Stay more secure with Windows 8
Windows 8 has some significant security improvements, and they're not only about limiting what Metro applications can do to the PC. PCs that come with Windows 8 installed will have UEFI, the newer BIOS replacement that stores a database of OS signatures; with the UEFI secure boot feature enabled you can only boot a signed OS. That includes more than just Windows 8, and if you want to boot an unsigned OS or an earlier version of Windows you can turn it off, but with secure boot unless an OS signing key is compromised, you won't have to worry about root-kits and other malware that tampers with Windows before it starts up.
Most anti-virus software will now start as part of the boot process – before any malware can run and turn it off; there are pre-production versions of all the major anti-virus tools that support this Early Load Anti-Malware option and the good news is that in our tests this didn't slow boot times.
Protecting your anti-virus software means that malware will shift to attacking other software. If the PC has a Trusted Platform Module (TPM) chip – and far more PCs will come with a TPM, including Windows RT systems – you can use measured boot as well, which records the details of all the software you start up automatically – including your anti-virus software – and stores that securely in the TPM. That way if anything changes, including malware tampering with your anti-virus software, you'll know about it.
SmartScreen moves from Internet Explorer to Windows
Windows Defender works with Early Launch Anti Malware (ELAM), it's built in to Windows 8 and it's a good enough anti-virus package that it may well save you money by being all the security software you need, especially combined with SmartScreen.
This SmartScreen reputation service for executable files from IE9 is now built into Windows, so it works with programs that you load from a USB stick or DVD or download through other browsers. If it's the real version of Adobe Acrobat or WinZip it will download and install without any irritating warnings; if it's a fake, SmartScreen will spot that it's a file it's never seen before and warn you. You can still install the software if it's an obscure but legitimate program, but the warning will help protect you from viruses that are so new your anti-virus software doesn't know about them yet.
If you do get a virus, Windows 8 improves on the techniques Microsoft has been adding since Windows XP SP2 to make it harder to attack Windows itself, by putting code and data into different places every time it loads and adding integrity checks to more key parts of Windows including the kernel and the memory heap.
Faster BitLocker in Windows 8
Encrypting disks with BitLocker so the data is safe even if a PC is lost or stolen is much faster with Windows 8 because you can tell it to only encrypt the disk space that has data in (if you're re-using a PC, use a tool to erase it securely first).
If you have one of the new generation of hardware-encrypted disks, the encryption on these is now good enough for BitLocker to use, so encrypting these disks disk is almost instant.
Windows 8 fixes some other irritations in BitLocker; you no longer have to be an admin user to change the BitLocker password or PIN. Recovery keys are automatically saved onto your server (or SkyDrive). Lastly, if you have a Windows Server 2012 network you can set BitLocker-protected PCs to boot without needing a PIN, so people only need to type in the PIN if they're connecting from somewhere less secure than the office.
These improvements make BitLocker an excellent solution for protecting confidential data on business PCs without being so irritating it slows you down.
