Windows 7 Security Overview

Transcription

1 Windows 7 Security: To Protect and Serve Matthew Hartel Application Analyst White and Williams LLP hartelm@whiteandwilliams.com Tel: J. Abernethy Practice Manager Legal Applications mindshift Technologies, Inc. Booth 407/409 J. Abernethy@mindSHIFT.com Windows 7 Security Overview What s different Windows XP and Vista Mature Basic Security Toolbox Authentication Permissions Malware Data Protection Compatibility Manageable Framework Windows 7 Security Model Trusted Installer Group Policy and Preferences UAC User Installs Internet Threats File and Registry Virtualization 1

2 Administrative Rights 90% of vulnerabilities can be mitigated by running as a user. 1 Principle of Least Privilege Built to run as user - Local administrator disabled by default Live as a user - Know thy User, for He is not Thee Application compatibility features help older programs work without admin privileges 1 BeyondTrust 2009 Microsoft Vulnerability Analysis Bit Locker Encryption Ties data to the hardware. Encrypt ALL portable devices. Seamless Active Directory integration for pin recovery No partition creation (as in Vista) Trusted Platform Modules (TPM) are standard Features Bit Locker Local Drive Bit Locker to Go USB Drives Active Directory Integration Group Policy Management Demo User Access Control State Change Leave it on but customize Process Isolation (think CTRL ALT DEL) More relaxed with Windows 7. Fixes for incompatible apps available via shims and manifests (Application Compatibility Toolkit) 2

3 File & Registry Virtualization UAC must be enabled 32-bit Applications only %WinDir% \Program Files \Program Files (x86) Dealing with Bad Apps Open rights difficult to manage Allow virtualization Technical support needs to understand how virtualization works. Watch settings changes from within the application. Windows Firewall Very similar to Vista, but a far cry from XP Improvements Inbound and outbound Support for multiple l network connections/policies i Configuration Wizards no more netsh commands and hokey text editing More granular exceptions, connection and port configurations App Locker For restricting installation or execution of apps Inventory of current application is critical. Much more granular than software restriction policies More maintainable over the long term. Group or user driven Must start Application Identity service and set default rules. Can get frustrating to support if over utilized 3

4 Windows 7 Security Management Deployment Group Policy includes over 300 new settings to manage security Group Policy Preferences adds additional Client Side Extensions for management Compliance Enhanced Auditing provides capabilities to make it easier for an organization to meet business compliance requirements. What can be Managed? Windows Firewall AppLocker User Account Control Local Security Rights Local User Accounts Device Access BitLocker / BitLocker To Go Internet Explorer Security NTFS / Registry Policy versus Preferences Group Policy Characteristics: Popular Client Side Extensions (CSE): Folder Redirection, Scripts, Security, Application Management, IE Settings May be extended through ADM/ADMX files Can hide aspects of the application or OS Interface. Does not tattoo by default Group Policy Preference Characteristics: Popular CSEs: Shortcuts, Drive Maps, Files, Registry, Printers, Power Allows item-level targeting based on an extensive set of criteria Tattoos by default Can be used to set first use settings 4

5 Common Group Policy Myths Myth: Group Policy Preferences only work on Windows 7 Actually, GPPs work Vista, Server 2008 / R2 natively, and XP SP2, Server 2003 with CSEs installed. GPPs must be managed by Vista, Server 2008 or above. Myth: You should upgrade to Windows 2008 R2 before implementing Windows 7 Actually, Windows 2008 R2 DCs and/or 2008 R2 Functional Level provide few specific benefits to Windows 7 Myth: You must implement a Group Policy Central Store when going to Windows 7 Actually, while adding some performance and replication benefits, a central store is NOT required. T y p ic a l S e c u r ity P o lic ie s Account policies Password complexity and aging. Enhanced with Windows 2008 R2 Functional level! Local User and Group management Control the Administrator password and username Applocker / Software Restrictions Monitor or prevent application execution Internet Explorer Security Settings Manage Trusted Sites, ActiveX Controls Typical Security Policies Part 2 Device Management Control the ability to Load and unload devices, such as removable media Desktop Encryption Control Bitlocker configuration, recovery passwords User Interface Remove access to run command, hide drives, or prevent context menus User Account Control For both users and administrators Windows Firewall Enforce more restrictive rules when not connected to the corporate network 5

6 Windows 7 Enhanced Auditing 53 auditable events in Windows 7 Only 9 in XP Reason for Access Reporting All can be managed via Group Policy For Your C onsideration Group Policies / Preferences are not perfect! You cannot easily: Granularly control registry / file permissions Run executables Apply privilege to individual executables Centralized Event Viewer Reporting needs to be assessed There are dozens of security products in the marketplace that are designed to enhance and augment the base Windows 7 Security features Questions? 6