Llunitebe2018 windows 10 security features
•
0 likes•91 views
windows 10 security features by Kim Oppalfens and Tom Degreef
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Llunitebe2018 windows 10 security features
Similar to Llunitebe2018 windows 10 security features (20)
More from Kenny Buntinx
More from Kenny Buntinx (20)
Recently uploaded
Recently uploaded (20)
Llunitebe2018 windows 10 security features
- 1. #Scugbe #LLUniteBE #BEEMUG Windows 10 (Not your father’s Windows) Security Improvements TOM DEGREEF & KIM OPPALFENS
- 2. 1 Year in the MVP Program EMS @tomdegreef, http://OSCC.BE Tom Degreef
- 3. Kim Oppalfens 13 Years in the MVP Program (SMS, SCCM, Enterprise Client Management, EMS) @thewmiguy, http://OSCC.BE
- 4. Agenda ▪ Application whitelisting in general ▪ Microsoft & Application whitelisting ▪ Implementing Application control ▪ Demo - Q&A T
- 6. Open vs closed devices K
- 7. Application whitelisting in general ▪ Protect against malicious code by only running trusted code ▪ Whitelist contains the rules that define trust T
- 8. National Institute of standards and technology “Use application whitelisting technologies built into the OS.” “Test in monitoring mode.” “Plan and deployment in a phased approach.” “analyze the environment in which application whitelisting will be running.” T
- 9. Application whitelisting benefits ▪ Protects against 99% of automated malware & ransomware attacks ▪ Enforces solid processes and security practices T&K
- 11. Microsoft & Application whitelisting Applocker Appcontrol Device guard User targeted Device targeted Hardware protected by HVCI Exe, dll, cmd & bat Exe & DLL Requires UEFI Path based rules Accompanied by PowerShell constrained language Requires TPM Block store apps Runs in Kernel space Requires VBS Can Protect against administrator K
- 12. Application control advancements 1703 1709 1803 Managed installer Intelligent Security Graph New policy without reboot T
- 13. Defining trust – core rules • FileHash per binaryHash • Signing certificateLeafcert • Root cert in certificate chainPCA Cert • Original FilenameFilename T
- 14. Defining trust – PCA derivates • Verisign cert + Common name = MicrosoftPublisher • Publisher + Minimal Version Number Signed version • Publisher + Filename File Publisher K
- 15. The unsurmountable challenge of code signing Create your own cert without a PKI New-SelfSignedCertificate -Type CodeSigningCert ` -Subject 'Application control signing cert’ Sign a file using that cert Set-AuthenticodeSignature ` -Certificate((gci Cert:LocalMachineMy) | ` ? {$_.EnhancedKeyUsageList -like '*code signing*’ ` -and $_.Subject -like 'CN=Application control signing cert'}) ` -TimestampServer http://timestamp.digicert.com -HashAlgorithm sha256 ` -FilePath "file" K
- 16. Defining trust – Managed installer ▪ New since 1703 ▪ Makes files written to disk by Trusted process trusted ▪ Does nothing for files already on disk ▪ Can’t be enabled during staging T
- 17. Defining trust – intelligent security graph ▪ New in 1709 ▪ Trust list of known applications generated by Microsoft ▪ Non-Customizable, read: list is as good as it is T
- 18. Audit mode / monitoring mode ▪ NIST and our recommendation, audit mode first (FCS/GBV) ▪ Generates Events in Code Integrity event log – Client side ▪ 1 event per process/file per boot cycle T
- 20. Implementation assumptions •Prevent automated attacksGoal •If app is trusted on one machine in the company it’s trusted everywhereTrust •Majority of apps is installed in a managed fashionManagement K
- 21. OSCC’s application control project kickoff Define scope Find POC department Analyze application types/needs Define catalog creating process Build Initial audit policy T
- 22. OSCC’s application control project assessment phase Collect audit results Remediate audit results Deploy audit policy K
- 23. OSCC’s application control project round-up Start enforcements for deployed systems Expand scope to more departments Sign policy? Start enforcement for new deployments T
- 24. Proposed base policy ▪ Microsoft Base policy ▪ Block Microsoft known bypasses ▪ Microsoft Publisher rule ▪ Define managed installers ▪ Audit-mode Enabled ▪ Add-signerrule (Leaf certificate) ▪ Optional: Add-signerrule store for business cert K
- 25. Common challenges ▪ Unsigned applications ▪ Self-Updating applications ▪ Temporary emergencies ▪ Inhouse developed apps T
- 26. Catalog creation T ▪ Packageinspector.exe start c: ▪ Copy source files ▪ Install application ▪ Packageinspector.exe stop –out cat –name application.cat ▪ Sign cat-file ▪ Copy cat-file to : ▪ C:WindowsSystem32catroot{F750E6C3-38EE-11D1-85E5-00C04FC295EE}
- 27. Generate trust from audit events ▪ Script to convert Audit entries to WMI ▪ Needs access to audited binaries ▪ Collect & Consolidate with SCCM ▪ Create rules based on consolidated list K
- 28. Thanks to our event sponsors Silver Platinum #Scugbe #LLUniteBE #BEEMUG