The changing of the guard Dune Desormeaux Program Manager II @DuneConfigured Nash Pherson Enterprise Mobility MVP @KidMystic

Windows 10 security pillars Secure Identities Credential Guard Threat Resistance Device Guard WDAG Information Protection BitLocker Windows Information Protection

Device Guard: Two features Configurable code integrity Enterprise-grade application and software whitelist capabilities Configurable Code Integrity sets a single, machine policy Continue to use AppLocker for user/role-specific policies and managing .bat/.cmd Windows Script Host, MSIs, PowerShell Hypervisor protected code integrity Virtualization-based security protections for the Windows kernel Additional hardware and UEFI bios lockdown features to deliver most defensible security posture (Device Guard “ready” vs. Device Guard “capable”)

Device Guard: the old-Fashioned way 1 Identify target systems. 4 Deploy and test policy in audit mode. 6 Enable enforcement mode in CI policy and deploy to target systems. 2 Deploy VBS with CI protection. 5 Create new audit log policy and merge with CI policy 3 Create CI policy from ‘golden’ system(s).

Device Guard Management with ConfigMgr

Managing security Bouncer Manageability Security Bartender Win10 RTM: Device Guard Configurable Code Integrity Explicit Allow-List High Risk, High Complexity Bouncer Managed Installer Windows Policy Manageability Security Win7: AppLocker Explicit Allow-List Known exploits Deployed with Group Policy Bartender

traditional platform stack Device Hardware Kernel Windows Platform Services Apps

VIRTUALIZATION BASED SECURITY Windows 10 Kernel Windows Platform Services Apps System Container Trustlet #1 Trustlet #2 Trustlet #3 Hypervisor Device Hardware Windows Operating System Hyper-V Hypervisor protected code integrity (HVCI) Code Integrity process runs in a virtualized container Credential Guard Isolation of processes that handle secrets THERE ARE HARDWARE REQUIREMENTS

Credential Guard Windows 10 can keep a secret

Credential guard: Basics Isolates secrets/credentials using Virtualization Based Security

ConfigMgr CI – Babysitting Cred Guard Gotta do this ourselves for now… Because you haven’t voted yet: https://configurationmanager.uservoice.com/forums/300492-ideas/suggestions/19311187- support-enabling-credential-guard-via-compliance-s bhttps://www.scconfigmgr.com/2016/06/15/enable-credential-guard-in-windows-10-during- osd-with-configmgr/ https://github.com/npherson/StealTheseCIs http://ccmexec.com/2017/04/configmgr-ci-to-check-that-credential-guard-is-running/ (See the ConfigMgr CI’s session at 1pm today, repeat on Thursday)

Requirements for VBS Hardware: 64-bit CPU Hardware: CPU virtualization extensions, plus extended page tables Firmware: UEFI firmware version 2.3.1.c or higher with UEFI Secure Boot Firmware: Secure firmware update process Software: HVCI/CG compatible drivers Software: Qualified Windows operating system

Device Guard and Credential Guard Hardware Readiness Tool

Windows defender Application guard Isolating Microsoft Edge from unsafe web locations

Why application guard?

Windows Defender application guard

In The real world feat. nash Tell us how you really feel!

Q & A