Drop the hammer down on malware threats with Windows 10’s Device Guard Microsoft 2016 11/11/2018 4:22 PM BRK2129 Drop the hammer down on malware threats with Windows 10’s Device Guard Scott Anderson Program Manager – OS Security © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

200+ 80 The Malware threat $3Trillion $3.5Million Microsoft 2016 11/11/2018 4:22 PM The Malware threat Median number of days attackers are present on a victims network before detection 200+ Days after detection to full recovery 80 Impact of lost productivity and growth $3Trillion Average cost of a data breach (15% YoY increase) $3.5Million “There are two kinds of companies, those who’ve been hacked, and those who don’t know they’ve been hacked.” -James Comey, FBI Director © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Device Guard Achieving PC lockdown for enterprise 11/11/2018 4:22 PM Device Guard Achieving PC lockdown for enterprise Enterprise-grade application whitelisting Virtualization-based security protections Hardware and UEFI bios lockdown Device Guard “ready” and Device Guard “capable” options from OEMs © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/11/2018 4:22 PM Code Integrity © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Whitelisting is a top security recommendation 11/11/2018 4:22 PM Whitelisting is a top security recommendation Australian Signals Directorate top 4 Strategies to Mitigate Targeted Cyber Intrusion Application Whitelisting Application patching Operating System patching Minimise administrative privileges “ASD TOP 4 PREVENTS OVER 85% OF INTRUSTIONS” “Application Whitelisting is the most effective strategy in the Australian Signal Directorate’s (ASD) Strategies to Mitigate Targeted Cyber Intrusions” © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Ensuring the Integrity of Windows 11/11/2018 Ensuring the Integrity of Windows Secure Boot Includes Secure Firmware Updates and Platform Secure Boot Kernel Mode Code Integrity (KMCI) User Mode Code Integrity (UMCI) AppLocker Device Guard’s configurable code integrity ROM/Fuses Bootloaders Native UEFI Windows OS Loader Windows Kernel and Drivers 3rd Party Drivers User mode code (apps, etc.) Device Guard’s configurable code integrity Platform Secure Boot UEFI Secure Boot KMCI UMCI AppLocker © 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

But Whitelisting is Hard… 11/11/2018 4:22 PM But Whitelisting is Hard… IT codesigning is not pervasive Best option for strong app identity and integrity validation Decentralized LOB app development Lack of code signing expertise Enterprises don’t want to (and shouldn’t) blindly trust all software from an ISV, even if signed Too darned many existing LOB apps © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Getting Apps in to the Circle of Trust Adopting Code Signing 11/11/2018 4:22 PM Getting Apps in to the Circle of Trust Adopting Code Signing Make codesigning part of the LOB app development process – OR – app deployment workflows Create catalogs for “legacy” and ISV apps with Windows 10’s Package Inspector tool No need to repackage/rebuild apps Easily deployed with SCCM Device Guard signing in the Windows Store for Business Download default Device Guard configurable CI policy Catalog signing with enterprise-specific, unique keys © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo: Deploying Policies and Applications Microsoft 2016 11/11/2018 4:22 PM Demo: Deploying Policies and Applications © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Secured Scripts with Config CI 11/11/2018 4:22 PM Secured Scripts with Config CI Windows Script Host will be limited Require signed scripts for full functionality WSH is the scripting host for VBScript (.vbs), Jscript (.js), Windows script file (.wsf) and Windows script component (.wsc) scripts Beware unenlightened 3rd party script hosts MSIs must be signed PowerShell runs in “ConstrainedLanguage” mode Only signed PowerShell scripts runs in full language mode .bat & .cmd scripts are not restricted © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Configurable Code Integrity and AppLocker 11/11/2018 4:22 PM Configurable Code Integrity and AppLocker Complementary features to whitelist application/code execution on Windows Configurable Code Integrity (CCI) sets machine policy AppLocker for user role-specific policies, managing UWP apps, and managing .bat/.cmd Signed Device Guard CI policy protects from local admin Signed policy stored in pre-OS secure variable Requires a newer signed policy to update – cannot be deleted by admin Becomes a “machine” level policy which means boot from media must be compliant Measured into the TPM and part of device health attestation © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

“That all sounds great. But… whitelisting is still too hard!” 11/11/2018 4:22 PM “That all sounds great. But… whitelisting is still too hard!” Every IT Pro in the World © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo: Introducing Trusted Managed Installers Microsoft 2016 11/11/2018 4:22 PM Demo: Introducing Trusted Managed Installers © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Simplifying Whitelist Management 11/11/2018 4:22 PM Simplifying Whitelist Management Managed Installer Automatically trust software installed by your IT app deployment solution (e.g. SCCM) Available in RS1 as custom AppLocker policy with configurable CI support coming soon Enable enterprises to better balance security and manageability © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Virtualization Based Protection of Code Integrity 11/11/2018 4:22 PM Virtualization Based Protection of Code Integrity © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Virtualization based security (VBS) A new trust boundary for Windows 11/11/2018 4:22 PM Virtualization based security (VBS) A new trust boundary for Windows Secure execution environment isolated from the high-level OS Enhanced OS protection against attacks (including attacks from kernel mode) Protection of secrets (e.g. derived user credentials) Protection of guest VM secrets from the host OS © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/11/2018 4:22 PM KMCI protected by VBS Code integrity (CI) rules enforced even if a vulnerability allows unauthorized kernel mode memory access Memory pages are only marked executable when CI validation succeeds Kernel memory cannot be marked both writable and executable BUT… not all drivers will be compatible © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Hardware (TPM, virtualization extensions, IOMMU) KMCI in Windows 8.1 Host OS User Kernel Normal World Howdy Peer! KMCI Malware Firmware (UEFI) Hardware (TPM, virtualization extensions, IOMMU)

