Windows 10 Security

In the previous chapter, you learned about the risks and impact of personally owned devices on information security and the practical steps you can take to ensure the appropriate protection is applied. In this chapter, we'll look at the new security options available with Windows 10 and how they can be combined with existing security to enhance protection. We will explore their benefits and their hardware and software requirements and point you to caveats when implementing some of them.

We will cover the following topics in this chapter:

• Windows Hello and Windows Hello for Business
• Virtual-based security
• Credential Guard
• Device Guard
• Windows Defender Application Guard (WDAG) for Microsoft Edge
• Windows Defender Exploit Guard
• Device Health Attestation
• New BitLocker options
• Local Administrator Password Solution

...

Today's security challenges

Welcome to computer viruses, Trojan horse, rootkits, Backdoors, worms, ransomware, scareware, rogue security software, scamware, crapware, malware, adware, spyware, riskware, grayware, unwanted software, and many, many other threats.

And they are getting more and more sophisticated. Scared?

The cyber-security landscape has changed a lot in the past years. Have you also adapted to it? You can speak of a revolution of cyber threats. Cybercrime has moved on to cyber-espionage, cyber-warfare, and cyber-terror. Where former attackers focused on Fortune 500 companies, you see attackers now go after any target, all verticals, all supply chains, subcontractors, small businesses, and line-level individuals. Malware and vulnerabilities have moved on to credential theft at a large scale and advanced persistent threats. You need to combat this revolution,...

Windows Hello/Windows Hello for Business

According to Microsoft's newest security report, the password length recommendation has been raised to a minimum of 12 characters. But strong passwords can be difficult to remember, and forcing users to frequently change their passwords will often lead to yellow sticky note problems. Also, users often reuse passwords. Passwords are sometimes shared among individuals. Server breaches can expose passwords, especially if they are stored in plain-text or hashed without a salt. Also, users can unintentionally expose their passwords due to phishing attacks.

So passwords are no longer sufficient because they are frequently weak, the same password is used in too many locations, and due to increased cloud calculation power they can easily be cracked by brute force attack or rainbow tables if too short. They can easily be stolen, breached, or...

Virtualization-based security

VBS, a.k.a. Isolated User Mode (IUM) provides a new trust boundary for system software. VBS is included with the Enterprise (including LTSB), Education, and IoT Enterprise editions of Windows 10. It leverages platform virtualization to enhance platform security by limiting access to high-value security assets, even from supervisor mode code (CPL). VBS provides a secure execution environment and protects several Windows 10 services such as LSA credential isolation and Kernel Mode Code Integrity (KMCI). On the server OS, it additionally provides a virtual TPM (vTPM). VBS uses the hypervisor to protect a mini kernel and other important parts/services of the OS by enforcing read, write, and execute permissions across system memory.

By separating these services, it enhances the OS protection against kernel-mode attacks and other attacks. Even if malware...

Credential Guard

As already described in the Windows Hello section, the PtH vulnerability has become a very common threat. Hacker tools such as Mimikatz can dump the system memory and debug your LSASS.exe, containing all the currently active credentials, including hashes. When PtH was weaponized, Windows 7 was already mainstream, and the design of Windows 8.0 was also completed. They could not react/redesign their kernel to prevent this memory dump. Every service was able to dump your Local Security Authority Subsystem (LSASS). With Windows 8.1, a new protected process level (PPL) was introduced. When RunAsPPL was activated, the LSASS process would run with a higher protection level (system level) and therefore no longer be accessible by illegal/corrupt services. But Mimikatz evolved and found a weak spot with device drivers. Even when running in the PPL, LSASS could be accessed...

Device Guard

You can run your system in two ways. One is trusting everything until there is evidence it is malicious. The evidence needs to be provided by, for example, your antivirus solution. This is a method of the past that could hardly keep up with the over 390,000 daily newly generated malware. The other is you trust only known software/executables/scripts.

But have you ever tried to whitelist all executables of your image with software restriction policies or AppLocker? First you need to inventory all executables and then create a policy based on a digital certificate, hash, or path. There are a huge number of executables. And not all are digitally signed. So you need to fall back to filenames and hashes. But what if you use an application that creates unsigned randomly named executables in your temporary folder during runtime? You have to punch a huge security hole into...

