1. Module 1: Identity is the New Perimeter
Evolution of Identity
Module 1: Identity is the New Perimeter
Hasain “The Wolf” Alshakarti
Trusted Cyber Security Advisor - TrueSec
MVP: Cloud & Datacenter Mgmt - Enterprise Security
@Alshakarti
Marcus Murray
Cyber Security Team Manager- TrueSec
@marcusswede

2. Agenda – Module 1 Identity is the “NEW“ Security Boundary
Identity in Windows 10 and Windows Server 2016

3. Identity is the “NEW“ Security Boundary
Entry
Lateral Movement
Threat Actor Goal

4. Identity in Windows 10 & Windows Server 2016
Credential Guard & Remote Credential Guard
Privileged Access Management
Windows Hello for Business
PowerShell Just Enough Administration

5. Module 2: Securing the On Prem Identity
Evolution of Identity
Module 2: Securing the On Prem Identity
Hasain “The Wolf” Alshakarti
Trusted Cyber Security Advisor - TrueSec
MVP: Cloud & Datacenter Mgmt - Enterprise Security
@Alshakarti
Fredrik “DXter” Jonsson
Senior Security Advisor - Identitry

6. Agenda – Module 2 Hybrid Identities
Azure Active Directory integrations
Privilege Access Management – JIT
Shadow Forests for High Privileged Users
Securing Privileged Access & Privileged Access Workstation

7. Hybrid Identities

8. Azure Active Directory integrations

9. Privilege Access Management JIT
An expiring Links Feature A user can be added to the group for just enough time required to perform an administrative task. The time-bound membership is expressed by a time-to-live (TTL) value that is propagated to a Kerberos ticket lifetime.
KDC enhancements Restrict Kerberos ticket lifetime to the lowest possible time-to-live (TTL) value in cases where a user has multiple time-bound memberships in administrative groups.
New Monitoring Capabilities Help you easily identify who requested access, what access was granted, and what activities were performed.
Bastion Active Directory forest The bastion forest has a special PAM trust with an existing forest. It provides a new Active Directory environment that is known to be free of any malicious activity, and isolation from an existing forest for the use of privileged accounts.
Shadow Security Principals (groups) The shadow security principals have an attribute that references the SID of an administrative group in an existing forest. This allows the shadow group to access resources in an existing forest without changing any access control lists (ACLs).

10. Shadow Forests for High Privileged Users

11. Securing Privileged Access & Privileged Access Workstation
LAPS
Unique Local Admin Passwords for Workstations
Unique Local Admin Passwords for Servers
PAM
Time-bound privileges (no permanent administrators)
Multi-factor for time-bound elevation
Just Enough Admin (JEA) for Maintenance
Lower attack surface of important services
Privileged Access Workstations

12. Module 3: Enabling Secure Cloud Access
Evolution of Identity
Module 3: Enabling Secure Cloud Access
Hasain “The Wolf” Alshakarti
Trusted Cyber Security Advisor - TrueSec
MVP: Cloud & Datacenter Mgmt - Enterprise Security
@Alshakarti
Fredrik “DXter” Jonsson
Senior Security Advisor - Identitry

13. Agenda – Module 3 Single Sign On Identity Federation
Public Identity Providers
Multi Factor Authentication
External Users & Application Scenarios

14. Single Sign On

15. Identity Federation

16. Public Identity Providers

17. Multi Factor Authentication

18. External Users & Application

19. Module 4: Enabling Secure Mobile Access
Evolution of Identity
Module 4: Enabling Secure Mobile Access
Hasain “The Wolf” Alshakarti
Trusted Cyber Security Advisor - TrueSec
MVP: Cloud & Datacenter Mgmt - Enterprise Security
@Alshakarti
Fredrik “DXter” Jonsson
Senior Security Advisor - Identitry

20. Agenda – Module 4 Intune, AAD & ADFS Web Application Proxy 2.0
Device Registration
Access Control Policies

21. Intune, AAD & ADFS

22. Web Application Proxy 2.0

23. Device Registration

24. Access Control Policies