Virtualization-Based Security (VBS)

A specific VBS feature that isolates the Local Security Authority (LSA) process within a VSM container. By moving credential storage and processing to VTL 1, Credential Guard prevents attackers from extracting NTLM password hashes, Kerberos TGTs, and service account tokens using tools like Mimikatz. Even if an attacker gains SYSTEM-level access to the normal OS, the isolated LSA process remains inaccessible. This directly mitigates Pass-the-Hash, Pass-the-Ticket, and Kerberoasting attacks.

A Windows security feature that leverages VBS to isolate the Local Security Authority (LSA) process, preventing credential theft. Instead of storing secrets in process memory accessible to the kernel, Credential Guard places them in a protected virtualized container that even a compromised OS cannot read.

• Mitigates Pass-the-Hash and Pass-the-Ticket attacks
• Uses Hyper-V hypervisor to enforce memory isolation
• Kerberos, NTLM, and Credential Manager secrets are protected

An international standard (ISO/IEC 11889) for a secure cryptoprocessor embedded on the motherboard. The TPM provides hardware-based root of trust by generating, storing, and limiting the use of cryptographic keys. It works in concert with VBS by providing secure attestation of the boot chain.

• Stores Platform Configuration Registers (PCRs) for measured boot
• Enables remote attestation to verify system integrity
• Required for Windows 11 and many VBS-dependent features

A dedicated physical computing device that safeguards and manages digital keys for strong authentication. Unlike a TPM which is embedded, an HSM is often a removable or network-attached appliance with FIPS 140-2 Level 3 certification, providing tamper-evident physical boundaries.

• Used for Certificate Authority (CA) key storage
• Performs all cryptographic operations on-device
• Private keys never leave the HSM boundary

A set of instruction codes that allows user-level applications to allocate private memory regions called enclaves. Unlike VBS which isolates the entire security kernel, SGX protects individual application secrets from the OS, hypervisor, and even firmware.

• Enables confidential computing at the application layer
• Enclave memory is encrypted at the hardware level
• Provides remote attestation that specific code is executing inside an enclave

A cryptographic mechanism by which a host proves its hardware and software configuration to a remote verifier before secrets are released. In VBS architectures, attestation ensures an agent is running inside a genuine, untampered virtual secure mode before granting access to sensitive workloads.

• Relies on TPM quotes or SGX reports
• Verifies measurement chain from firmware through hypervisor
• Critical for zero-trust agent deployment in untrusted environments

A hardware-based security paradigm that protects data in use by performing computation within a Trusted Execution Environment (TEE). While VBS protects security assets from the OS, confidential computing extends this protection to entire workloads, shielding them from the cloud provider and infrastructure admins.

• Implemented via AMD SEV, Intel TDX, or ARM CCA
• Memory remains encrypted even during processing
• Enables multi-party computation without mutual trust