1. Windows Tech Series Module 13: Device Guard
Speaker name
Title

2. Objectives Define what Device Guard is
SMSG Readiness
9/16/2018
Objectives
Start Time xx:xx / Length: 2 minutes
Review the learning objectives.
Define what Device Guard is
Understand the requirements for deploying Device Guard
Determine the planning strategy
Identify options for signing applications
Title: Objectives
Length: 2 minutes
<Instructional Designer: List the module learning objectives here. You can use longer descriptions than slide bullets if you want to.>
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

3. The security landscape isn’t changing; it’s changed…

4. US Office of Personnel Management Hacked
SMSG Readiness
9/16/2018
Sony
Hacked
US Office of Personnel Management
Hacked
Anthem
Hacked
Lockheed
Hacked
Show exams of company security breach, why security is the top consideration of every industries
Aramco
Hacked
Bushehr nuclear reactor
Hacked
NSA
Hacked
Microsoft,
Google,
Apple,
Facebook
Hacked
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

5. Device Guard Windows 10 Secure Identities Threat Resistance
SMSG Readiness
9/16/2018
Windows 10
Secure Identities
Threat Resistance
Secure Identities
-Windows Hello
-Microsoft Passport
Information Protection
-Enterprise Data protection
Threat Resistance
-Device Guard
Device Guard
Information
Protection
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6. What is Device Guard?
Combination of hardware + software security features
Enables businesses to strongly control what is allowed to run
Brings mobile-like security protections to desktop OS with support for existing line of business apps

7. Device Guard Solution Virtualization based Security (VBS)
SMSG Readiness
9/16/2018
Device Guard Solution
Virtualization based Security (VBS)
Hypervisor Enforced Code Integrity 
Credential Guide
Configurable Code Integrity (CI)
Virtualization Based Security -  Virtualization Based Security allows the OS to move sensitive operations and data into a protected area in memory, where even malware running in the normal OS kernel can't read it.
Credential Guard - Using virtualization based security as a foundation, Credential Guard protects your domain credentials from being collected by malware in the event of a compromise. When Credential Guard is running, you don't notice anything different about your user experience.
Hypervisor Enforced Code Integrity -  Windows ensures that drivers and other code that runs in kernel mode is properly signed. Hypervisor Enforced Code Integrity protects the management of the code integrity checks using virtualization based security.
Configurable Code Integrity - This gives an enterprise the ability to lock down what apps are allowed to run on a machine. An IT admin can create their own policy, which can include a mix of modern apps and legacy apps.
Kno
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

8. Hardware Requirements
SMSG Readiness
9/16/2018
Hardware Requirements
UEFI 2.3 or higher firmware along with Secure Boot
Virtualization Extensions, such as Intel VT-X, AMD-V and SLAT must be enabled
BIOS Lockdown
X64
IOMMU such as Intel VT-D and AMD-Vi
Trusted Platform Module (TPM) 2.0
Hardware requirements of Device Guard
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9. Virtualization Based Security
SMSG Readiness
9/16/2018
Virtualization Based Security
In the next slides, we will go through the configuration of VBS
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

10. Virtualization Based Security (VBS)
SMSG Readiness
9/16/2018
Virtualization Based Security (VBS)
Provides a new trust boundary for system software
Leverage platform virtualization to enhance platform security
Limit access to high-value security assets from supervisor mode (CPL0) code
Provides a secure execution environment to enable:
Protected storage and management of platform security assets
Enhanced OS protection against attacks (including attacks from kernel-mode)
A basis for strengthening protections of guest VM secrets from the host OS
Windows 10 services protected with Virtualization Based Security
LSA Credential Isolation
vTPM (server only)
Kernel Mode Code Integrity
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. VBS Requirements Hyper-V + Isolated User Mode features
These features can be configured manually by using Windows PowerShell, Deployment Image Servicing and Management, or the Unattend.xml file when deploying images
Restart is needed after

