Mobile devices have fundamentally altered where and how we use technology. The concept of the traditional office and 40-hour work week have faded away because people can stay connected and get things done virtually anywhere and any time.
Smartphones are convenient for checking email and performing basic tasks, but too small for any real productivity. Tablets, on the other hand, are large enough to work on and have a variety of unique advantages over laptop PCs, but still face challenges when it comes to running the software users need, or keeping data synced between the tablet and a PC.
Benefits of tablets
The tablet is an ideal mobile computing device. Tablets are exceptionally light and thin compared to traditional laptop PCs, and most are svelte even by Ultrabook or netbook standards. A few ounces can make a huge difference when you’re lugging a device around all day.
Tablets are more convenient to use on the go than a laptop PC. Laptops are cumbersome—they need a surface to sit on and have to be opened up to be used. A tablet is flat, and it can be held in one hand. A touchscreen display makes it easy to navigate the device and open apps even while walking down the hall.
Exceptional battery life is another hallmark of tablets. Most laptops can only survive a few hours at best, and even Ultrabooks top out around 7 hours on average. But, most tablets can make it through an entire workday on a single charge, freeing you up from power cords.
Tablet challenges
Despite the advantages, tablets face a number of obstacles when it comes to business productivity. Most tablets use a mobile operating system like iOS or Android. They can only run apps that are specifically developed for the mobile OS, which means they can’t run the software businesses rely on, like custom applications or productivity suites like Microsoft Office.
The ports and slots available on a tablet vary widely from one device to the next, but from a hardware perspective most tablets are very limited. A USB port or SD memory card slot are useful for expanding the limited storage capacity of the tablet, or simplifying the process of moving data to and from the device.
Tablets running a mobile OS also can’t join a Windows network domain. That means they can’t be managed with Active Directory and Group Policy like desktop and laptop PCs, and they can’t be monitored or protected using the same tools the business is already using. They either require additional applications and effort, or they’re just ignored and act as rogue devices that expose the company to risk.
Best of both worlds: Windows 8 tablets
Tablets running Windows 8 Pro straddle the line between PC and tablet, and let users enjoy the benefits of a tablet without sacrificing productivity or security. The beauty of a Windows 8 tablet like the Dell Latitude 10 is that it is simultaneously a Windows PC and a tablet.
The new tiled interface of Windows 8 provides a slick experience equivalent to iOS and Android mobile devices. There are tens of thousands of apps available in the Windows Store—games, entertainment, productivity, social networking, and other apps designed specifically for a mobile, touchscreen experience.
A Windows 8 tablet also has something that other tablets are missing, though—a desktop mode that runs legacy Windows software. That means you can still use Microsoft Office or your custom CRM tool on your tablet. All of your software and data is right there with you no matter where you are.
With an optional docking station, you can just snap the tablet into place while working at your desk, and it is functionally identical to a traditional desktop or laptop PC. The docking station keeps that tablet charged, and instantly connects the device to an external monitor via HDMI, to a wired gigabit Ethernet network connection, and to other devices like a full-size keyboard, mouse, and printer via USB. While using the device in this configuration, you can forget that it’s a tablet at all.
When it’s time to go to a meeting down the hall, or visit a client, or go home for the day, though, you can just take the tablet out of the docking station and be on your way. Unlike having a separate tablet running a mobile OS, you don’t have to jump through hoops to find compatible apps or ensure your data is synced because everything is still there on your PC. It’s just much more convenient to take with you or work on the go than it would be with a desktop or laptop PC.
A Windows 8 tablet can be joined to a Windows network domain and managed using Active Directory and Group Policy. It lets you monitor and enforce security policies, and manage access using the same software and tools you use for the rest of your desktop and laptop PCs.
The tablet is the PC
Don’t waste money buying both a laptop and a tablet, and don’t waste time debating which is better for mobile productivity. A Dell Latitude 10 is both a tablet and a full Windows 8 PC. It gives you the best of both worlds and lets you jump on the tablet revolution without sacrificing productivity.
