Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

Experts Live Europe 2017 - Best Practices to secure Windows 10 with already included features


Published on

AppLocker, Windows Information Protection, Device Guard, Windows Defender Application Guard- there are many ways to secure Windows 10. Not all ways are compatible with Enterprise requirements. In the session, we will have a look at what we are able to do and I will add some experiences from the field about what works well and what doesn’t. In addition, we will check how ConfigMgr can support us.

Published in: Technology
  • Be the first to comment

Experts Live Europe 2017 - Best Practices to secure Windows 10 with already included features

  1. 1. Best Practices to secure Windows 10 with already included features Alexander Benoit Head of Competence Center Microsoft @sepago @ITPirate
  2. 2. Alexander Benoit Senior Consultant / Head of Competence Center Microsoft „Future Workplace“, Security SCCM, Intune, Windows 10, Defender Framework,… @ITPirate
  3. 3. We have a firewall We can‘t get hacked!
  4. 4. Agenda: The threat landscape No-brainers to secure Windows 10 Latest & greatest mitigation features in Windows 10
  5. 5. The discussion is always about tools!
  6. 6. Threat Landscape Phishing Keylogger Ransomware Spyware Worm Compromised accounts
  7. 7. Analysis: High-level vulnerability & exploit trends Vulnerabilities are increasing while evidence of actual exploits is decreasing due to mitigation investments
  8. 8. How to Secure Windows 10 ?
  9. 9. Windows 10 Security on Modern Devices Breach detection investigation & response Device protection Identity protection Information protection Threat resistance
  10. 10. No-Brainer: Microsoft BitLocker • Full drive encryption solution provided natively with Windows 10 Professional and Enterprise • Used to protect the operating system drive, secondary data drives and removable devices • System Center Configuration Manager, MDT and Intune can be used to deploy BitLocker Overview
  11. 11. No-Brainer: Microsoft BitLocker Hack not encrypted client
  12. 12. Windows Defender Credential Guard • Uses virtualization-based security to isolate secrets in the Local Security Authority (LSA) . • Only privileged system software can access secrets when stored locally. • Mitigates credential theft attacks, such as Pass-the-Hash (PtH) or Pass-The-Ticket (PtT). Overview
  13. 13. Windows Defender Credential Guard Overview • Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. • The LSA process in the operating system talks to the isolated LSA by using remote procedure calls. • Data stored by using VBS is not accessible to the rest of the operating system.
  14. 14. Get deeper into attack scenarios Good to know Exploit: Computercode that takes advantage of a vulnerability in a software system. Payload: Payloads carry the functionality for the greater access into the target.
  15. 15. Scenario Attack PayloadExploit Common way‘s to share payloads: • Fake Hyperlink • PowerPoint Macro • as „JPG“ File
  16. 16. Create a payload with Metasploit Create Metasploit payload and configure listener port and host IP.
  17. 17. Share Payload Hide payload behind fake Link
  18. 18. Windows Defender Smart Screen Block at first sight support in Microsoft Edge
  19. 19. Windows Defender SmartScreen • The Windows Defender SmartScreen provides an early warning system to notify users of suspicious websites that could be engaging in phishing attacks or distributing malware through a socially engineered attack. • Windows Defender SmartScreen is one of the multiple layers of defense in the anti-phishing and malware protection strategies Check downloaded files Windows Defender Cloud Protection Click! Attacker Generate new malware file Send file metadata Evaluate metadata Verdict: Malware – Block! Malware Block! Including Machine Learning, proximity, lookup heuristics Command & Control User
  20. 20. Windows Defender Application Guard Call managed and unmanaged hompages
  21. 21. Windows Defender Application Guard • Windows Defender Application Guard protects the device from advanced attacks launched against Microsoft Edge. • Malware and vulnerability exploits targeting the browser, including zero days, are unable to impact the operating system, apps, data and network. • Application Guard uses virtualization based security to hardware to isolate Microsoft Edge and any browsing activity away from the rest of the system. • Closing Microsoft Edge wipes all traces of attacks that may been encountered while online. Call managed and unmanaged hompages
  22. 22. Windows Defender Application Guard Call managed and unmanaged hompages
  23. 23. Windows Defender Application Guard Call managed and unmanaged hompages
  24. 24. Windows Defender Application Guard Call managed and unmanaged hompages
  25. 25. Share Payload Hide payload behind fake “jpg”
  26. 26. Run Payload Run hidden payload an establish connection
  27. 27. User Account Control • User Account Control (UAC) helps prevent malware from damaging PCs and helps organizations deploy a better-managed desktop. • Apps and tasks always run in the security context of a standard user account, unless an administrator specifically authorizes elevated access to the system Protect clients from unwanted software
  28. 28. Windows Defender Device Guard Device Guard Kernel Mode Code Integrity • Protects kernel mode processes and drivers from “zero day” attacks and vulnerabilities by using HVCI. • Drivers will must signed. Device Guard User Mode Code Integrity • Enterprise-grade application white-listing that achieves PC lockdown for enterprise that runs only trusted apps. • Untrusted apps and executables, such as malware, are unable to run. driver and application white-listing
  29. 29. Windows Defender Device Guard driver and application white-listing
  30. 30. Metasploit - Meterpreter Compromise the client
  31. 31. Windows Defender Exploit Guard stops the attacker from manipulating processes • Windows Defender Exploit Guard helps you audit, configure, and manage Windows system and application exploit mitigations . • In addition Exploit Guard delivers a new class of capabilities for intrusion prevention. While it provides legacy app protections including: • Arbitrary Code Guard • Block Low Integrity Images • Block Remote Images • Block Untrusted Fonts • Code Integrity Guard • Disable Win32k system calls • Validate Stack Integrity • Do Not Allow Child Processes • Export Address Filtering • Import Address Filtering • Simulate Execution • Validate API Invocation (CallerCheck) • Validate Image Dependency Integrity
  32. 32. Windows Defender Exploit Guard stops the attacker from manipulating processes
  33. 33. Educate your users!