From Toms Hardware site which is one of the most respicted Technical site.
Please note the second to last paragraph
.
.
Microsoft Defines Standards For 'Highly Secure Windows 10 Devices'
by
Lucian Armasu November 7, 2017 at 2:18 PM - Source:
Microsoft Docs
In an effort to encourage PC manufacturers to ship more secure Windows 10 computers, as well as to increase demand for such devices from consumers, Microsoft released a set of hardware and firmware standards for secure Windows 10 devices. These security recommendations apply to Windows 10 version 1709,
Fall Creators Update.
Hardware Standards
There are six hardware standards that manufacturers should consider when building their new Windows 10 devices.
Processor Generation
Microsoft said that only Intel and AMD processors from generation seven and up comply with its standards, mainly because these chips support the Mode Based Execution Control (MBEC) feature, which is supposed to stop malicious changes to a guest kernel.
This feature may primarily be necessary to strengthen the
Windows Defender App Guard security solution, which essentially puts the Edge browser inside a minimal guest Windows 10 operating system to isolate it from the main system.
App Guard is not available to consumers, only to Windows 10 Enterprise users, but it may eventually trickle down regular Windows users, too, as it could significantly beef-up the somewhat lacking
Edge browser security.
The list of 7th generation processors includes Intel chips such as: Core i3/i5/i7/i9-7x, Core M3-7xxx, Xeon E3-xxxx, and current Intel Atom, Celeron and Pentium Processors, as well as processors such as the A Series Ax-9xxx, E-Series Ex-9xxx, FX-9xxx.
Process Architecture
Microsoft said that 64-bit support is necessary for secure devices, which includes modern AMD64 (or x64 as they’re sometimes called) processors, as well as ARMv8.2 CPUs.
As we’ve seen in the past, 32-bit architectures offer poor address space layout randomization (ASLR) security, a feature that shouldn’t be lacking from any modern operating system at this point. ASLR is a big hurdle for many attackers because they can’t pinpoint which memory locations to exploit. Microsoft also noted that the 64-bit process architecture is necessary for other virtualization-based security features, too.
Virtualization
The company included a list of features that are required for new Windows 10 computers to support modern virtualization.
Processors must support Input-Output Memory Management Unit (IOMMU) device virtualization and all I/O devices need to be protected by IOMMU/SMMU. The systems must support Intel VT-d, AMD-Vi, or ARM64 SMMUs.
Systems must also support virtual machine extensions with second level address translation (SLAT). That means the systems must have VT-x with Extended Page Tables (EPT), or AMD-V with Rapid Virtualization Indexing (RVI).
All the virtualization features must be supported in firmware and the OS should be able to use them.
TPM
Systems must have a TPM 2.0 module that is in compliance with the
Trustworthy Computing Group (TCG) specifications. Microsoft recommended TPM modules either from Intel or AMD, or from third-party vendors such as STMicroelectronics, Nuvoton, or Infineon (whose TPM was recently found to
generate weak cryptographic keys).
Platform Boot Verification
Secure systems must implement cryptographically verified boot solutions, such as Intel Boot Guard in Verified Boot mode, AMD Hardware Verified Boot, or equivalents.
RAM
Microsoft also said that secure systems should have 8GB or more of RAM. This is probably not a security feature per se, but a minimum 8GB of RAM is likely required if you intend to do any kind of virtualization on your system. The more memory there is, the more effective ASLR should be, too, as there are more places in which code can hide from attackers.
What seems to be missing in this category is a requirement for error-correcting code (ECC) RAM, or any other required protection against RowHammer, a dangerous attack vector that puts the vast majority of existing computers at risk. Microsoft should probably update its requirements to include such protection before long.
Damn I thought I could be ok like that. It's hard to get something better for under 1000 $