of memory-based attacks. In Windows 8, ASLR has been improved with even more randomness. And it’s been extended to even more Windows components.
• Memory: Modern Windows versions have of course always included various forms of protection against memory-based attacks, and the move to isolated Metro-style apps will help in this and other regards. But Windows 8 also includes new protections against “use after free” vulnerabilities, where rogue or malicious applications are able to examine and exploit freed up memory that still includes valuable data or other code.

There’s still more, but you get the idea. While many Windows 8 security features are in your face when required, some simply work behind the scenes, tirelessly keeping you safe without you doing a thing. What’s missing is the “security theater” that used to dog older Windows versions, where the security features were purposefully made to be overly chatty and interruptive, providing you with a sense that something good was happening.

Summary

With Windows 8, Microsoft offers the first major change to user accounts since, well, it added user accounts to Windows. Now, home users can get the same kind of settings-roaming functionality that was previously available only in expensive and complex corporate environments, tied to the online ID—the Microsoft account—we all already use. Of course, those using traditional workgroup-type local accounts or domain accounts won’t be left behind either, and you can mix all three account types on the same PC if desired.

From a security perspective, Microsoft has finally closed the loop and silenced the critics by adding an excellent and effective antivirus solution to the OS. That, combined with new boot-time security protections, new security features like Windows SmartScreen, a host of new Action Center-based reliability and security tracking functionality, and, of course, all the excellent security features from Windows 7, makes Windows 8 the most secure Windows yet.

But then you expected nothing less, right?