Module 1: Identity is the New Perimeter Evolution of Identity Module 1: Identity is the New Perimeter Hasain “The Wolf” Alshakarti Trusted Cyber Security Advisor - TrueSec MVP: Cloud & Datacenter Mgmt - Enterprise Security @Alshakarti Marcus Murray Cyber Security Team Manager- TrueSec @marcusswede

Agenda – Module 1 Identity is the “NEW“ Security Boundary Identity in Windows 10 and Windows Server 2016

Identity is the “NEW“ Security Boundary Entry Lateral Movement Threat Actor Goal

Identity in Windows 10 & Windows Server 2016 Credential Guard & Remote Credential Guard Privileged Access Management Windows Hello for Business PowerShell Just Enough Administration

Module 2: Securing the On Prem Identity Evolution of Identity Module 2: Securing the On Prem Identity Hasain “The Wolf” Alshakarti Trusted Cyber Security Advisor - TrueSec MVP: Cloud & Datacenter Mgmt - Enterprise Security @Alshakarti Fredrik “DXter” Jonsson Senior Security Advisor - Identitry

Agenda – Module 2 Hybrid Identities Azure Active Directory integrations Privilege Access Management – JIT Shadow Forests for High Privileged Users Securing Privileged Access & Privileged Access Workstation

Hybrid Identities

Azure Active Directory integrations

Privilege Access Management JIT An expiring Links Feature A user can be added to the group for just enough time required to perform an administrative task. The time-bound membership is expressed by a time-to-live (TTL) value that is propagated to a Kerberos ticket lifetime. KDC enhancements Restrict Kerberos ticket lifetime to the lowest possible time-to-live (TTL) value in cases where a user has multiple time-bound memberships in administrative groups. New Monitoring Capabilities Help you easily identify who requested access, what access was granted, and what activities were performed. Bastion Active Directory forest The bastion forest has a special PAM trust with an existing forest. It provides a new Active Directory environment that is known to be free of any malicious activity, and isolation from an existing forest for the use of privileged accounts. Shadow Security Principals (groups) The shadow security principals have an attribute that references the SID of an administrative group in an existing forest. This allows the shadow group to access resources in an existing forest without changing any access control lists (ACLs).

Shadow Forests for High Privileged Users

Securing Privileged Access & Privileged Access Workstation LAPS Unique Local Admin Passwords for Workstations Unique Local Admin Passwords for Servers PAM Time-bound privileges (no permanent administrators) Multi-factor for time-bound elevation Just Enough Admin (JEA) for Maintenance Lower attack surface of important services Privileged Access Workstations

Module 3: Enabling Secure Cloud Access Evolution of Identity Module 3: Enabling Secure Cloud Access Hasain “The Wolf” Alshakarti Trusted Cyber Security Advisor - TrueSec MVP: Cloud & Datacenter Mgmt - Enterprise Security @Alshakarti Fredrik “DXter” Jonsson Senior Security Advisor - Identitry

Agenda – Module 3 Single Sign On Identity Federation Public Identity Providers Multi Factor Authentication External Users & Application Scenarios

Single Sign On

Identity Federation

Public Identity Providers

Multi Factor Authentication

External Users & Application

Module 4: Enabling Secure Mobile Access Evolution of Identity Module 4: Enabling Secure Mobile Access Hasain “The Wolf” Alshakarti Trusted Cyber Security Advisor - TrueSec MVP: Cloud & Datacenter Mgmt - Enterprise Security @Alshakarti Fredrik “DXter” Jonsson Senior Security Advisor - Identitry

Agenda – Module 4 Intune, AAD & ADFS Web Application Proxy 2.0 Device Registration Access Control Policies

Intune, AAD & ADFS

Web Application Proxy 2.0

Device Registration

Access Control Policies