2013年6月20日星期四
2013年6月14日星期五
Big hurdle facing Windows 8 tablet adoption
Say what you will about Microsoft's shot at the tablet market with Windows 8, there's no denying the guts it took. Completely redesigning the biggest OS in history was guaranteed to ruffle a few feathers. Unfortunately, the big roll of the dice the company's taken with Windows 8 is not panning out so far in the tablet space. There's one particular reason why that may be, and there's not much Microsoft can do about it.
Windows 8 is designed from the ground up to handle both desktop and tablets, but it's the latter category Microsoft most wants to crack. The tablet market has been growing like weeds while the PC/desktop market has been slowing down. Breaking into the tablet space makes perfect business sense but so far Windows 8 hasn't done that.
No one predicted how fast consumers would take to the iPad when it was introduced. There was undeniably something about the iPad that resonated with buyers that turned it into one of the most successful products we've ever seen. I believe I know what attracts buyers to the iPad and now the iPad mini, and it's something Windows 8 can't give.
Firstly, Windows 8 tablets should do well in the enterprise, that market is already huge for Windows. Many vertical markets will be well served by a tablet running Windows.
The consumer space, which is the giant market that has turned the iPad into such a success, is a different matter. Consumers aren't looking for tablets running Windows. It is in fact the furthest thing from their minds when they shop for tablets.
What they are looking for is an extension of their phone with a screen more comfortable to see. I believe that's a big reason why the iPad was so successful from its first appearance. People saw a way to do what they loved doing on their iPhones on a device that was better to use due to the bigger screen.
Sure the iPad has grown beyond simple use cases but I think those simple activities -- email, web browsing, social networking, and the like, are still what drives buyers to grab iPads. That's why the iPad mini has been flying off the shelves, it has an even more comfortable form to do those phone-like activities than its bigger sibling.
Critics of the iPad have always contended that it is just a "big phone". I believe that is a correct assessment, and the very reason consumers love it. They aren't looking to get work done, something I admit I do all the time, they are looking to do the simple things they do on their phone, but with that slightly bigger screen.
The iPhone-based heritage is what makes the iPad so appealing to the masses, and this is something Windows 8 doesn't have. There's a big difference in bringing the desktop to the tablet and bringing the phone to one. No matter how successful Microsoft will be at improving Windows 8 for the tablet, and version 8.1 looks to be a good step in that direction, it will still be a full desktop on the slate.
Consumers don't want that at any level. Yes, there will be some who like having a "full" system on the tablet, but the number of those buyers are nothing in the big scheme of things. Tablet buyers want to do simple things on their device like they do on their phone. I firmly believe that is the draw of the iPad in particular and Android tablets in general.
This is the big hurdle that Microsoft faces in trying to sell Windows tablets to the masses. Yes, it's more capable than the iPad with iOS, and yes it runs Office. But that's not even close to what the typical consumer wants in a tablet. They just want a big phone screen with apps.
Windows 8 is designed from the ground up to handle both desktop and tablets, but it's the latter category Microsoft most wants to crack. The tablet market has been growing like weeds while the PC/desktop market has been slowing down. Breaking into the tablet space makes perfect business sense but so far Windows 8 hasn't done that.
No one predicted how fast consumers would take to the iPad when it was introduced. There was undeniably something about the iPad that resonated with buyers that turned it into one of the most successful products we've ever seen. I believe I know what attracts buyers to the iPad and now the iPad mini, and it's something Windows 8 can't give.
Firstly, Windows 8 tablets should do well in the enterprise, that market is already huge for Windows. Many vertical markets will be well served by a tablet running Windows.
The consumer space, which is the giant market that has turned the iPad into such a success, is a different matter. Consumers aren't looking for tablets running Windows. It is in fact the furthest thing from their minds when they shop for tablets.
What they are looking for is an extension of their phone with a screen more comfortable to see. I believe that's a big reason why the iPad was so successful from its first appearance. People saw a way to do what they loved doing on their iPhones on a device that was better to use due to the bigger screen.
Sure the iPad has grown beyond simple use cases but I think those simple activities -- email, web browsing, social networking, and the like, are still what drives buyers to grab iPads. That's why the iPad mini has been flying off the shelves, it has an even more comfortable form to do those phone-like activities than its bigger sibling.
