1. PowerShell Desired State Configuration for Securing Systems Jeffrey Snover Distinguished Engineer (MSFT) Hemant Mahawar Senior Program Manager (MSFT) #devconnections

2. Typical Corporate Environment Personal health information (PHI) Personally identifiable information (PII) Trade secrets Intellectual property

3. “New” Threat Personal health information (PHI) Personally identifiable information (PII) Trade secrets Intellectual property

4. Scenario Environment Domain Controller Domain Admin Dept. Head User Domain ( Corporate.Contoso.Com ) Servers containing critical information Phish

5. Post exploit toolkits (like mimikatz) allow bad guys to spider their way through the network compromising systems and users Makes it very hard to have confidence that you’ve remediated an attack Consider what happens with a restore SideNote on Exploits

6. Scenario Recap Corporate domain Admin rights sprawl Bad guys are in the environment and have compromised: – One or more users – One or more machines – One or more machine admin accounts – One or more domain admin accounts Business critical information on file servers

7. One Solution Build a new datacenter with an air gap Create a new AD Provision new machines Set up application/service Users go into the datacenter to use the applications #devconnections

8. Safe Harbor Approach Experimental PowerShell DSC module Uses PowerShell DSC, JEA and virtualization to script a “Safe Harbor” where servers are highly isolated, locked down and tightly managed Benefits – Implementable – Simple (once the base components are available) – Safe and Secure #devconnections

9. Starting Environment Domain Controller Domain Admin Dept. Head User P.A.P.A Domain ( Corporate.Contoso.Com ) Servers containing critical information

10. Hyper-V Domain Admin Dept. Head P.A.P.A User SH DC One Way Trust Jump Box DSC Pull Server File Servers Corporate Request A C T I O N ( W S M A N O N L Y ) A C C E S S ( S M B O N L Y ) Safe Harbor ( Safe Harbor.contoso.com ) Safe Harbor Configuration

11. Safe Harbor Scenario

12. Demo: Safe Harbor - Users can access File Servers - Specified users enabled to for specific admin actions - No other admin actions allowed #devconnections

13. Mitigations Used Move critical data into protected environment Restrict “Administrator” role Provide specific access to specific users (Firewalls, lockdown policies, etc.)

14. How we did it

15. Safe Harbor Steps Create Projected Environment Separate Domain Controller DSC Pull Server JEA Management head (Jump box) Limit Access Domain Admins Firewall Ports Resources Add Servers Securely Never on Corp domain Boot to pull server for configuration Configure Servers Configure and copy critical information

16. Implementation Options GUI tools PowerShell Scripts PowerShell Desired State Configuration PowerShell DSC dramatically simplifies complex composition

17. DSC Supports Composition Declarative approach – Allows you to safely refactor and abstract to your hearts content Supports distributed definition of resources and nodes – DSC does the aggregation Couldn’t I just do this with scripts? – Yes but No

18. Demo: Evolution of SMBShare #devconnections

19. DSC Simplification Intent Logging & Error Handling Reboot Resiliency Environmental Side effects Dependency Resolution Repeatable Automation DSC Engine Dependency Resolution Logging & Error Handling Reboot Resiliency Repeatable Automation Resources Technology Specific Configuration Intent Traditional Scripts

20. DSC Decouples … DSC Engine Dependency Resolution Logging & Error Handling Reboot Resiliency Repeatable Automation Resources Technology Specific Configuration Intent Make It So HOW : DSC Resources Do the heavy lifting in an idempotent way Intent WHAT : Structural Configuration Stays same irrespective of the environment WHERE : Environmental Configuration Changes as system goes through different env. Dev  Test  Production

22. DSC and Security The things that thwart security: – Complexity – Scale – Drift DSC is designed to address these

23. Demo DSC addresses: - Complexity - Scale - Drift #devconnections

24. Domain Admin Dept. Head P.A.P.A User SH Admin SH DC One Way Trust Jump Box DSC Pull Server File Servers Run As M.A.T.A Corporate Request A C T I O N A C C E S S Safe Harbor ( Safe Harbor.contoso.com ) Remember Safe Harbor?

25. #devconnections Configuring Safe Harbor for File Server

26. Components #devconnections Assert- SafeFileServer DSC Resource SafeHarbor Resource Safe FileServer Structural Configuration Safe FileServer Structural Configuration + => FileServer in a Safe Harbor Environment Configuration Data

27. Summary Safe Harbor is an experimental PowerShell DSC module Address the problem of creating a very secure environment to run services/applications – Users can access the applications – Specified users can use a JumpBox to perform a limited set of admin functions – Domain Admins can’t get at these machines/resources Security requires large scale configuration of complex configurations which don’t drift PowerShell DSC dramatically simplifies configuration of complex environments

28. SESSION TITLE #devconnections Rate This Session Now! Rate with Mobile App: 1.Select the session from the Agenda or Speakers menus 2.Select the Actions tab 3.Click Rate Session Rate Using Our Website: 1.Register at www.devconnections.com/logintoratesession 2.Go to www.devconnections.com/ratesession 3.Select this session from the list and rate it Tell Us What You Thought of This Session Be Entered to WIN Prizes!

29. Jeffrey Hemant