12. VBS Requirements UEFI 2.3 or higher firmware along with Secure Boot
Direct Memory Access (DMA) protection can be enabled to provide additional memory protection but requires processors to include DMA protection technologies
Registry
HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
Set the EnableVirtualizationBasedSecurity DWORD value to 1
Set the RequirePlatformSecurityFeatures DWORD value as appropriate:
Setting this value to 1 enables the Secure Boot option
Setting this value to 2 enables the Secure Boot with DMA Protection option
Group Policy Object
Computer Configuration\Administrative Templates\System\Device Guard\Turn On Virtualization Based Security
Select the Enabled option, and then select Secure Boot or Secure Boot and DMA Protection from the Select Platform Security Level list

13. VBS Requirements Restart is needed after configuring Registry or GPO
SMSG Readiness
9/16/2018
VBS Requirements
Restart is needed after configuring Registry or GPO
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Enabling VBS of Kernel Mode Code Integrity
Registry
HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard
Set the HypervisorEnforcedCodeIntegrity DWORD value to 1
Group Policy Object
Computer Configuration\Administrative Templates\System\Device Guard\Turn On Virtualization Based Security
Select the Enabled option, and then select the Enable Virtualization Based Protection of Code Integrity check box
Restart is needed after configuring Registry or GPO

15. Enabling VBS of Kernel Mode Integrity

16. Credential Guard

17. Credential Guard
Part of a significant Protect the Platform (PtP) initiative
Protecting against Pass the Hash (PtH) attacks
LSA/NTLM/Kerberos refactored to run critical parts in VBS
User credentials remain in VBS and cannot be stolen by kernel malware
Let’s talk about Credential Guard.
Credential Guard is designed to protect the client secrets, both Kerberos and NTLM.
It utilizes virtualization based security.
Prevents PtH attacks by storing credentials in an isolated area not accessible to outside processes.
Problem: Not accessible with debugging tools. Wait, if it’s not accessible to debugging tools..

18. The problem: Someone goes fishing on your network
Pass the Hash enables an attacker to get user access tokens using common tools such as MimiKatz.
In order to run these types of tools administrative privileges on the local machine are required which includes the user right Debug Programs.
By default, only administrators and LocalSystem accounts have the privileges to debug programs.
To understand PtH consider:
LSA is the Local Security Authority Sub System which authenticates user accounts and supports protocols such as Kerberos and NTLM. It is the prime target for attackers trying to steal user credentials.
Pass-the-Hash attacks target credentials like the NTOWF (NT One Way Function) and Kerberos Keys.
Attackers harvest one user's credentials from another user, with privileges.
Attackers can leverage these to laterally traverse from one user to another and from one device to another
Once obtained the attacker can use this account to obtain additional access tokens and walk up the ladder of permissions until a domain administrator account is captured.
Even if the compromise is detected it is hard to completely remove.

19. Pass-the-Hash Technique
Patient Zero
Carol_Tablet
APT-ONE
Recon
User: Carol
User: Bob
NT: 238D…
Will go each steps of Pass-the-Hash technique
Escalate
User: Carol
User: Alice
Foothold
Bob_Laptop
Alice_PC
HR_Vids
User: Bob
User: Alice
NT: A3D7…
NT: 4F3D…

20. The solution: Credential Isolation
When lsass.exe detects that credential isolation is enabled, it spawns an LsaTrustlet as an isolated process, ensuring that it runs within isolated user mode.
The startup of LsaTrustlet is performed before the Security Support Provider initialization, ensuring that the secure mode support routines are ready before any authentication begins.
Requirements:
Windows 10 Enterprise
TPM 2.0
UEFI 2.31
input/output memory management unit such as Intel VT-d
Credential isolation is enabled via a UEFI variable. This is done in order to guard against remote modifications of the configuration.
Now this means once configured it will require physical access to remove or modify.

