1. The changing of the guard
Dune Desormeaux
Program Manager II
@DuneConfigured
Nash Pherson
Enterprise Mobility MVP
@KidMystic

2. Windows 10 security pillars
Secure Identities
Credential Guard
Threat Resistance
Device Guard
WDAG
Information Protection
BitLocker
Windows Information Protection

3. Device Guard: Two features
Configurable code integrity
Enterprise-grade application and software whitelist capabilities
Configurable Code Integrity sets a single, machine policy
Continue to use AppLocker for user/role-specific policies and managing .bat/.cmd
Windows Script Host, MSIs, PowerShell
Hypervisor protected code integrity
Virtualization-based security protections for the Windows kernel
Additional hardware and UEFI bios lockdown features to deliver most defensible security posture (Device Guard “ready” vs. Device Guard “capable”)

4. Device Guard: the old-Fashioned way1
Identify target systems. 4
Deploy and test policy in audit mode. 6
Enable enforcement mode in CI policy and deploy to target systems. 2
Deploy VBS with CI protection. 5
Create new audit log policy and merge with CI policy 3
Create CI policy from ‘golden’ system(s).

5. Device Guard Management with ConfigMgr

6. Managing security Bouncer Manageability Security Bartender
Win10 RTM: Device Guard
Configurable Code Integrity
Explicit Allow-List
High Risk, High Complexity
Bouncer
Managed Installer
Windows Policy
Manageability
Security
Win7: AppLocker
Explicit Allow-List
Known exploits
Deployed with Group Policy
Bartender

7. traditional platform stack
Device Hardware
Kernel
Windows Platform Services
Apps

8. VIRTUALIZATION BASED SECURITY Windows 10
Kernel
Windows Platform Services
Apps
System Container
Trustlet #1
Trustlet #2
Trustlet #3
Hypervisor
Device Hardware
Windows Operating System
Hyper-V
Hypervisor protected code integrity (HVCI)
Code Integrity process runs in a virtualized container
Credential Guard
Isolation of processes that handle secrets
THERE ARE HARDWARE REQUIREMENTS

9. Credential Guard
Windows 10 can keep a secret

10. Credential guard: Basics
Isolates secrets/credentials using Virtualization Based Security

11. ConfigMgr CI – Babysitting Cred Guard
Gotta do this ourselves for now… Because you haven’t voted yet:
support-enabling-credential-guard-via-compliance-s
bhttps:// osd-with-configmgr/
(See the ConfigMgr CI’s session at 1pm today, repeat on Thursday)

12. Requirements for VBS Hardware: 64-bit CPU
Hardware: CPU virtualization extensions, plus extended page tables
Firmware: UEFI firmware version c or higher with UEFI Secure Boot
Firmware: Secure firmware update process
Software: HVCI/CG compatible drivers
Software: Qualified Windows operating system

13. Device Guard and Credential Guard Hardware Readiness Tool

14. Windows defender Application guard
Isolating Microsoft Edge from unsafe web locations

15. Why application guard?

16. Windows Defender application guard

17. In The real world feat. nash
Tell us how you really feel!

18. Q & A