With Windows 10 support ending in <5 months, I thought I’d talk a little about what Trusted Platform Module (TPM) is, its role in Windows 11, and how it fits into Microsoft’s Chip-to-Cloud security strategy, along with an explanation of Microsoft’s own Pluton processors.
Why. Well, before Microsoft released TPM and made it a mandatory system requirement, few people paid attention to it but now I get asked more and more “what is TPM”. So here we go….
Introduction
Security in computing has never been more critical. As cyber threats evolve, Microsoft continues to adapt it’s proactive approach to securing Windows devices from the ground up. This is where Trusted Platform Module (TPM) and Pluton processors come into play, forming key components of Microsoft’s Chip-to-Cloud security strategy.
TPM 2.0 is the latest version of TPM, the previous version being TPM 1.2
What is TPM?
TPM is a hardware-based security module designed to protect sensitive data, such as encryption keys, credentials, and system integrity measurements.
Trusted Platform Module (TPM, also known as ISO/IEC 11889) is an international standard for a secure cryptoprocessor, a dedicated microcontroller designed to secure hardware through integrated cryptographic keys. The term can also refer to a chip conforming to the standard.
It acts as a root of trust, ensuring that a device boots securely and remains protected against unauthorised access.
Why is TPM Required for Windows 11
Microsoft made TPM 2.0 a requirement for Windows 11 to enhance security across all devices.
Today, we are announcing Windows 11 to raise security baselines with new hardware security requirements built-in that will give our customers the confidence that they are even more protected from the chip to the cloud on certified devices.
David Weston, Director of Enterprise and OS Security @ Microsoft
Here’s why it’s needed.
BitLocker encryption in Windows 11 (and earlier versions) enhances security by storing encryption keys in the Trusted Platform Module (TPM). When a user accesses their computer, these keys unlock the drive, ensuring seamless protection. Without the keys stored in TPM, attackers cannot decrypt the drive—such as the system drive—nor can they access the files on it.
TPM is needed because it provides and enforces:
- Hardware-Based Protection: Unlike software-only security solutions, TPM is embedded in the hardware, making it resistant to malware and physical attacks.
- Secure Boot & System Integrity: TPM ensures that the operating system loads securely, preventing unauthorized modifications.
- Encryption & Authentication: Features like BitLocker and Windows Hello rely on TPM to securely store encryption keys and biometric data.
- Defending Against Emerging Threats: With attackers increasingly targeting firmware and hardware vulnerabilities, TPM provides a trusted execution environmentthat mitigates these risks.
Microsoft’s Chip-to-Cloud Security Strategy
Microsoft’s Chip-to-Cloud approach is designed to integrate security at every level, from the silicon inside a device to cloud-based protections. TPM plays a crucial role in this strategy by ensuring that security starts at the hardware level.
Where does Pluton Fit in?
Pluton is Microsoft’s next-generation security processor, built directly into the CPU (known as System on Chip). Unlike traditional TPMs, which are separate chips, Pluton is integrated within the processor, making it even more resistant to attacks.
How Pluton Enhances Security
- Eliminates Physical Attacks: Since Pluton is embedded within the CPU, attackers cannot extract sensitive data by physically removing or tampering with a separate TPM chip.
- Continuous Security Updates**: Pluton receives firmware updates directly from Microsoft via Windows Update, ensuring devices remain protected against evolving threats.
- Improved Cryptographic Security: Pluton enhances encryption capabilities, making it harder for attackers to compromise sensitive data.
Is Pluton part of TPM then?
Yes, Pluton can function as a TPM. It supports TPM 2.0 standards, meaning Windows features like BitLocker, Windows Hello, and System Guard can leverage Pluton for security.
Pluton also goes beyond TPM, offering additional security features that traditional TPMs cannot.
Pluton acts as the TPM in the new Surface Laptop and Pro released this month.
Conclusion
Microsoft’s Chip-to-Cloud security strategy ensures that Windows devices are protected at every level. TPM 2.0 provides a trusted foundation while Pluton takes security to the next level by integrating protection directly into the CPU. As cyber threats continue to evolve, these technologies will play a crucial role in safeguarding Windows devices.
Further Reading
Microsoft Pluton security processor https://learn.microsoft.com/en-us/windows/security/hardware-security/pluton/microsoft-pluton-security-processor
Microsoft Pluton as Trusted Platform Module https://learn.microsoft.com/en-us/windows/security/hardware-security/pluton/pluton-as-tpm
