Why Windows 10 is the most secure Windows ever
Credit to Author: Fahmida Y. Rashid| Date: Tue, 18 Sep 2018 14:40:00 -0700
Three years after its debut, Windows 10 is poised to overtake Windows 7 as the most popular version of the Windows operating system. Microsoft introduced virtualization-based security features – namely Device Guard and Credential Guard – in Windows 10, and in subsequent updates, has added other virtualization-based protections to the operating system.
Microsoft tackled the two biggest challenge for enterprises with Windows 10, password management and protecting the operating system from attackers. Windows Defender was renamed Windows Security in 2017 and now includes anti-malware and threat detection, firewall and network security, application and browser controls, device and account security, and device health. Windows Security shares status information between Microsoft 365 services and interoperates with Windows Defender Advanced Threat Protection, Microsoft’s cloud-based forensic analysis tool.
Device Guard and Credential Guard remain the two standout security features of Windows 10 – they protect the core kernel from malware and prevent attackers from remotely taking control of the machine. Microsoft has also grouped other virtualization-based protections such as Windows Defender Application Guard under the Windows Security umbrella. Windows Defender Advanced Threat Protection round out the analytics available to Windows 10 Enterprise customers.”Clearly, Microsoft thought a lot about the kind of attacks taking place against enterprise customers and is moving security forward by leaps and bounds,” said Ian Trump, a security lead at LogicNow.
Device Guard relies on Windows 10’s virtualization-based security to allow only trusted applications to run on devices. Credential Guard protects corporate identities by isolating them in a hardware-based virtual environment. Microsoft isolates critical Windows services in the virtual machine to block attackers from tampering with the kernel and other sensitive processes. With Application Guard, Microsoft Edge opens untrusted websites in an isolated Hyper-V enabled container, keeping the host operating system protected from potentially malicious sites. These features rely on the same hypervisor technology already used by Hyper-V.
Using hardware-based virtualization to extend whitelisting and protecting credentials was a “brilliant move” by Microsoft, said Chester Wisniewski, senior security strategist for Sophos Canada, an antivirus company.
Device Guard relies on both hardware and software to lock down the machine so that it can run only trusted applications. Applications must have a valid cryptographic signature from specific software vendors — or from Microsoft if the application comes from the Windows Store. Device Guard assumes that all software is suspicious, and relies on the enterprise to decide which is trusted.
Although there have been reports of malware code writers stealing certificates to sign malware, a significant majority of malware is unsigned code. The reliance of Device Guard on signed policies will block most malware attacks.
“It is a great way to protect against zero-day attacks that make it by anti-malware defenses,” Trump said.
While this approach is similar to what Apple does with its App Store, there’s a twist: Microsoft recognizes that enterprises need a wide array of applications. Businesses can sign their own software without having to make changes to the code, and for applications they know and trust (custom software they bought, for example), they can sign those applications, too. In this way, organizations can create a list of trusted applications independent of whether the developer obtained a valid signature from Microsoft.
This puts organizations in control of which sources Device Guard considers trustworthy. Device Guard comes with tools that can make it easy to sign Universal or even Win32 apps that may not have been originally signed by the software vendor. Clearly, Microsoft is looking for middle ground between a total lockdown and keeping everything open, enabling organizations to “have their cake and eat it, too,” Wisniewski said.
Under the hood, Device Guard is more than another whitelisting mechanism. It handles whitelisting in a way that is actually effective because the information is protected by the virtual machine. That is, malware or an attacker with administrator privileges cannot tamper with the policy checks.
Device Guard isolates Windows services that verify whether drivers and kernel-level code are legitimate in a virtual container. Even if malware infects the machine, it cannot access that container to bypass the checks and execute a malicious payload. Device Guard goes beyond the older AppLocker feature, which could be accessed by attackers with administrative privileges. Only an updated policy signed by a trusted signer can change the app control policy that has been set on the device.
Windows Defender ATP, a cloud-based console for forensic analysis of threats and attacks, lets enterprises upload telemetry from workstations to the cloud service and monitor for lateral movement, ransomware, and other common attacks. Administrators can use the threat intelligence API to combine telemetry information, antivirus detection, and Device Guard events to build custom alerts.
“It’s exciting for Windows to put this right in the box,” said Trump. “It may become a corporate standard.”
Credential Guard may not be as exciting as Device Guard, but it addresses an important facet of enterprise security: It stores domain credentials within a virtual container, away from the kernel and user mode operating system. This way, even if the machine is compromised, the credentials are not available to the attacker.
Advanced persistent attacks rely on the ability to steal domain and user credentials to move around the network and access other computers. Typically, when users log into a computer, their hashed credentials are stored in the operating system’s memory. Previous versions of Windows stored credentials in the Local Security Authority, and the operating system accessed the information using remote procedure calls. Malware or attackers lurking on the network were able to steal these hashed credentials and use them in pass-the-hash attacks.
