2. Protecting Against Credential Theft: Today and Tomorrow
Chris Jackson
M330

3. The Evolution of Attacks
11/21/2018
The Evolution of Attacks
Beyond
Nation States, Activists, Terror Groups
BRAZEN,
COMPLEX,
PERSISTENT
Motives:
IP Theft,
Damage,
Disruption
2005-PRESENT
Organized Crime
RANSOMWARE,
CLICK-FRAUD,
IDENTITY THEFT
Motive: Profit
Sophistication
Script Kiddies
BLASTER, SLAMMER
Motive: Mischief
Targeting
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4. Are Attackers Getting More Sophisticated?
11/21/2018
Are Attackers Getting More Sophisticated?
Microsoft Defies Court Order, Will Not Give s to US Government
NSA internet snooping: EU threatens to suspend data sharing with US
Data source: Microsoft Security Intelligence Report volume 11 microsoft.com/sir
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Observed Adversary Tactics
Capture the Identity Infrastructure
Target Specific High Value Assets

7. Cybersecurity Framework
11/21/2018
Cybersecurity Framework
Design and configure environment for resiliency
Use signals to detect adversaries early
Be prepared to respond calmly and rapidly to incidents
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Typical Credential Theft Attack
11/21/2018
Typical Credential Theft Attack
Beachhead (e.g. Phishing)
Steal credentials
Move laterally
Acquire Domain Admin credentials
Execute attacker mission
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Typical Attack Timeline and Observations
11/21/ :06 PM
Typical Attack Timeline and Observations
24–48 Hours
Average 8 Months 
Initial compromise or entry
Vector.
Core security compromised.
Service outage, data theft, or
exfiltration.
Attack detected. 
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Tier Model for Credential Partitioning
Control
Tier-0
Data and
Services
Tier-1
Access
Tier-2

11. SMSG Readiness
11/21/2018
“If you protect your paper clips and diamonds with equal vigor, you’ll soon have more paper clips and fewer diamonds”
-Attributed to Dean Rusk,
US Secretary of State,
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

12. Hardened Workstation 11/21/2018 12:06 PM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

13. Domain Administration
Privileged
Access
Control
Tier-0
IPsec
Data and
Services
Tier-1
Access
Tier-2

14. ESAE / Red Forest Production Domain Secure Vault IPsec
Domain Controllers
Admin Workstations
Domain Admins
Monitoring
(SCOM)
Red Forest
Certificate
Authority
WSUS
Break-glass Account
Red Forest Admins
Secure Vault
SCOM Gateway

15. Hardened Workstation 11/21/2018 12:06 PM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

16. Local Admin Password Solution (LAPS)
Active Directory X X X
100110
110010
100011

17. Virtual Secure Mode Apps Windows Hypervisor Hardware
Microsoft Ignite 2015
11/21/ :06 PM
Virtual Secure Mode
Windows
Kernel
Apps
Virtual Secure Mode (VSM)
Local Security Auth Service
Virtual TPM
Hyper-Visor Code Integrity
Kernel
Hypervisor
Hardware
© 2015 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

18. Staying ahead of exploits
Stay current on security updates
Use the newest versions of applications
Use the Enhanced Mitigation Experience Toolkit (EMET)

20. APPS TODAYS CHALLENGE Trusted by default, until defined as threat
Detection based methods are unable to keep up

21. Virtual Secure Mode Apps Windows Hypervisor Hardware
Kernel
Apps
Virtual Secure Mode (VSM)
Local Security Auth Service
Virtual TPM
Hyper-Visor Code Integrity
Kernel
Hypervisor
Hardware

22. Trusted Code Within a Process
Enhanced Mitigation Experience Toolkit
Behavior-based protection
Supports Group Policy and ConfigMgr

23. Security Development Lifecycle (SDL)
11/21/2018
Security Development Lifecycle (SDL)
Reduce Number & Impact of security issues
Prioritize use of threat models
Training
Requirements
Design
Implementation
Verification
Release
Response
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. How do you truly recover?
11/21/ :06 PM
How do you truly recover?
Tier 2
Tier 1
Tier 0
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. the era of cloud computing
is being born
in a time of war
-like constant hostility

26. Related Ignite NZ Sessions1 5 6 2 3
Find me later at…
Hub Happy Hour Thu 5:30-6:30pm 4

27. Resources Microsoft Virtual Academy TechNet & MSDN Flash
11/21/2018
Microsoft Virtual Academy
Resources
TechNet & MSDN Flash
Free Online Learning
Subscribe to our fortnightly newsletter
Sessions on Demand
© 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. Complete your session evaluation now and be in to win!
11/21/ :06 PM
Complete your session evaluation now and be in to win!
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29. 11/21/ :06 PM
© 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.