How does SMB over QUIC enhance security in Windows Server 2025?

SMB over QUIC enhances security in Windows Server 2025 by providing a secure alternative to traditional SMB over TCP. Here are some key security benefits:

• TLS 1.3 Encryption: SMB over QUIC uses TLS 1.3 to encrypt data, ensuring that all SMB traffic, including authentication, is protected from eavesdropping and tampering.
• Certificate-Based Authentication: QUIC requires certificate-based authentication, which enhances security by ensuring that only authorized clients can access the SMB server. This helps protect against unauthorized access and credential theft.
• Firewall-Friendly: SMB over QUIC operates over UDP port 443, which is typically open on most firewalls. This reduces the need for complex firewall configurations and enhances security by minimizing the attack surface.
• Protection Against NTLM Credential Leakage: By using TLS 1.3 encryption, SMB over QUIC protects NTLM credentials from being exposed to the underlying network, reducing the risk of credential theft.
• Client Access Control: Windows Server 2025 introduces QUIC Client Access Control, allowing administrators to restrict access to file servers via QUIC to specific clients based on their certificates. This adds an additional layer of security by ensuring that only trusted devices can connect.