Critics of the iPad have always contended that it is just a "big phone". I believe that is a correct assessment, and the very reason consumers love it. They aren't looking to get work done, something I admit I do all the time, they are looking to do the simple things they do on their phone, but with that slightly bigger screen.
The iPhone-based heritage is what makes the iPad so appealing to the masses, and this is something Windows 8 doesn't have. There's a big difference in bringing the desktop to the tablet and bringing the phone to one. No matter how successful Microsoft will be at improving Windows 8 for the tablet, and version 8.1 looks to be a good step in that direction, it will still be a full desktop on the slate.
Consumers don't want that at any level. Yes, there will be some who like having a "full" system on the tablet, but the number of those buyers are nothing in the big scheme of things. Tablet buyers want to do simple things on their device like they do on their phone. I firmly believe that is the draw of the iPad in particular and Android tablets in general.
This is the big hurdle that Microsoft faces in trying to sell Windows tablets to the masses. Yes, it's more capable than the iPad with iOS, and yes it runs Office. But that's not even close to what the typical consumer wants in a tablet. They just want a big phone screen with apps.
2013年5月30日星期四
Manage the tile-based slide show in Windows 8's Photo app
I've discussed this app briefly before, in How to better control Windows 8 slide shows. But this time around, I want to touch on two issues I didn't cover back then: How to turn on and off the little, tile-based slideshow on the Start screen, and how to control what pictures turn up on that slideshow, and in the Photo app in general.
First, you don’t have to run the Start page slideshow. To turn it on or off, right-click the tile (or press and hold if you're using a touchscreen). Some options will appear at the bottom of the screen. Click or tap Turn live tile off. If you change your mind, you can always click Turn live tile on.
The app shows all of the photos in your Pictures library. You can therefore control the selection by moving pictures in and out of the folders in that library. You need to do this in File Explorer, in the old-fashioned Desktop section.
You can also control what folders are recognized as part of that library. In File Explorer, right-click the Pictures library in the left pane and select Properties.The Add and Remove buttons should be self-explanatory.
You can also include photos from your accounts in various cloud-based services. Click or tap the app and wait a bit, and you'll find options to display your photos from SkyDrive (of course), Facebook, and Flickr. You'll have to give the program your logon name and password for the service.
First, you don’t have to run the Start page slideshow. To turn it on or off, right-click the tile (or press and hold if you're using a touchscreen). Some options will appear at the bottom of the screen. Click or tap Turn live tile off. If you change your mind, you can always click Turn live tile on.
The app shows all of the photos in your Pictures library. You can therefore control the selection by moving pictures in and out of the folders in that library. You need to do this in File Explorer, in the old-fashioned Desktop section.
You can also control what folders are recognized as part of that library. In File Explorer, right-click the Pictures library in the left pane and select Properties.The Add and Remove buttons should be self-explanatory.
You can also include photos from your accounts in various cloud-based services. Click or tap the app and wait a bit, and you'll find options to display your photos from SkyDrive (of course), Facebook, and Flickr. You'll have to give the program your logon name and password for the service.
2013年4月24日星期三
Ingram Goes Digital with Office, Windows 8
As software vendors move away from the distribution of boxed software and towards electronic download, what role is a distributor to play? Ingram Micro has introduced its own direction, debuting what the company calls a “Digital Locker” that holds details of customers’ software licenses on behalf of those customers’ solution providers.
The distributor’s first partner signed up for this electronic software delivery model is Microsoft, which is now offering Office 2013 and Windows 8 for download through the distributor.
Solution providers choose a SKU from the distributor on behalf of a customer, then post-transaction, the customer gets the license key and downloads the actual bytes of the software from Microsoft directly. The distributor keeps all the details of the transaction, including license key information, in its digital locker, ready to be retrieved by the solution provider should it ever be misplaced.
Jodi Honore, executive director of vendor management at Ingram Micro, said digital locker simplifies and streamlines the process of acquiring software through licensing, and as such, it believes it will allow SMB-focused solution providers to get business from very small customers (1-10 seat locations) that may have traditionally opted to buy packaged software at retail.
