Microsoft has announced a significant security update for Windows 11, introducing new controls that mirror the permission systems on modern smartphones. The changes are designed to make the operating system "secure by default" by giving users more direct control over how applications access data and system resources.

This change aims to address long-standing issues where applications can override system settings or install unwanted software without clear user approval. The new framework is built on two core components: "Windows Baseline Security Mode" and "User Transparency and Consent."

A 'Secure by Default' Approach

The new Baseline Security Mode will, by default, only permit applications, services, and drivers that have been properly signed to run. This process involves verifying a digital certificate that confirms the publisher's identity and makes sure the software has not been altered. (Source: windowslatest.com)

While this creates a stronger defense against malware, Microsoft has confirmed that both users and IT administrators will retain the ability to create exceptions for trusted applications that may be unsigned. This flexibility is crucial for developers and professionals who need to run specialized or legacy tools..

Granular Permission Controls

The second major change introduces a granular permission system inspired by security in mobile operating systems such as Android. Under the "User Transparency and Consent" feature, Windows will now explicitly request permission when an application attempts to access sensitive hardware like a camera or microphone, or personal data such as local files, location, and contacts.

These permission prompts are designed to be clear, providing a brief explanation of why the application is requesting access and allowing users to grant or deny it. Users will be able to review and revoke these permissions at any time via a centralized dashboard in the system settings, providing greater ongoing visibility and control over their privacy. (Source: bleepingcomputer.com)

What's Your Opinion?

Do you think enforcing signed apps by default will significantly improve Windows security? Will the new permission prompts become an annoyance or a welcome privacy feature? Are there any potential downsides to making Windows security more like a mobile operating system?