21. Architectural Overview
SMSG Readiness
9/16/2018
Architectural Overview
LsaTrustlet protects credentials by encrypting them with either a per-boot or persistent key. The per-boot key is used for any in-memory credentials which do not require persistence. An example of such a credential would be a TGT Session Key. This key is negotiated with a KDC every time authentication occurs, and is protected with a per-boot key. The persistent key, or some derivative thereof, is used to protect items which are stored and reloaded after a reboot. An example of a persisted, protected secret is a domain credential stored in the credential management system (CredMan). Such credentials are intended for long-term storage, and must be protected with a consistent key.
When credential isolation is enabled certain calls are routed via RPC to the LsaTrustlet trustlet. However, when isolation is off, the calls are handled directly in-process. An abstraction around all credential isolation calls is used encapsulate the differences between the two modes. The following diagram illustrates the code layout.
Limitations
Credential Guard is designed to protect user credentials on a Windows 10 device and is not intended to run on a domain controller.
There is no benefit to enabling Credential Guard without Device Guard. It can be enabled without Device Guard for testing purposes.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Credential Guard login flow
9/16/2018
Credential Guard login flow
Domain Controller
LSASS
VSM
NTLM
NTLM
NTOWF: C9DF4E56…
NTOWF: C9DF4E56…
Kerberos
Demo the credential guard login flow
Kerberos
Kerb key
TGT
Kerb key
TGT key
File server
Alice’s User Session
Hypervisor
User: Alice
Password: a1b2c3
© 2015 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

23. Enabling Credential Guard
SMSG Readiness
9/16/2018
Enabling Credential Guard
Registry
HKLM\SYSTEM\CurrentControlSet\Control\Lsa
Set the LLsaCfgFlags DWORD value to 1
Group Policy Object
Computer Configuration\Administrative Templates\System\Device Guard\Turn On Virtualization Based Security
Select the Enabled option, and then select the Enable Credential Guard check box
Restart is needed after configuring Registry or GPO
How to enable credential guard
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Enabling Credential Guard
SMSG Readiness
9/16/2018
Enabling Credential Guard
How to enable credential guard
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

25. Validating Device Guard Hardware Based Features
SMSG Readiness
9/16/2018
Validating Device Guard Hardware Based Features
Get-CimInstance –ClassName Win32_DeviceGuard –Namespace root\Microsoft\Windows\DeviceGuard
Validate via powershell cmdlets
SecurityServicesConfigured: whether or not VBS is configured
SecurityServicesRunning: whether or not VBS is running
VirtualizationBasedSecurityStatus: VBS status
Detailed parameter guide can be found in next hide slides.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

26. Validating Device Guard Hardware Based Features
SMSG Readiness
9/16/2018
Validating Device Guard Hardware Based Features
Msinfo32.exe
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

27. Configurable Code Integrity
SMSG Readiness
9/16/2018
Configurable Code Integrity
us/library/dn986865(v=vs.85).aspx
Windows 10 Enterprise Hypervisor introduces new capabilities around virtual trust levels, which helps Windows 10 Enterprise services to run in a protected environment, in isolation from the running operating system. Windows 10 Enterprise virtualization-based security helps protect kernel code integrity and helps to provide credential isolation for the local security authority (LSA). Letting the Kernel Code Integrity service run as a hypervisor-hosted service increases the level of protection around the root operating system, adding additional protections against any malware that compromises the kernel layer.
Important  Device Guard devices that run Kernel Code Integrity with virtualization-based security must have compatible drivers - legacy drivers can be updated - and have all virtualization capabilities turned on. This includes virtualization extensions and input/output memory management unit (IOMMU) support.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

28. Configurable Code Integrity
SMSG Readiness
9/16/2018
Configurable Code Integrity
Secure Boot
Kernel Mode Code Integrity (KMCI)
User Mode Code Integrity (UMCI)
AppLocker
Introduce what is Configurable code integrity, how many types of it.
ROM/Fuses
Bootloaders
Native UEFI
Windows
OS Loader
Windows Kernel and Drivers
3rd Party Drivers
User mode code (apps, etc.)
KMCI
UEFI Secure Boot
UMCI
Platform Secure Boot
AppLocker
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29. Securing Scripts Scripts can do dangerous things
Windows Script Host will require signed scripts
WSH is the scripting host for VBScript (.vbs), JScript (.js), Windows Script File (.wsf) and Windows Script Component (.wsc) scripts
MSIs must be signed
PowerShell will be in “ConstrainedLanguage” mode
Signed PowerShell scripts can be in full language mode
.bat & .cmd scripts are not restricted

30. Create Device Guard Policy
SMSG Readiness
9/16/2018
Create Device Guard Policy
New-CIPolicy
-FilePath Destination file
-Audit Create from audit log
-Level Level of detail - RootCertificate, PCACertificate, LeafCertificate, FileName, Hash, FilePublisher
-Fallback Fallback level of detail if primary not available
-ScanPath Scan path
-UserPEs Include user mode code integrity
Merge-CIPolicy
-PolicyPaths Comma separated list of policy file paths
-OutputFilePath Destination file
Use cmd line to configure CI policy
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