The service is live with Microsoft wares across North America, throughout EMEA, and in Australia and New Zealand, part of a global effort by the distributor to build on its software business.
Honore said that any partner that can access the offered products can opt to do electronic software delivery instead of the traditional software model, and that the terms and conditions of involvement with Microsoft’s wares are the same in the electronic world as they have been in the physical world.
As well as making a previously hard-to-reach part of the market more accessible, the distributor suggests that going with ESD will help solution providers accelerate their software business, as downloads are available immediately, and attract no freight costs for the distributor, reseller or customer. Honore said ESD can also open up the business to a variety of solution providers that have not traditionally have software licensing practices – again, particularly local VARs and MSPs that deal with small-business customers.
Honore said the idea for the Digital Locker had been in development at Ingram for some time, and that Microsoft was the right vendor to launch with. But the goal is to broaden the company’s electronic software distribution horizons in the very near future with other software companies.
“I’ve already had a few [other vendors] reach out to me looking for a bit more information about it, and that’s all good for Ingram and our partners,” she said. “I’d like to add other vendors as soon as they’re ready to go.”
The distributor’s first partner signed up for this electronic software delivery model is Microsoft, which is now offering Office 2013 and Windows 8 for download through the distributor.
Solution providers choose a SKU from the distributor on behalf of a customer, then post-transaction, the customer gets the license key and downloads the actual bytes of the software from Microsoft directly. The distributor keeps all the details of the transaction, including license key information, in its digital locker, ready to be retrieved by the solution provider should it ever be misplaced.
Jodi Honore, executive director of vendor management at Ingram Micro, said digital locker simplifies and streamlines the process of acquiring software through licensing, and as such, it believes it will allow SMB-focused solution providers to get business from very small customers (1-10 seat locations) that may have traditionally opted to buy packaged software at retail.
The service is live with Microsoft wares across North America, throughout EMEA, and in Australia and New Zealand, part of a global effort by the distributor to build on its software business.
Honore said that any partner that can access the offered products can opt to do electronic software delivery instead of the traditional software model, and that the terms and conditions of involvement with Microsoft’s wares are the same in the electronic world as they have been in the physical world.
As well as making a previously hard-to-reach part of the market more accessible, the distributor suggests that going with ESD will help solution providers accelerate their software business, as downloads are available immediately, and attract no freight costs for the distributor, reseller or customer. Honore said ESD can also open up the business to a variety of solution providers that have not traditionally have software licensing practices – again, particularly local VARs and MSPs that deal with small-business customers.
Honore said the idea for the Digital Locker had been in development at Ingram for some time, and that Microsoft was the right vendor to launch with. But the goal is to broaden the company’s electronic software distribution horizons in the very near future with other software companies.
“I’ve already had a few [other vendors] reach out to me looking for a bit more information about it, and that’s all good for Ingram and our partners,” she said. “I’d like to add other vendors as soon as they’re ready to go.”
2013年4月11日星期四
Will Blue meld Windows 8, Windows Phone OS into one?
Chalk this up in the unconfirmed column, but a new report adds an interesting shade to the Windows Blue story.
According to some prognosticating over at DigiTimes, Microsoft is developing Blue to help merge Windows 8 and Windows Phone into one product. The team working on Blue is reportedly working independently of crews in either of those departments.
The idea, DigiTimes said, is to create an operating system to compete with Google's Android and Chrome platforms.
The Softies are reportedly skittish about Google partnering with PC brand vendors to create Chromebooks and Android-based notebooks. A report from last week (also from DigiTimes) hinted at "Androidbooks" coming down the line from Google.
Not an easy thing to do
It's unclear if Blue - which will be called something different publicly - will merely serve as a stepping stone in the path towards integration or have immediate mash-up capabilities at launch.
DigiTimes also mentioned an October release for another, next-gen operating system Microsoft is developing, though again it's hard to tell if the pub is pointing to Blue or something else, such as Windows 9.
We've heard Blue updates will extend to other Microsoft platforms besides the PC, even catching wind of a Windows Phone Blue revamp, so this new rumor could tie into Blue's supposed cross-platform applications.
