Device Guard and AppLocker Better Together Troy L. Martin 1E.com/blogs/author/troymartin/ Technical Architect 1E Bill Moore billamoore.com IT Product Owner Client & Mobility Dell Technologies

@BMooreatDell Described as "Best Dad ever" years Dell client management Jeep junkie (no Uber in In ‘92, 2 nd highest score at DeVry 20 1E) Go NY Yankees!! Bill Moore Troy L. Martin

So, an Engineer walks in to a bar…..

Security is no joke…even at the bar Device Guard App Locker

What is the problem? Users can install and run unauthorized/untrusted apps Most security products are reactionary by nature Attacks are narrowly focused with specific goals New malware is easily obtained for a few BitCoin Advanced social engineering methods Relaxed attitudes toward local administrators

What is the goal? Enforce application standards Eliminate threats associated with untrusted apps Improve management and control of application sprawl

Understanding Individual Capabilities App Locker Device Guard Exclude file from allow / deny rule Target users and groups Allow rules beyond executable only Wizard driven Rules survive app updates without mods Windows 7/8/10 Enterprise & W10 Education Dependent on service Only trusted applications are allowed Ability to sign an unsigned app Windows 10 Enterprise & Education No services Separate from kernel Protected by Hyper-V

Understanding Similarities Only known-good “trusted” applications are allowed to run. All others blocked. Rules driven Digital signatures Publisher Application attribute Audit mode capability to convert events to rules PowerShell cmdlets =

Code Integrity ( Secure Boot  Includes Secure Firmware Updates and Platform Secure Boot Kernel Mode Code Integrity (KMCI) User Mode Code Integrity (UMCI) AppLocker ROM/FusesBootloaders Native UEFI Windows OS Loader Windows OS Loader Windows Kernel and Drivers 3 rd Party Drivers User mode code (apps, etc.) KMCIUEFI Secure Boot UMCI Platform Secure Boot AppLocker

Demo Make application trusted by Device Guard

Demo Block older version app using AppLocker

Demo Malware attack on Group Policy Client and AppLocker

Application Control & Whitelisting

The end goals are basically the same Implementation and level of security are much different AppLocker can be compromised Device Guard is very difficult to compromise i.e. Virtualization Based Security, KMCI Security has a cost. Not willing to pay the cost can lead to compromise Differences: Application Control and Whitelisting

Presentation Just a placeholder slide. Please use the example slides in the “Template Example Slides” Section. Questions?

And Then …

Section HeaderSection Header This is the next section

Title Line1 Line2 Line3 Line4 Line5 Line6 Bullet Level 1 Bullet Level 2 Bullet Level 3

Title Code

Text Only with Border Level 1 Level 2 Level 3

Text Only without Border Level 1 Level 2 Level 3

Title Text 1 Level 1 Level 2 Level 3 Text 2 Level 1 Level 2 Level 3

Section 1 Text Level 1 Level 2 Level 3 Section 2 Text Level 1 Level 2 Level 3 Title

Demo Demo Title