Microsoft to roll out a 'consent first' model to protect Windows

"In response, the tech giant plans to roll out what it calls a "consent‑first" model. This new default baseline will grant access only to explicitly approved apps, although users will retain full control to permit, deny, or reverse permission decisions. They will also be given full visibility into app and agent behavior."

"With Windows Baseline Security Mode, runtime safeguards will be enabled by default and will only allow "properly signed" apps, services, and drivers to run. However, users and admins will be able to override these safeguards for specific apps when needed, and they will have visibility into what protections are active and whether any exceptions have been granted. The goal, Microsoft notes, is to help protect the system from "tampering or unauthorized changes.""

Windows will adopt a consent-first default that limits runtime access to explicitly approved applications and agents. Windows Baseline Security Mode will enable runtime safeguards by default and permit only properly signed apps, services, and drivers to run. Users and administrators can override protections on a per-app basis and can view active protections and any exceptions. New transparency and consent prompts will notify when apps request sensitive data or attempt to install additional software, allowing users to grant, deny, or revoke permissions. The change targets abuses like misconfigured endpoints, credential theft, and living-off-the-land techniques to prevent tampering and unauthorized changes.

Read at Computerworld