While intriguing, DigiTimes was quick to point out that fusing PC and mobile OSes together "will pose great difficulties" for both Microsoft and Google. It's a bit of a no-brainer observation, but also serves as a reminder that it could take yet more time before we ever see a mobile-to-PC crossover from either firm.
DigiTimes didn't give much in the way of verification for its info, so this could all turn out to be little more than conjecture. Lucky for us, Blue's mysteries should get solved in a few short months.
According to some prognosticating over at DigiTimes, Microsoft is developing Blue to help merge Windows 8 and Windows Phone into one product. The team working on Blue is reportedly working independently of crews in either of those departments.
The idea, DigiTimes said, is to create an operating system to compete with Google's Android and Chrome platforms.
The Softies are reportedly skittish about Google partnering with PC brand vendors to create Chromebooks and Android-based notebooks. A report from last week (also from DigiTimes) hinted at "Androidbooks" coming down the line from Google.
Not an easy thing to do
It's unclear if Blue - which will be called something different publicly - will merely serve as a stepping stone in the path towards integration or have immediate mash-up capabilities at launch.
DigiTimes also mentioned an October release for another, next-gen operating system Microsoft is developing, though again it's hard to tell if the pub is pointing to Blue or something else, such as Windows 9.
We've heard Blue updates will extend to other Microsoft platforms besides the PC, even catching wind of a Windows Phone Blue revamp, so this new rumor could tie into Blue's supposed cross-platform applications.
While intriguing, DigiTimes was quick to point out that fusing PC and mobile OSes together "will pose great difficulties" for both Microsoft and Google. It's a bit of a no-brainer observation, but also serves as a reminder that it could take yet more time before we ever see a mobile-to-PC crossover from either firm.
DigiTimes didn't give much in the way of verification for its info, so this could all turn out to be little more than conjecture. Lucky for us, Blue's mysteries should get solved in a few short months.
Windows 8 Is Worth Trying for the Security Features Alone
If it’s not already there, Windows 8 is probably coming to your network in the near future.
Although some companies are delaying the official adoption of Microsoft’s new operating system, manufacturers are shipping devices with the operating system preinstalled. And if your company allows any form of bring-your-own-device (BYOD) program, it has even less say in the matter. In fact, it’s quite difficult for a consumer to walk into a store and purchase a system running the now “outdated” Windows 7 OS.
When it comes to new operating systems, IT workers are usually interested in hearing about security improvements first. Fortunately, Windows 8 is strong on that front.
Windows 8 Secures the Boot Process
Rootkits are some of the most insidious forms of malware circulating today. These packages gain privileged access and reach into the lowest levels of an operating system and undermine traditional antimalware controls that run at the application level.
The rootkits often function by replacing critical components of the operating system that facilitate the boot process, allowing them to gain a foothold in the system when it boots, before antimalware software is able to load.
Windows 8 adds two features to the boot process that greatly enhance security by protecting against rootkit infections: Secured Boot, with Early Launch Antimalware (ELAM); and Measured Boot. Together, these technologies combat rootkits by minimizing the likelihood of their successful launch and by using remote trusted systems to identify the presence of untrusted software that bypassed antimalware controls.
Secured Boot’s ELAM capability loads during the very early stages of the boot process, before the kernel is given the opportunity to load other hardware drivers. ELAM then monitors the other drivers that the kernel attempts to load and verifies their digital signatures, classifying each driver as “good,” “bad” or “unknown.”
The kernel then uses this information to implement an administrator-defined policy. In most cases, especially until ELAM technology is widely adopted by hardware vendors, administrators should follow the default policy: allow the loading of both “good” and “unknown” drivers while preventing the loading of known malicious drivers.
It is important to understand that ELAM is not a replacement for antivirus software. It merely complements existing packages by adding security to a phase of the boot process that is inaccessible to traditional antimalware packages.
Once Windows 8 finishes loading boot drivers, ELAM terminates and the system’s other antimalware software assumes control. ELAM can, however, perform a seamless transfer of status information to the system’s runtime antimalware software.