31. Create Device Guard Policy
Set-RuleOption
-Help List available options
-Option Identifier for option to configure
-Delete Remove the specified option
-FilePath Policy file path

32. Create Policy from “Golden” System
SMSG Readiness
9/16/2018
Create Policy from “Golden” System
PS C:\> #Create a ShadowCopy to avoid locks
PS C:\> $s1 = (gwmi -List Win32_ShadowCopy).Create("C:\", "ClientAccessible")
PS C:\> $s2 = gwmi Win32_ShadowCopy | ? { $_.ID -eq $s1.ShadowID }
PS C:\> $d  = $s2.DeviceObject + "\"
PS C:\> cmd /c mklink /d C:\scpy "$d"
PS C:\> #Create policy from current system
PS C:\> New-CIPolicy -level PcaCertificate –fallback hash
-filepath C:\TRPolicy.xml –scanpath C:\scpy –u
PS C:\> #Remove ShadowCopy
PS C:\> "vssadmin delete shadows /Shadow=""$($s2.ID.ToLower())"" /Quiet" | iex
Explain the command used to create policy from gloded system.
Create Shadow Copy of System Drive
Generate a new policy from scan
Clean up Shadow Copy
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

33. Create and Merge Policy from Audit
SMSG Readiness
9/16/2018
Create and Merge Policy from Audit
PS C:\> #Create policy from audit log events
PS C:\> New-CIPolicy -l PcaCertificate -f C:\AuditPolicy.xml –a –u
PS C:\> #Merge audit policy with other policy/policies
PS C:\> Merge-CIPolicy –OutputFilePath C:\MergedPolicy.xml
–PolicyPaths C:\AuditPolicy.xml,C:\IgnitePolicy.xml
PS C:\> #Set policy options e.g. Audit Mode (option 3)
PS C:\> Set-RuleOption –option 3 –FilePath C:\MergedPolicy.xml
PS C:\> #Compile policy as binary
PS C:\> ConvertFrom-CIPolicy C:\MergedPolicy.xml C:\MergedPolicy.bin
PS C:\> #Install compiled policy
PS C:\> cp C:\MergedPolicy.bin
c:\Windows\System32\CodeIntegrity\SIPolicy.p7b
PS C:\> #Policy takes effect after reboot
Convert from XML to binary file
Install compiled policy
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

34. SMSG Readiness
9/16/2018
KMCI protected by VBS
CI rules are still enforced even if a vulnerability allows unauthorized kernel mode memory access
Memory pages are only marked executable if CI validation succeeds
Kernel memory cannot be marked both writeable and executable
BUT… not all drivers will be compatible initially
Talking point: why we have Kernel mode CI
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

35. Hardware (TPM 2.0, Vt-x2, IOMMU)
KMCI in Windows 8.1
Host OS
User
Kernel
Normal World
Howdy Peer!
KMCI
Malware
Firmware (UEFI)
Hardware (TPM 2.0, Vt-x2, IOMMU)

36. Hardware (TPM 2.0, Vt-x2, IOMMU)
KMCI with Windows 10 VBS
I thought we could be friends 
Measured
Host OS
User
Normal World
Secure World
Hardened Boundary
KMCI
Kernel
Malware
Hypervisor
Firmware (UEFI)
Hardware (TPM 2.0, Vt-x2, IOMMU)

37. Planning for Device Guard

38. Planning for Device Guard
Know your target(s)
Use PowerShell cmdlets to create policy from “golden” system(s)
Defaults to Audit Mode
Merge multiple policies OR deploy differentiated policies
Deploy policy in audit mode and test
Use PowerShell cmdlets to create policy from audit log and merge
Enable enforcement

39. Know Your Targets Fixed workloads Tightly managed
SMSG Readiness
9/16/2018
Know Your Targets
Tightly managed
Very well-defined software and hardware configurations
Low churn
No user or standard user only
Secure Boot restricted to only boot Windows
Virtualization-based security (VBS) enabled
Kernel mode code integrity protected by VBS
User mode code integrity enforced
Define how Device Guard can help increase security for different workloads.
Fixed Workload example: ATM, Point of Sales machines.
Fixed workloads
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

