Download as PDF, PPTX
More Related Content
Similar to Experts Live Europe 2017 - Best Practices to secure Windows 10 with already included features
![Support, Monitoring, Continuous Improvement & Scaling Agentic Automation [3/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day3-cfd-251120170304-ddef8112-thumbnail.jpg?width=640&height=640&fit=bounds)
Experts Live Europe 2017 - Best Practices to secure Windows 10 with already included features
- 1. Best Practices tosecure Windows 10 with already included features Alexander Benoit Head of Competence Center Microsoft @sepago @ITPirate
- 2. Alexander Benoit Senior Consultant/ Head of Competence Center Microsoft „Future Workplace“, Security SCCM, Intune, Windows 10, Defender Framework,… [email protected] @ITPirate http://it-pirate.com/
- 3. We have afirewall We can‘t get hacked!
- 4. Agenda: The threat landscape No-brainersto secure Windows 10 Latest & greatest mitigation features in Windows 10
- 5. The discussion isalways about tools!
- 6. Threat Landscape Phishing Keylogger Ransomware Spyware WormCompromised accounts
- 7. Analysis: High-level vulnerability& exploit trends Vulnerabilities are increasing while evidence of actual exploits is decreasing due to mitigation investments
- 8. How to SecureWindows 10 ?
- 9. Windows 10 Securityon Modern Devices Breach detection investigation & response Device protection Identity protection Information protection Threat resistance
- 10. No-Brainer: Microsoft BitLocker •Full drive encryption solution provided natively with Windows 10 Professional and Enterprise • Used to protect the operating system drive, secondary data drives and removable devices • System Center Configuration Manager, MDT and Intune can be used to deploy BitLocker Overview
- 11. No-Brainer: Microsoft BitLocker Hacknot encrypted client
- 12. Windows Defender CredentialGuard • Uses virtualization-based security to isolate secrets in the Local Security Authority (LSA) . • Only privileged system software can access secrets when stored locally. • Mitigates credential theft attacks, such as Pass-the-Hash (PtH) or Pass-The-Ticket (PtT). Overview
- 13. Windows Defender CredentialGuard Overview • Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security. • The LSA process in the operating system talks to the isolated LSA by using remote procedure calls. • Data stored by using VBS is not accessible to the rest of the operating system.
- 14. Get deeper intoattack scenarios Good to know Exploit: Computercode that takes advantage of a vulnerability in a software system. Payload: Payloads carry the functionality for the greater access into the target.
- 15. Scenario Attack PayloadExploit Common way‘s toshare payloads: • Fake Hyperlink • PowerPoint Macro • as „JPG“ File
- 16. Create a payloadwith Metasploit Create Metasploit payload and configure listener port and host IP.
- 17.
- 18. Windows Defender SmartScreen Block at first sight support in Microsoft Edge
- 19. Windows Defender SmartScreen •The Windows Defender SmartScreen provides an early warning system to notify users of suspicious websites that could be engaging in phishing attacks or distributing malware through a socially engineered attack. • Windows Defender SmartScreen is one of the multiple layers of defense in the anti-phishing and malware protection strategies Check downloaded files Windows Defender Cloud Protection Click! Attacker Generate new malware file Send file metadata Evaluate metadata Verdict: Malware – Block! Malware Block! Including Machine Learning, proximity, lookup heuristics Command & Control User
- 20. Windows Defender ApplicationGuard Call managed and unmanaged hompages
- 21. Windows Defender ApplicationGuard • Windows Defender Application Guard protects the device from advanced attacks launched against Microsoft Edge. • Malware and vulnerability exploits targeting the browser, including zero days, are unable to impact the operating system, apps, data and network. • Application Guard uses virtualization based security to hardware to isolate Microsoft Edge and any browsing activity away from the rest of the system. • Closing Microsoft Edge wipes all traces of attacks that may been encountered while online. Call managed and unmanaged hompages
- 22. Windows Defender ApplicationGuard Call managed and unmanaged hompages
- 23. Windows Defender ApplicationGuard Call managed and unmanaged hompages
- 24. Windows Defender ApplicationGuard Call managed and unmanaged hompages
- 25.
- 26. Run Payload Run hidden payloadan establish connection
- 27. User Account Control •User Account Control (UAC) helps prevent malware from damaging PCs and helps organizations deploy a better-managed desktop. • Apps and tasks always run in the security context of a standard user account, unless an administrator specifically authorizes elevated access to the system Protect clients from unwanted software
- 28. Windows Defender DeviceGuard Device Guard Kernel Mode Code Integrity • Protects kernel mode processes and drivers from “zero day” attacks and vulnerabilities by using HVCI. • Drivers will must signed. Device Guard User Mode Code Integrity • Enterprise-grade application white-listing that achieves PC lockdown for enterprise that runs only trusted apps. • Untrusted apps and executables, such as malware, are unable to run. driver and application white-listing
- 29. Windows Defender DeviceGuard driver and application white-listing
- 30.
- 31. Windows Defender ExploitGuard stops the attacker from manipulating processes • Windows Defender Exploit Guard helps you audit, configure, and manage Windows system and application exploit mitigations . • In addition Exploit Guard delivers a new class of capabilities for intrusion prevention. While it provides legacy app protections including: • Arbitrary Code Guard • Block Low Integrity Images • Block Remote Images • Block Untrusted Fonts • Code Integrity Guard • Disable Win32k system calls • Validate Stack Integrity • Do Not Allow Child Processes • Export Address Filtering • Import Address Filtering • Simulate Execution • Validate API Invocation (CallerCheck) • Validate Image Dependency Integrity
- 32. Windows Defender ExploitGuard stops the attacker from manipulating processes
- 33.