While Secured Boot takes an active approach to securing the boot process, Measured Boot combines passive monitoring with remote attestation to provide administrators with assurance about the integrity of the boot process.
Measured Boot monitors the launch of all system components that load prior to the launch of antimalware software. It records this information in a tamper-proof fashion using the Trusted Platform Module (TPM), a secured piece of hardware attached to the motherboard. When antimalware software loads, it may access (but not modify) the information stored in the TPM to verify the steps that occurred on the system before the activation of antimalware software.
The remote-attestation feature of Measured Boot is also a promising development that administrators should keep an eye on. It facilitates the use of a remote server to verify that systems on the network are booting into a known trusted state.
With remote attestation, Measured Boot sends a securely encrypted copy of the TPM data to the remote-attestation server. The server then verifies that the values recorded in the TPM match previously known secure states for that specific system. If the values do not match, the remote attestation server may alert the administrator or trigger corrective action. Full implementation of remote-attestation will require the cooperation of third-party software vendors, so stay tuned.
Security on the Run: Windows To Go
The new Windows To Go feature provided with Windows 8 Enterprise edition offers administrators a solution to a problem that has plagued them for years: how to provide remote users with access to enterprise data in a secured environment. While VPNs and other remote-access technologies have long offered a means to protect sensitive information transferred over the Internet, administrators were still left to worry about the security of the systems used to access that data from home, hotel business centers and similar environments outside the protection of enterprise security controls.
Windows To Go allows administrators to provide users with a complete Windows 8 image on a supported USB drive. Users simply insert the drive into any hardware that supports Windows 7 or Windows 8, boot the system and find themselves up and running in the familiar corporate computing environment.
When they are finished, they just remove the drive and reboot the computer; the system will return to its normal use, with no trace of the user’s computing activity left behind.
Windows To Go also protects against a user accidentally leaving a session open after stepping away from the computer. If the USB drive is removed, Windows To Go pauses for one minute to allow reinsertion of the drive. If the drive is not reinserted, the machine shuts down. To protect against the risk of loss, Windows To Go is also compatible with BitLocker drive encryption.
The downside? Currently, there are only a small number of USB drives certified by Microsoft as compatible with Windows To Go. These include:
IronKey Workspace W300
Kingston DataTraveler Workspace for Windows To Go
Spyrus Portable Workplace
Spyrus Secure Portable Workplace
Western Digital My Passport Enterprise
Watch for additional products to support this technology as its adoption grows.
Regardless of when Windows 8 makes its way to your enterprise, the additional security provided by ELAM, Measured Boot and Windows To Go makes it an attractive OS for IT workers.
A recent Spiceworks survey found that 69 percent of small and medium-size businesses were currently testing Windows 8, so if you don’t want to roll the new OS out to the whole company, it’s worth conducting pilot evaluations to assess potential future uses.
Although some companies are delaying the official adoption of Microsoft’s new operating system, manufacturers are shipping devices with the operating system preinstalled. And if your company allows any form of bring-your-own-device (BYOD) program, it has even less say in the matter. In fact, it’s quite difficult for a consumer to walk into a store and purchase a system running the now “outdated” Windows 7 OS.
When it comes to new operating systems, IT workers are usually interested in hearing about security improvements first. Fortunately, Windows 8 is strong on that front.
Windows 8 Secures the Boot Process
Rootkits are some of the most insidious forms of malware circulating today. These packages gain privileged access and reach into the lowest levels of an operating system and undermine traditional antimalware controls that run at the application level.
The rootkits often function by replacing critical components of the operating system that facilitate the boot process, allowing them to gain a foothold in the system when it boots, before antimalware software is able to load.
Windows 8 adds two features to the boot process that greatly enhance security by protecting against rootkit infections: Secured Boot, with Early Launch Antimalware (ELAM); and Measured Boot. Together, these technologies combat rootkits by minimizing the likelihood of their successful launch and by using remote trusted systems to identify the presence of untrusted software that bypassed antimalware controls.
