1. Device Guard and AppLocker Better Together Troy L. Martin 1E.com/blogs/author/troymartin/ troy.martin@1E.com troy.martin@1E.com Technical Architect 1E Bill Moore billamoore.com bill_a_moore@dell.com IT Product Owner Client & Mobility Dell Technologies

2. @BMooreatDell Described as "Best Dad ever"- 2014 19 years Dell client management Jeep junkie (no Uber in Austin!!) @1E_TroyMartin In ‘92, 2 nd highest score at DeVry 20 (7.5 @ 1E) Go NY Yankees!! Bill Moore Troy L. Martin

3. So, an Engineer walks in to a bar…..

4. Security is no joke…even at the bar Device Guard App Locker

5. What is the problem? Users can install and run unauthorized/untrusted apps Most security products are reactionary by nature Attacks are narrowly focused with specific goals New malware is easily obtained for a few BitCoin Advanced social engineering methods Relaxed attitudes toward local administrators

6. What is the goal? Enforce application standards Eliminate threats associated with untrusted apps Improve management and control of application sprawl

7. Understanding Individual Capabilities App Locker Device Guard Exclude file from allow / deny rule Target users and groups Allow rules beyond executable only Wizard driven Rules survive app updates without mods Windows 7/8/10 Enterprise & W10 Education Dependent on service Only trusted applications are allowed Ability to sign an unsigned app Windows 10 Enterprise & Education No services Separate from kernel Protected by Hyper-V

8. Understanding Similarities Only known-good “trusted” applications are allowed to run. All others blocked. Rules driven Digital signatures Publisher Application attribute Audit mode capability to convert events to rules PowerShell cmdlets =

9. Code Integrity (https://channel9.msdn.com/Events/Ignite/2015/BRK2336) Secure Boot  Includes Secure Firmware Updates and Platform Secure Boot Kernel Mode Code Integrity (KMCI) User Mode Code Integrity (UMCI) AppLocker ROM/FusesBootloaders Native UEFI Windows OS Loader Windows OS Loader Windows Kernel and Drivers 3 rd Party Drivers User mode code (apps, etc.) KMCIUEFI Secure Boot UMCI Platform Secure Boot AppLocker

10. Demo Make application trusted by Device Guard

11. Demo Block older version app using AppLocker

12. Demo Malware attack on Group Policy Client and AppLocker

13. Application Control & Whitelisting

14. The end goals are basically the same Implementation and level of security are much different AppLocker can be compromised Device Guard is very difficult to compromise i.e. Virtualization Based Security, KMCI Security has a cost. Not willing to pay the cost can lead to compromise Differences: Application Control and Whitelisting

15. Presentation Just a placeholder slide. Please use the example slides in the “Template Example Slides” Section. Questions? info@mnscug.orginfo@mnscug.org

16. And Then …

17. Section HeaderSection Header This is the next section

18. Title Line1 Line2 Line3 Line4 Line5 Line6 Bullet Level 1 Bullet Level 2 Bullet Level 3

19. Title Code

20. Text Only with Border Level 1 Level 2 Level 3

21. Text Only without Border Level 1 Level 2 Level 3

22. Title Text 1 Level 1 Level 2 Level 3 Text 2 Level 1 Level 2 Level 3

23. Section 1 Text Level 1 Level 2 Level 3 Section 2 Text Level 1 Level 2 Level 3 Title

24. Demo Demo Title