Microsoft has expanded its Secured-core PC initiative to its server products in a bid to combat ransomware attacks on infrastructure.
Secured-core will now be expanded to reach Windows Server, Microsoft Azure Stack HCI, and Azure-certified IoT devices.
Businesses can search for Secured-core servers in the Azure Stack HCI and Windows Server online catalogues. There are currently four all-HPE products that run Azure Stack HCI and 42 options from a variety of vendors that meet the Windows Server spec.
All servers come “fully equipped with industry-leading security mitigations built into the hardware, firmware, and the operating system to help thwart some of the most advanced attack vectors,” Microsoft said.
Secured-core servers are built around three distinct security pillars:
- To protect the server infrastructure with a hardware-based root of trust
- To defend sensitive workloads against firmware-level attacks
- To prevent access and the execution of unverified code on the systems
“Partnering with leading original equipment manufacturers (OEMs) and silicon vendors, Secured-core servers use industry-standard hardware-based root of trust coupled with security capabilities built into today’s modern central processing units (CPUs),” said Microsoft in a blog post.
“Secured-core servers use the Trusted Platform Module 2.0 and Secure boot to ensure that only trusted components load in the boot path.”
It’s thought the new hardware will help tackle specific parts of ransomware attacks and help detect intrusions earlier, with the hope that attacks can be mitigated before any real damage is done.
Microsoft used a typical REvil ransomware kill chain as an example. REvil was one of the most prolific ransomware gangs of 2021 before it shuttered following a string of arrests of alleged REvil associates.
Using the kill chain used by REvil on Kaseya earlier this year, Microsoft explained that certain features in Secured-core servers like Hypervisor-protected Code Integrity (HVCI) can block drivers that tamper with the kernel, like with Mimikatz, via a code integrity security policy.
By preventing credential theft, an early stage of the ransomware kill chain, Microsoft said Secured-core server can make it very difficult for attackers to move laterally around a potential victim’s network.
RELATED RESOURCE
How to reduce the risk of phishing and ransomware
Top security concerns and tips for mitigation
“Continuing to raise the security bar for critical infrastructure against attackers makes it easier for organisations to meet that higher bar, which is an important priority for both customers and Microsoft,” said Microsoft.
“Successfully protecting systems requires a holistic approach that builds security from the chip to the cloud across hardware, firmware, and the operating system.”
Microsoft debuted the Secured-core initiative in 2019 on Windows PCs which saw computers ship with enhanced security measures at the hardware level.
The machines were designed for business use, with the financial services and healthcare industries targeted specifically, as well as anyone working in a high-value-data role such as in government.
-
LaunchDarkly to "double down" on observability with Highlight acquisitionNews Highlight's observability tools will be integrated into LaunchDarkly's Guarded Releases software deployment service
-
Samsung Galaxy Tab S10 FE reviewReviews The Tab S10 FE retains the feel and core capabilities of Samsung's high-end S10 tablets, but compromises on the display and the performance
-
Ransomware attacks are rising — but quiet payouts could mean there's more than actually reportedNews Ransomware attacks continue to climb, but they may be even higher than official figures show as companies choose to quietly pay to make such incidents go away.
-
Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the lastNews Hertz has confirmed it suffered a data breach as a result of the Cleo zero-day vulnerability in late 2024, with the car rental giant warning that customer data was stolen.
-
‘Phishing kits are a force multiplier': Cheap cyber crime kits can be bought on the dark web for less than $25 – and experts warn it’s lowering the barrier of entry for amateur hackersNews Research from NordVPN shows phishing kits are now widely available on the dark web and via messaging apps like Telegram, and are often selling for less than $25.
-
Healthcare systems are rife with exploits — and ransomware gangs have noticedNews Nearly nine-in-ten healthcare organizations have medical devices that are vulnerable to exploits, and ransomware groups are taking notice.
-
Alleged LockBit developer extradited to the USNews A Russian-Israeli man has been extradited to the US amid accusations of being a key LockBit ransomware developer.
-
February was the worst month on record for ransomware attacks – and one threat group had a field day
News February 2025 was the worst month on record for the number of ransomware attacks, according to new research from Bitdefender.
-
CISA issues warning over Medusa ransomware after 300 victims from critical sectors impactedNews The Medusa ransomware as a Service operation compromised twice as many organizations at the start of 2025 compared to 2024
-
Warning issued over prolific 'Ghost' ransomware groupNews The Ghost ransomware group is known to act fast and exploit vulnerabilities in public-facing appliances