Secured Boot’s ELAM capability loads during the very early stages of the boot process, before the kernel is given the opportunity to load other hardware drivers. ELAM then monitors the other drivers that the kernel attempts to load and verifies their digital signatures, classifying each driver as “good,” “bad” or “unknown.”
The kernel then uses this information to implement an administrator-defined policy. In most cases, especially until ELAM technology is widely adopted by hardware vendors, administrators should follow the default policy: allow the loading of both “good” and “unknown” drivers while preventing the loading of known malicious drivers.
It is important to understand that ELAM is not a replacement for antivirus software. It merely complements existing packages by adding security to a phase of the boot process that is inaccessible to traditional antimalware packages.
Once Windows 8 finishes loading boot drivers, ELAM terminates and the system’s other antimalware software assumes control. ELAM can, however, perform a seamless transfer of status information to the system’s runtime antimalware software.
While Secured Boot takes an active approach to securing the boot process, Measured Boot combines passive monitoring with remote attestation to provide administrators with assurance about the integrity of the boot process.
Measured Boot monitors the launch of all system components that load prior to the launch of antimalware software. It records this information in a tamper-proof fashion using the Trusted Platform Module (TPM), a secured piece of hardware attached to the motherboard. When antimalware software loads, it may access (but not modify) the information stored in the TPM to verify the steps that occurred on the system before the activation of antimalware software.
The remote-attestation feature of Measured Boot is also a promising development that administrators should keep an eye on. It facilitates the use of a remote server to verify that systems on the network are booting into a known trusted state.
With remote attestation, Measured Boot sends a securely encrypted copy of the TPM data to the remote-attestation server. The server then verifies that the values recorded in the TPM match previously known secure states for that specific system. If the values do not match, the remote attestation server may alert the administrator or trigger corrective action. Full implementation of remote-attestation will require the cooperation of third-party software vendors, so stay tuned.
Security on the Run: Windows To Go
The new Windows To Go feature provided with Windows 8 Enterprise edition offers administrators a solution to a problem that has plagued them for years: how to provide remote users with access to enterprise data in a secured environment. While VPNs and other remote-access technologies have long offered a means to protect sensitive information transferred over the Internet, administrators were still left to worry about the security of the systems used to access that data from home, hotel business centers and similar environments outside the protection of enterprise security controls.
Windows To Go allows administrators to provide users with a complete Windows 8 image on a supported USB drive. Users simply insert the drive into any hardware that supports Windows 7 or Windows 8, boot the system and find themselves up and running in the familiar corporate computing environment.
When they are finished, they just remove the drive and reboot the computer; the system will return to its normal use, with no trace of the user’s computing activity left behind.
Windows To Go also protects against a user accidentally leaving a session open after stepping away from the computer. If the USB drive is removed, Windows To Go pauses for one minute to allow reinsertion of the drive. If the drive is not reinserted, the machine shuts down. To protect against the risk of loss, Windows To Go is also compatible with BitLocker drive encryption.
The downside? Currently, there are only a small number of USB drives certified by Microsoft as compatible with Windows To Go. These include:
IronKey Workspace W300
Kingston DataTraveler Workspace for Windows To Go
Spyrus Portable Workplace
Spyrus Secure Portable Workplace
Western Digital My Passport Enterprise
Watch for additional products to support this technology as its adoption grows.
Regardless of when Windows 8 makes its way to your enterprise, the additional security provided by ELAM, Measured Boot and Windows To Go makes it an attractive OS for IT workers.
A recent Spiceworks survey found that 69 percent of small and medium-size businesses were currently testing Windows 8, so if you don’t want to roll the new OS out to the whole company, it’s worth conducting pilot evaluations to assess potential future uses.
Using Windows 8 AppLocker and application sideloading in Windows 8
Organizations planning a Windows 8 upgrade have to choose between Windows 8 Professional and Windows 8 Enterprise. The latter edition offers remote desktop functionality not available in Windows 8 Pro, including Windows To Go and BranchCache. Here are some more features found only in Windows 8 Enterprise.
Administrators can centrally manage AppLocker through group policies that include rules for blacklisting or whitelisting scripts, dynamic link libraries and executable files. AppLocker also includes policies for Windows Installer files and Windows Store app packages and their installer files (.appx). Support for Windows Store files is new in Windows 8 Enterprise, as is the ability to manage .mst files, a type of Windows Installer file.