40. Know Your Targets Fully managed Fixed workloads
SMSG Readiness
9/16/2018
Know Your Targets
Secure Boot restricted to only boot Windows
Virtualization-based security (VBS) enabled
Kernel mode code integrity protected by VBS
User mode code integrity enforced
Tightly managed
Well-defined hardware configurations
Managed software only
Ideally standard user only
Define how Device Guard can help increase security for different workloads.
Fully managed workloads example: enterprise file server, dev\test machine
Fully managed
Fixed workloads
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

41. Know Your Targets Lightly managed Fully managed Fixed workloads
SMSG Readiness
9/16/2018
Know Your Targets
Multiple and varied hardware configurations
User can install “unmanaged” software
Standard or Admin users
Secure Boot may be restricted to only boot Windows
VBS enabled
KMCI may be protected by VBS
Code Integrity in audit mode
Lightly managed
Define how Device Guard can help increase security for different workloads.
Lightly managed: user machine, laptop
Fully managed
Fixed workloads
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

42. Know Your Targets BYOD Lightly managed Fully managed Fixed workloads
Personally owned devices
Highly-variable hardware and software
Secure Boot not required
No VBS
No enterprise code integrity policy
BYOD
Lightly managed
Fully managed
Fixed workloads

43. Device Guard Catalog Files

44. SMSG Readiness
9/16/2018
IT Code Signing
Just as most malware is unsigned, so too are the vast majority of LOB apps
“Code Signing is hard”
Decentralized LOB app development
Lack of code signing expertise
Enterprises don’t want to (and shouldn’t) blindly trust all software from an ISV even if signed
Windows 10 includes tools enabling IT to address code signing for existing apps
Why we have CI catalog, what’s the concern of using CI in Enterprise environment.
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

45. Types of Digital Signatures
Embedded Signature
The binary and signing information is self contained
Required for boot-start drivers (run-time check)
Catalog Signing
A signed file that identifies one or more binaries
Published to Windows in a well defined path
Required for driver packages (install-time check)
Can be managed and deployed independently of the packaged binaries
Preserves any existing signatures

46. Adopting Code Signing Microsoft Store signed and distributed apps
SMSG Readiness
9/16/2018
Adopting Code Signing
Microsoft Store signed and distributed apps
Universal and Classic Windows apps
Enterprise signing via internally managed PKI
Incorporated into LOB app development processes
Windows 10 package inspector tool to generate catalog for existing apps
Microsoft Device Guard Signing Portal (coming later this year)
Catalog signing with enterprise specific, unique key
How apps can be signed?
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

47. Additional Windows 10 CI Improvements
Raising the bar for what runs in the kernel
Windows 10 drivers must be signed by Microsoft
Strong driver publisher identity verification via Extended Validation (EV) certificates
Enterprises can enforce Windows 10 driver requirements via Device Guard policy
Signed Device Guard CI policy protects from local admin
Signed policy stored in pre-OS secure variable
Requires a newer signed policy to update – cannot be deleted by admin
Becomes a “machine” level policy which means boot from media must be compliant
Measured into the TPM and part of device health attestation

48. AppLocker and Code Integrity
Together, AppLocker and code integrity are the basis for enforcing code and application rules on Windows
Think of code integrity as the bouncer at the door, and AppLocker as the bartender
Code integrity best expresses high level expression of trust
AppLocker allows for granular rules
Managed through common management tools in Windows 10

49. Module review What is Device Guard solution.
SMSG Readiness
9/16/2018
Module review
In this module, you learned to:
Start Time xx:xx / Length: 2 minutes
Introduce the review activity.
“Before we conclude, let’s do a quick review of what we’ve learned today. Use the Text tool to type your responses to the question on the screen.”
Acknowledge responses. If time allows, follow up verbally with one or two responses.
What is Device Guard solution.
How to deploy Device Guard solution.
How to plan Device Guard solution.
Title: Module Review
Length: 5 minutes
<Instructional Designer: use this slide to drive home the objectives and summary for this module. > 52
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

50. Questions?

51. SMSG Readiness
9/16/2018
© 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.