Seven Windows security layers, and the gap each one closes

Endpoint security is not one product. It is a set of layers, each of which reduces a different part of an attack, and the reason there are so many is that attacks are not one step either.

A typical intrusion chains things together. Something arrives, something runs, something reaches out, something is stolen, something moves sideways. Layers exist to break that chain in more than one place, so that missing it once is not the same as losing.

Here is what each layer is actually for, and the gap it closes that nothing else does.

BitLocker protects data when the device is gone #

Volume encryption addresses a risk none of the other layers touch. A device that is lost, stolen or decommissioned badly, or a drive pulled out and read somewhere else.

Windows sign in controls do nothing here. They protect a running session, not the disk. Encryption is what makes the data unreadable when somebody has the hardware and no longer has to get past Windows at all.

It has no effect on malicious code while a user is signed in. That is not a shortcoming, it is a different job.

Antivirus decides what looks bad #

Real time protection against known and emerging malware, using signatures, machine learning, behavioural analysis and cloud intelligence.

Antivirus is a prediction. It asks whether this file is malicious, and it is right the overwhelming majority of the time. The residual risk is the case it has not seen yet, which is why the answer to a miss cannot be another predictor.

Attack Surface Reduction blocks risky behaviour #

ASR rules target the behaviours attackers keep reusing rather than the files they use. An Office application spawning a child process. An obfuscated script. A script or executable that downloads and runs something. Code injected into another process.

This matters because attackers abuse software that is entirely legitimate. Nothing needs to be identified as malware for ASR to refuse the behaviour, which is what makes it useful against techniques rather than samples.

App Control decides what is allowed to run #

This is the explicit trust layer. Code runs because policy permits it, not because nothing objected.

It is the inversion of the antivirus question. Instead of asking whether this file is known to be bad, it asks whether this file was approved, and the default answer is no. On endpoints that is powerful, because most intrusions depend on getting something new onto the device and running it.

App Control vs antivirus vs XDR goes through that distinction properly, including why it is not three products competing for the same budget line.

The firewall controls where traffic can go #

Host firewall policy filters what enters and leaves the device, and can limit which applications are allowed to communicate at all.

On a server it protects exposed services. On an endpoint it reduces what is reachable on whatever network somebody has joined, which on a laptop is a genuinely unknown quantity.

It makes no judgement about whether a local file should execute.

Patching removes the weaknesses worth exploiting #

Patch and vulnerability management reduce the number of known holes available, and give you a prioritised view of which ones actually matter on which assets.

The limit is in the word known. Patching does nothing about phishing, social engineering, stolen credentials or an attacker using tools that are already trusted. A perfectly patched fleet still runs what it is told to run, which is why this layer and the execution layer are not substitutes.

Staying current is also its own operational problem, and one worth solving deliberately rather than by accepting whatever a vendor ships. PoliEze Flow covers that side.

Detection and response cover what got through #

Endpoint detection and response, and XDR across endpoints, identities, email and applications, exist because prevention is never complete.

Their value is in connecting things. A single event is usually ambiguous, and the same event next to four others is an incident with a shape, a scope and an entry point. That is a question no preventive control is asking.

Where they overlap, and where they do not #

The overlaps are real and largely benign. Antivirus, ASR and App Control will all sometimes stop the same thing, and that redundancy is the point of a layered design.

The gaps are the part worth being precise about.

Nothing else does what encryption does. Lose the device and every other layer is irrelevant.

Nothing else does what the execution decision does. Antivirus predicts, ASR constrains behaviour, the firewall constrains communication, patching removes weaknesses, and detection reacts. Only one of them refuses to run code because nobody approved it.

Nothing else does what detection does. Every preventive control is silent about what happened after it was bypassed.

Why the execution layer is usually the one missing #

Most organisations already run antivirus, a firewall and a patching programme. Many run ASR and XDR. The layer that tends to be absent is the one that decides what may execute.

It is not absent because anyone doubts it works. It is absent because it is the hardest of these to operate. Every other layer can be turned on centrally and largely left to run. Application control requires knowing what your software estate actually is, deciding who approves additions, handling exceptions, and keeping the whole thing accurate as software changes underneath you.

That is an operating problem rather than a security one, and it is the problem PoliEze was built to solve. The platform covers how.

Sources #

• BitLocker overview, Microsoft
• Attack surface reduction rules overview, Microsoft
• Application Control for Windows, Microsoft
• Windows Firewall overview, Microsoft
• Microsoft Defender Vulnerability Management, Microsoft
• Microsoft Defender XDR, Microsoft