To deploy AppLocker, administrators usually create the necessary policies and then apply them through Group Policy. However, an Active Directory environment is not mandatory. In a small network, administrators can install the policies directly on Windows 8 Enterprise desktops. And in either environment, admins can set up publication rules to permit software updates to specific applications without having to set up a rule for each update.
For organizations that want to maintain tighter controls over their desktops yet still retain flexibility, AppLocker could prove an invaluable addition to their arsenal of management tools.
Microsoft now requires that Metro-style applications be distributed through the Windows Store. For organizations with their own line-of-business applications, this approach might not acceptable. Windows 8 Enterprise offers a solution: application sideloading.
Sideloading lets organizations publish Metro-style apps directly to their own desktops, without going through the Windows Store. Users or administrators can install approved, in-house apps (via an app installation package). At the same time, admins can prevent unapproved and potentially malicious apps from being installed.
Sideloading is available in some form in all Windows 8 editions, but it's only in Enterprise that the feature is turned on by default. Other editions also require an activation key to be created for each app, which needs to be added to the system through a special sideloading script.
Windows 8 Enterprise, on the other hand, lets organizations distribute apps with far less fuss. In fact, IT can build what is essentially an internal app store for distributing their in-house applications. When used with AppLocker, sideloading provides a controlled, secure way to distribute internal Metro-style apps to Windows 8 Enterprise desktops.
Features such as Windows To Go, DirectAccess, RemoteFX enhancements, BranchCache, AppLocker and application sideloading add important functionality to the Windows 8 Enterprise edition. Depending on the needs of your organization, one or more of them could prove valuable enough to warrant Windows 8 Enterprise over Windows 8 Pro. So the better you understand how these features work, the easier it will be to decide whether to go with Windows 8 Professional or Windows 8 Enterprise.
Administrators can centrally manage AppLocker through group policies that include rules for blacklisting or whitelisting scripts, dynamic link libraries and executable files. AppLocker also includes policies for Windows Installer files and Windows Store app packages and their installer files (.appx). Support for Windows Store files is new in Windows 8 Enterprise, as is the ability to manage .mst files, a type of Windows Installer file.
To deploy AppLocker, administrators usually create the necessary policies and then apply them through Group Policy. However, an Active Directory environment is not mandatory. In a small network, administrators can install the policies directly on Windows 8 Enterprise desktops. And in either environment, admins can set up publication rules to permit software updates to specific applications without having to set up a rule for each update.
For organizations that want to maintain tighter controls over their desktops yet still retain flexibility, AppLocker could prove an invaluable addition to their arsenal of management tools.
Microsoft now requires that Metro-style applications be distributed through the Windows Store. For organizations with their own line-of-business applications, this approach might not acceptable. Windows 8 Enterprise offers a solution: application sideloading.
Sideloading lets organizations publish Metro-style apps directly to their own desktops, without going through the Windows Store. Users or administrators can install approved, in-house apps (via an app installation package). At the same time, admins can prevent unapproved and potentially malicious apps from being installed.
Sideloading is available in some form in all Windows 8 editions, but it's only in Enterprise that the feature is turned on by default. Other editions also require an activation key to be created for each app, which needs to be added to the system through a special sideloading script.
Windows 8 Enterprise, on the other hand, lets organizations distribute apps with far less fuss. In fact, IT can build what is essentially an internal app store for distributing their in-house applications. When used with AppLocker, sideloading provides a controlled, secure way to distribute internal Metro-style apps to Windows 8 Enterprise desktops.
Features such as Windows To Go, DirectAccess, RemoteFX enhancements, BranchCache, AppLocker and application sideloading add important functionality to the Windows 8 Enterprise edition. Depending on the needs of your organization, one or more of them could prove valuable enough to warrant Windows 8 Enterprise over Windows 8 Pro. So the better you understand how these features work, the easier it will be to decide whether to go with Windows 8 Professional or Windows 8 Enterprise.
订阅：
博文 (Atom)