Hardware (TPM, virtualization extensions, IOMMU) Secure Trustlets with Windows 10 VBS KMCI with Windows 10 VBS I thought we could be friends  Measured Host OS User Secure World Normal World Hardened Boundary LSAIso LSASS Secure App 2 Normal App 2 Kernel KMCI Malware Hypervisor Firmware (UEFI) Hardware (TPM, virtualization extensions, IOMMU)

INTRODUCING Device Guard and Credential Guard Readiness Tool 11/11/2018 4:22 PM INTRODUCING Device Guard and Credential Guard Readiness Tool Verify device compatibility with Device Guard and Credential Guard Hardware and virtualization support Driver compatibility with HVCI Audit status of DG/CG on systems Use SCCM or other management solutions to automate end-to-end deployment of DG/CG Can use the tool to automate enablement of DG/CG © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo: Readiness Tool Microsoft 2016 11/11/2018 4:22 PM © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Preparing for Device Guard 11/11/2018 4:22 PM Preparing for Device Guard © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Planning for Device Guard Considerations 11/11/2018 Planning for Device Guard Considerations Configurable CI works on any Windows 10 PC Choose the right policy options based on scenarios/machine configurations and maturity of IT Policy management can be complicated by the diversity of hardware and software VBS and HVCI have specific hardware requirements Virtualization and IOMMU Microsoft Hyper-V hypervisor Driver compatibility! New or existing systems? © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Device Guard Scenarios and Recommendations Tightly managed Very well-defined software and hardware configurations Low churn No user or standard user only Turn on VBS protection of Kernel Mode Code Integrity Deploy configurable code integrity policy with both kernel and user mode generated from “golden” system(s) Fixed workloads

Device Guard Scenarios and Recommendations Tightly managed Well-defined hardware configurations Managed software only Ideally standard user only Turn on VBS protection of Kernel Mode Code Integrity Deploy configurable code integrity policy with both kernel and user mode created from “golden” system(s) or based on DGSP default policy Optionally, use Managed Installer to simplify policy management Fully managed Fixed workloads

Device Guard Scenarios and Recommendations Multiple and varied hardware configurations User can install “unmanaged” software Standard or Admin users Turn on VBS protection of Kernel Mode Code Integrity Deploy configurable code integrity in audit mode OR KMCI enforced only Optionally, use Managed Installer to simplify policy management Lightly managed Fully managed Fixed workloads

Device Guard Scenarios and Recommendations Personally owned devices Highly-variable hardware and software Device Guard not appropriate BYOD Lightly managed Fully managed Fixed workloads

Deploying Device Guard 11/11/2018 4:22 PM Deploying Device Guard Buy Device Guard “ready” machines from OEMs -- OR -- Use Device Guard and Credential Guard Readiness tool to identify Device Guard “capable” devices Use Windows Store for Business to create default code integrity policy and catalog sign LOB apps Create policy from “golden” systems and sign apps with Windows Store for Business or internal PKI Use Managed Installer to simplify manageability © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/11/2018 4:22 PM Resources Device Guard and Credential Guard Readiness Tool - https://www.microsoft.com/en-us/download/details.aspx?id=53337 Device Guard signing in Business Store Portal - https://businessstore.microsoft.com/en-us/DeviceGuard/ Managing Device Guard with SCCM blog - https://blogs.technet.microsoft.com/configmgrteam/2015/10/30/managing-windows-10-device-guard-with-configuration-manager/ SCCM as a Managed Installer blog - https://blogs.technet.microsoft.com/enterprisemobility/2016/06/20/configmgr-as-a-managed-installer-with-win10/ Device Guard deployment guide - https://technet.microsoft.com/en-us/library/mt463091.aspx Ignite 2015 Device Guard session - https://channel9.msdn.com/Events/Ignite/2015/BRK2336 Windows 10 Device Guard Overview en Français - https://channel9.msdn.com/Blogs/Concretement/Episode-5-Windows-10-Device-Guard © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session 11/11/2018 4:22 PM Please evaluate this session Your feedback is important to us! From your PC or Tablet visit MyIgnite at http://myignite.microsoft.com From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting https://aka.ms/ignite.mobileapp © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11/11/2018 4:22 PM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.