The world as frankps sees it!
Posts tagged AppLocker
Introduction to Windows 7
Jan 14th
It’s two months since I got the first introduction to Windows 7 (code named Vienna) at Microsoft Tech-Ed 2008 in Barcelona, and this week Microsoft released a public beta of their next client operating system. I have installed it on my MacBook Pro, and plan to install it on an office machine in AD and on my home machine.
I have been using Windows Vista for about 3 years now, through some of the betas and later with the released product. At the department where I am the sysadmin, more of then half of our computers are running Windows Vista (three of them x64) and Office 2007. All in all, I can say that we are very satisfied. This is not the situation many other places, as I often hear of companies that have decided to continue with Windows XP and not implement Vista in their organization. At our department we have only ran in to a few problems, most of them have been software not following Microsoft’s coding guidelines.
Watch the video on NRKbeta video – Direct link to this video
More >
Introduction to Windows 7 Security
Nov 5th
Paul Cooke – CISSP
Director
Microsoft
Core Security in Windows 7, explore related usage scenarios, and look into how to manage these in an enterprise environment.
The Windows Vista Foundation is continued. User Account Control and Enhanced Auditing. Security Development Lifecycle process. Kernel Patch Protection, Windows Service Hardening, DEP & ASLR (IE 8 inclusive), Mandatory Integrity Controls.
User Access Control
Make the system work well for standard users
Administrators use full privilege only for administrative tasks
File and registry virtualization helps applications that are not UAC compliant
Windows 7
Reduce the number of OS applications and tasks that require elevation
Refactor applications into elevated/non-elevated pieces
Flexible promt behavior for administrators
Customer Value: Users can do even more as a standard user (for instance change time zone) and administrators will see fewer UAC Elevation Prompts. MS has done a lot to evaluate user submitted data of their user experiences. Users will be able to do more in Windows 7 then in Vista.
Desktop Auditing
Simplidied configuration results in lower TCO
Demonstrate why a person has access to specific information
Understand why a person has been denied access to specific informatioin
Track all changes made by specific people or groups
Advanced Security Settings for Global File SACL (Photo taken) – you can then find when and who is poking around on the system.
UAC Control
Set the level for what level the UAC should prompted you on. You can no longer turn UAC off, but can set it to never prompt me. More or less the same? You can now look at the BitLocker state on your disk without getting prompted. Users can run updates without getting prompted. You set the level of UAC. You can also prevent them from doing so.
Securing Anywhere Access
Network Security
Windows Firefall can coexist with 3rd party products
Multi-Home Profiles – with Vista you can only have one such Home profile.
DNSSec
Network Access Protection (NAP)
Ensure that only “healthy” machines can access corporate data
Enable “unhealthy” machines to get clean before they gain access
NAP is the same as for Vista. Just as UAC, NAP is here to stay
DirectAccess
Same experiences accessing corporate resources inside and outside the office
Seamless connection increases productivity updates and policies
Seamless connection increases productivity of mobile users
Easy to service mobile PCs and distribute updates and policies
Built on Open Standards, IPv6 and IPSec. Not many people has IPv6 deployed. Torado protocol to tunnel IPv6 over an IPv4 network. Use Kerberos token. Cisco VPN also use IPSec. It is the VPNless VPN…
AppLocker
Application Control
Users can install and run non-standard application. Run applications from USB sticks and non-standard applications.
Even standard users can install some types of software
unauthorized applications may:
- introduce malware
- Increase helpdesk calls
- Reduce user productivity
Simple Rule Strcture: Allow, Exception & Deny
Publisher Rules: Product Publisher, Name, Filename & Version
Multiple Policies: Executables, installers, scripts & DLLs
Rule creation tools & wizard
Audit mode only
He actually mentioned somebody bloged about blocking Google apps. I guess that was my blog …
(Photo of a white list)
Publisher – Path – Hash are different ways of blocking/allowing applications. You can set version number, but also allow higher version number. Then you don’t have to maintain the white list every time there is a patch. You can also allow applications from a Publisher, for instance Microsoft, and you allow one specific application or a suite of applications. You can also allow a specific user or a group of users to use an application that is banned for the rest of the organization.
More about AppLocker tomorrow – First lecture, 9 o’clock.
Internet Explorer 8
(foto)
Freedom from intrusion – Social Engineering and Exploits
Reduce unwanted communications
Protection from harm: Browser and Web Server Exploits.
Protect Data
RMS, EFS and BitLocker
30 % of lost data is from lost devices.
BitLocker To Go
USB external devices (sticks and drives)
Create group policies to mandate the use of encryption
Now supports the FAT filesystem from Windows 7.
New Key Protectors for BitLocker
- Domain Recovery Agent (DRA)
- Smart Card – data volumes only
Windows 7 has a bunch of new GPOs for BitLocker. You can now set the minimum pin length. Deny write access to removable media if it is not BitLocker protected. A BitLocker protected device only give write access to other Windows 7 machines, but read access to XP SP2, Vista and Windows Server 2008.
You can choose between passphrase or smart card for your removable devices.
Recent Comments