1. Best practices to secure Windows 10 with already included features
6/25/ :00 PM
Best practices to secure Windows 10 with already included features
Alexander Benoit
MVP | Head of Competence Center
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Alexander Benoit
Senior Consultant / Head of Competence Center Microsoft
„Future Workplace“, Security
SCCM, Intune, Windows 10, Defender Framework,…
@ITPirate

3. We have a firewall
We can‘t get
hacked!

4. Take aways: The threat landscape
6/25/ :00 PM
Take aways:
The threat landscape
Latest & greatest mitigation features in Windows 10
Quick checklist – you have them enabled …
No-brainers to secure Windows 10
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. The discussion is always about tools!

6. Threat Landscape Phishing Ransomware Spyware Keylogger Worm
Compromised accounts
Compromised accounts
Drive-by download sites
Malicious websites
Ransomware
Deliver Code
Elevate (Everybody is local admin)
Code Injection
Malicisous Actions
Malware
Phishing

7. How to secure Windows 10 ? So you‘ll probably ask yourself…
What we are going to do today..
Remember when I said this is my first session at Ignite. Probalbly my last..

8. Get deeper into attack scenarios
Good to know
Exploit:
Computercode that takes advantage of a vulnerability in a software system.
Payload:
Payloads carry the functionality for the greater access into the target.

9. Scenario Exploit Payload Attack Common way‘s to share payloads:
Fake Hyperlink
PowerPoint Macro
as „JPG“ File
Remember when I said this is my first Ignite Session

10. Windows Defender SmartScreen
Check downloaded files
The Windows Defender SmartScreen provides an early warning system to notify users of suspicious websites that could be engaging in phishing attacks or distributing malware through a socially engineered attack.
Windows Defender SmartScreen is one of the multiple layers of defense in the anti-phishing and malware protection strategies
Verdict: Malware – Block!
Evaluate metadata
Including Machine Learning, proximity, lookup heuristics
Windows Defender Cloud Protection
Send file metadata
SmartScreen was introduced in Internet Explorer 11.
Generate new malware file
Command & Control
Click!
Malware Block!
Attacker
User

11. Windows Defender Application Guard
6/25/ :00 PM
Windows Defender Application Guard
Call managed and unmanaged homepages
Windows Defender Application Guard protects the device from advanced attacks launched against Microsoft Edge.
Malware and vulnerability exploits targeting the browser, including zero days, are unable to impact the operating system, apps, data and network.
Application Guard uses virtualization based security to hardware to isolate Microsoft Edge and any browsing activity away from the rest of the system.
Closing Microsoft Edge wipes all traces of attacks that may been encountered while online.
Kein SSO
© Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Windows Defender Application Guard
Call managed and unmanaged homepages

13. Windows Defender Application Guard
Call managed and unmanaged homepages

14. User Account Control Protect clients from unwanted software
User Account Control (UAC) helps prevent malware from damaging PCs and helps organizations deploy a better-managed desktop.
Apps and tasks always run in the security context of a standard user account, unless an administrator specifically authorizes elevated access to the system

15. Windows Defender Device Guard
driver and application white-listing
Device Guard Kernel Mode Code Integrity
Protects kernel mode processes and drivers from “zero day” attacks and vulnerabilities by using HVCI.
Drivers will must signed.
Device Guard User Mode Code Integrity
Enterprise-grade application white-listing that achieves PC lockdown for enterprise that runs only trusted apps.
Untrusted apps and executables, such as malware, are unable to run.

16. Windows Defender Device Guard
driver and application white-listing

17. Windows Defender Exploit Guard
stops the attacker from manipulating processes
Windows Defender Exploit Guard helps you audit, configure, and manage Windows system and application exploit mitigations .
In addition Exploit Guard delivers a new class of capabilities for intrusion prevention.
While it provides legacy app protections including:
Arbitrary Code Guard
Block Low Integrity Images
Block Remote Images
Block Untrusted Fonts
Code Integrity Guard
Disable Win32k system calls
Validate Stack Integrity
Do Not Allow Child Processes
Export Address Filtering
Import Address Filtering
Simulate Execution
Validate API Invocation (CallerCheck)
Validate Image Dependency Integrity

18. Secure Windows 10 – No Brainers

19. No-Brainer: Stay Current
Stay current! Analysis: High-level vulnerability & exploit trends
Vulnerabilities are increasing while evidence of actual exploits is decreasing due to mitigation investments

20. No-Brainer: Microsoft BitLocker
Overview
Full drive encryption solution provided natively with Windows 10 Professional and Enterprise
Used to protect the operating system drive, secondary data drives and removable devices
System Center Configuration Manager, MDT and Intune can be used to deploy BitLocker

21. No-Brainer: Windows Defender Credential Guard
Overview
Credential Guard isolates secrets that previous versions of Windows stored in the Local Security Authority (LSA) by using virtualization-based security.
The LSA process in the operating system talks to the isolated LSA by using remote procedure calls.
Data stored by using VBS is not accessible to the rest of the operating system.

22. Windows 10 Security on Modern Devices
6/25/2018
Windows 10 Security on Modern Devices
Virtualization Based Security
Windows Defender Expolit Guard
UEFI Secure Boot
Windows Defender Device Guard
Device Encryption
Windows Trusted Boot
Windows Defender Application Guard
Windows Defender Credential Guard
Security Management
Windows Information Protection
Windows Update
Microsoft Edge
Windows Hello for Business
Conditional Access
BitLocker (MBAM)
Windows Defender AV
Trusted Platform Module
Windows Firewall
Windows Hello
BitLocker
Windows Defender Advanced Threat Protection
SmartScreen
BitLocker to Go
Device protection
Threat resistance
Identity protection
Information protection
Breach detection investigation & response
© 2016 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation.
MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Educate your users!

24. Please evaluate this session
Tech Ready 15
6/25/2018
Please evaluate this session
From your
Please expand notes window at bottom of slide and read. Then Delete this text box.
PC or tablet: visit MyIgnite
Phone: download and use the Microsoft Ignite mobile app
Your input is important!
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.