Built-in Security Features

Chapters 5 and 7 both pointed toward the Windows Security app without opening it. This chapter finally does — Defender, BitLocker, and Smart App Control, plus the TPM and UAC material from Chapters 2 and 4 finally paying off as the real foundation two of these features are built directly on top of.

The Windows Security App — One Dashboard, Several Engines

Windows Security consolidates several genuinely separate protection systems into one interface: Virus & threat protection, Account protection (where Windows Hello, covered in Chapter 4, actually lives), Firewall & network protection (Chapter 7's own firewall material, surfaced here), App & browser control (home to Smart App Control), and Device security (TPM status and, on capable hardware, BitLocker/Device Encryption).

Microsoft Defender Antivirus

Defender is built in and active by default, combining real-time protection (scanning files as they're accessed) with cloud-delivered protection (checking suspicious files against Microsoft's own up-to-the-minute threat intelligence rather than relying solely on a locally stored signature file). Installing a third-party antivirus product automatically disables Defender's own real-time scanning to avoid conflicts — but Defender still performs periodic background scans even then, as a genuine second layer rather than switching off entirely.

BitLocker — Full-Disk Encryption, TPM-Sealed

BitLocker encrypts an entire drive, decrypting it transparently the moment Windows boots successfully and the TPM — the same chip Chapter 2 covered as a Windows 11 installation requirement — releases the encryption key. If the drive is removed and connected to a different machine, or if the boot process is tampered with, the TPM refuses to release the key at all, and the drive remains fully encrypted and unreadable.

On many Home-edition machines meeting the hardware requirements, a lighter version called Device Encryption turns on automatically the moment a Microsoft account signs in — a real, easy-to-miss consequence of Chapter 2's own account-type decision, tying that setup-time choice directly to whether disk encryption is silently active today.

BitLocker vs. Database Security 5's Own Encryption-at-Rest Material

Both are genuinely "encryption at rest," and both decrypt transparently for the legitimate process that's supposed to have access — but they protect against a different specific threat, at a different layer entirely, exactly the kind of same-name-different-mechanism distinction worth keeping straight rather than assuming one implies the other.

Key Management — a Real Instance of Cryptography Fundamentals 11

BitLocker's own recovery key — a 48-digit backup, generated once and requiring the user to save it somewhere outside the encrypted drive itself (a Microsoft account, a USB drive, printed, or Active Directory in a managed environment) — is a direct, practical instance of the key-storage and backup discipline Cryptography Fundamentals 11 covers in general terms. There is no backdoor: losing both the TPM-sealed key and the recovery key means the data is genuinely, permanently unrecoverable.

Smart App Control

Smart App Control (Windows 11 22H2 and later) uses cloud-based AI and code-signing verification to block unknown or unsigned applications from running at all, before they get the chance to do anything — a meaningfully more proactive stance than Defender's own scan-after-the-fact model.

Hands-On Exercises