By isolating those credentials in a virtual container, Credential Guard prevents attackers from stealing the hash, restricting their ability to move around the network. Credential Guard protects NTLM password hashes, Kerberos Ticket Granting Tickets, and credentials stored by applications as domain credentials from attackers.
Windows Defender Application Guard gives enterprise administrators the ability to control how Microsoft’s Edge browser identifies and blocks dangerous websites. Edge opens untrusted sites in an isolated Hyper-V enabled container, keeping the host operating system protected from potentially malicious sites. The isolated container has no user data, so the attacker in that virtual environment can’t obtain the user’s credentials. Once enabled, Application Guard will let enterprises block outside websites, limit printing, restrict the use of the clipboard and isolate the browser to only use local network resources.
Originally available for Windows 10 Enterprise, Application Guard now also supports Internet Explorer for Windows 10 Pro versions, provided the hardware requirements are met.
“Microsoft’s Implementation may not be as easy as some vendors, and Microsoft may not have a fancy dashboard, but to include security features like these [Credential Guard, Device Guard, Microsoft Hello two-factor authentication, and BitLocker] you have an operating system worthy of the title ‘Enterprise’ and a very hard target to hack,” Trump said.
Exciting features aren’t enough to spur adoption. Many businesses have held off on upgrading to Windows 10. The reluctance stems from the substantial investment required upfront, from better hardware and new Group Policy settings. However, the latest shift to Windows 10 reflects the reality that Windows 7 will enter end-of-life in January 2020 and even with support windows being extended, organizations have to plan their hardware refresh to support Windows 10.
The combination of Device Guard and Credential Guard could go a long way toward locking down an environment and stopping APT attacks, but the hardware requirements are hefty. To enable Device Guard and Credential Guard, the machines need Secure Boot, support for 64-bit virtualization, Unified Extensible Firmware Interface (UEFI) firmware, and the Trusted Platform Module (TPM) 2.0 chip. The UEFI lock, which prevents attackers from disabling UEFI by modifying the registry, is also recommended. Enabling Credential Guard on virtual machines have additional requirements, including 64-bit CPU, CPU virtualization extensions plus Extended Page Tables, and Windows Hypervisor. Application Guard requires being on a 64-bit machine, with Extended Page Tables (also called Second Level Address Translation, SLAT), as well as Intel VT-x extensions or AMD-V.
Only enterprise hardware, not consumer PCs, includes such features. For example, business laptops such as Lenovo ThinkPad and Dell Latitude models typically have these specs, but consumer models such as the Lenovo Yoga 3 Pro do not. The hypervisor-level protections are available only if the machine has a processor with virtualization extensions, such as Intel VT-x and AMD-V.
Other Windows 10 security features have different hardware requirements. Windows Hello, which supports face and fingerprint recognition, would typically need additional hardware. Windows Hello now supports FIDO 2.0 authentication for Windows 10 devices that are managed by Azure Active Directory, and there is now the option to use Windows Hello Face, Fingerprint, or PIN options from the main log-in screen.
Employees regularly working in the field or traveling extensively throughout the year are more likely to opt for a lighter laptop — and most Ultrabooks do not have TPM inside. “The executives are the ones I worry about,” Wisniewski said, as they’re the ones most at risk of attack and more likely to be using consumer models.
The hardware isn’t the only barrier to getting started; most organizations will also need to make changes to infrastructure and processes. Many IT teams don’t currently use UEFI or Secure Boot because they impact existing workflows and there are some single sign-on platforms that don’t play well with UEFI. IT may be concerned about getting locked out of computers with Secure Boot; it’s easier to wipe a machine and load a stock corporate image when setting it up. Likewise, some machines may run critical applications with specific requirements that cannot be upgraded.
Fortunately, Device Guard and Credential Guard don’t require an all-or-nothing decision. IT can build a new domain with Device Guard and Credential Guard protections turned on and move users who meet the hardware requirements. The machines that can’t be upgraded can be left in the existing domain. This lets IT maintain a “clean” network with signed policy and protected credentials and focus their attention on the older, “dirty” domains. “Don’t hold the entire network back for just one thing,” Wisniewski said.
Microsoft also recognizes that many organizations have a hybrid environment with different Windows versions. Very few can claim to have moved their entire infrastructure to Windows 10. Windows Defender ATP was originally available only with a Windows E5 or Microsoft Office 365 E5 subscription, but now there is down-level support for Windows 7 SP1 and Windows 8.1. Heterogenous organizations can get access to the advanced forensics.
Few enterprises believe the current state of enterprise Windows security is acceptable. Device Guard and Credential Guard actually offer a way forward, albeit one that demands a substantial investment. With Windows 10, “Microsoft is telling enterprises, ‘If you want good technology you need to do security [our way],'” Wisniewski said.
Time will tell whether enterprises are willing to follow that path.
This story, “Why Windows 10 is the most secure Windows ever” was originally published by InfoWorld.