Windows Defender Application Guard for Microsoft Edge

With Redstone 3/Windows 10 1709, a new security feature with the cumbersome name WDAG for Microsoft Edge was introduced. Even though it has an unwieldy name, its functionality can be explained easily. The concept of VBS is extended to software containers. So it will execute exposed software such as your browser in an extra virtual OS and connect only by Remote Desktop Protocol (RDP). The first program capable of this was Microsoft Edge, but other products will follow with the next versions of Windows 10. If a Microsoft Edge instance running in such a secure container gets hacked, it does not have access to the host OS. When Microsoft Edge is displaying a intranet or trustworthy site, it will be executed in the host OS. When surfing on other sites, a new instance in the Windows OS will be executed and connected by RDP.

To...

Windows Defender Exploit Guard

Since a long time ago, you could enable extra security on your OS using the free Enhanced Mitigation Experience Toolkit (EMET). Development of EMET was stopped last year, and support for it will end in July 2018. Also, the latest version of EMET 5.5.2 is no longer supported on Windows 10 1709 and will be uninstalled with an in-place upgrade, and installation of EMET will be actively blocked.

But no worries; all the functionality of EMET and even more features are now built in to Windows 10 1709. This new security feature is named Windows Defender Exploit Guard and is located inside the Windows Defender Security Center under App & browser control | Exploit protection:

By accessing the Exploit protection settings, you can control system-wide settings and program-specific overrides. Be carefully with system-wide settings. Per-program settings are...

Device Health Attestation

Already Windows 8.0 introduced a new possibility of evaluating the health of the boot process called Measured Boot, a recorded variant of the Secure Boot. But the suitable enterprise counter part for checking the health data and enforcing access control was not available at that time.

With Windows 10 1511 the technique was named as Windows Provable PC Health (PPCH) and later on with Windows 1607 and newer renamed to DHA. On Windows Server 2016 the counterpart is named Health Attestation Service (HAS).

But what does DHA exactly? It will combine Secure Boot, VBS, ELAM, and protection of your early-boot drivers and measures them with the help of your TPM 2.0. These measured boot data results are collected by the health attestation configuration service provider (CSP) and sent to a Remote HAS for verification/comparison against current policies:

The health...

Windows Defender Security Center

The Windows Defender Security Center introduced with 1703 and extended with 1709 will be described together with Windows Defender ATP in the next chapter.

New BitLocker options

The Advanced Encryption Standard (AES) hard-disk encryption (BitLocker) used since Windows Vista was AES Cipher Block Chaining (AES-CBC). Vista and Windows 7 provided also AES-CBC with Elephant Diffuser. To support BitLocker hardware encryption with so-called encrypted drives (eDrives), the support for Elephant Diffuser was dropped with Windows 8.0. AES with Diffuser can still be accessed, but new encryption can only be done in AES-CBC 128 or 256 bit.

With the introduction of Windows 10 1511, a new AES standard called AES-XEX based on tweaked-codebook mode with ciphertext stealing (XTS-AES) was implemented. XTS-AES provides additional protection from a class of attacks on encryption that rely on manipulating ciphertext to cause predictable changes in plain text by adding additional permutations. XTS-AES will not be back-ported to older OSes.

By default, Windows...

Local Administrator Password Solution

Where do you store the password of the local admin account on every PC in your domain? Options include:

• The account is disabled, only use a domain account/group for local admin rights (what about when the domain isn't available?)
• Use the same password on every machine, set at the time it is built (great way to allow malware to spread across the entire network in seconds!)
• Use a spreadsheet or other centralized notes to record them for other admins to access-but it's okay because it's on a secure network share and password protected (because no one could possibly make a copy or crack the weak security of Excel, right?)

And what do you do when you want to change the password after your system has been compromised, or one of your admins leaves, or a user has discovered the password and is now using it to install software and...

Summary

With the release of Windows 10 1703, Microsoft retired the Security Compliance Manager (SCM) tool, a good source of GPO baselines since 2010. It will be replaced by the new Security Compliance Toolkit (SCT), which can be found at https://www.microsoft.com/en-us/download/details.aspx?id=55319. Additional tools such as the Baseline Management module and the Desired State Configuration Environment Analyzer (DSCEA) tool have been released on GitHub to fill the gap between the old SCM and the new SCT. More details can be found in the following blog: https://blogs.technet.microsoft.com/secguide/2017/06/15/security-compliance-manager-scm-retired-new-tools-and-procedures/.

In this chapter, you learned about the new and improved security capabilities of Windows 10 and how they can protect you in the current cyber-security threat scenario. Raising the security level is an ongoing...