Windows 7. Qing Liu Michael Stevens

Transcription

1 Windows 7 Qing Liu Qing.Liu@chi.frb.org Michael Stevens Michael.Stevens@chi.frb.org 1

2 Overview 1. Financial Institution s Preliminary Steps 2. User Interface 3. Data Protection 4. User and Group Changes 5. Kernel Changes 6. Audit changes 7. New and Changed Security Options 2

3 Section 1: Financial Institution s Preliminary Steps 3

4 Learning Objectives In this module you will learn: Preliminary Steps on migration How to determine if a PC is Windows 7 ready What features the various versions of Windows 7 provide to the FI. 4

5 To Migrate or Not to Migrate? Plan now Start migration before 2012 Windows XP expires in

6 Preliminary Migration Steps Planning and rollout Hardware upgrades Application compatibility evaluation New applications Office 2007 consideration Training 6

7 Hardware Requirements 32-bit Processor 1 GHz 1 GHz Processor Type 32bit x86 or better, such as 64 bit 64 bit RAM 1 GB 2 GB Hard Disk Space 16 GB 20 GB Graphics DirectX 9 device with WDDM 1.0+ driver 64-bit DirectX 9 device with WDDM 1.0+ driver Note: The 64-bit edition of Windows offers better performance, but has additional system requirements (notably a 64-bit processor), needs different hardware drivers, and thus requires additional testing for hardware and software compatibility. 7

8 Windows 7 Versions Feature Home Premium Professional Ultimate Make the things you do every day easier with improved desktop navigation. Start programs faster and more easily, and quickly find the documents you use most often. Make your web experience faster, easier and safer than ever with Internet Explorer 8. Run many Windows XP productivity programs in Windows XP Mode. Help protect data on your PC and portable storage devices against loss or theft with BitLocker. 8

9 Windows 7 Enterprise Direct Access ( Security) BranchCache Federated Search BitLocker and BitLocker-to-Go (Security) AppLocker (Security) Virtual desktop infrastructure (VDI) optimizations Multilingual user interface 9

10 Windows 7 Readiness Download Windows 7 Upgrade Advisor Run Hardware / software compatibility report Windows 7 Upgrade Advisor link

11 Section 2: User Interface 11

12 Learning Objectives In this module you will: Describe Windows 7 s Graphical User Interface options List new features Become familiar with Windows XP Mode integrated virtualization 12

13 Changes to Windows Aero New taskbar: right-click applications to see new tasks 13

14 Changes to Windows Aero Taskbar Thumbnails: Quickly preview the content of each open window, not merely the name 14

15 Changes to Windows Aero Aero Peek: hover over lower-right corner of screen to reveal desktop temporarily 15

16 Live Icons 16

17 Flip 3D 17

18 Getting Started 18

19 Start Menu and Search Many elements of Windows 7 incorporate new search capabilities. Search box Libraries Ability to Save Searches 19

20 Demo Search 20

21 Libraries 21

22 Gadgets Gadgets mounted to the Desktop Gadget selection window 22

23 How about old applications running on XP? 23

24 XP Mode Processor: Processor capable of hardware virtualization, with AMD-V or Intel VT turned on in the BIOS. Memory: 2GB of memory recommended. Hard disk requirement: 20MB hard disk space for installing Windows Virtual PC. Additional 15GB of hard disk space per virtual Windows environment recommended.

25 Section 3: Data Protection 25

26 Learning Objectives In this module you will learn: The current threats Authentication and encryption features Trusted Platform Module Rights Management Service Encrypted Files System BitLocker / BitLocker to go 26

27 Current Threats Threats to data Password recovery programs are widely available that enable offline attacks Offline attacks expose core system keys that allow for the compromise of secured data Hundreds of thousands of laptops are lost every year Software Based Security 27

28 Trusted Platform Module (TPM) Module on the motherboard Performs cryptographic functions Can create, store and manage keys Performs digital signature operations Source: 28

29 Multi-Factor Authentication Three authentication factors: Factor Something you have Something you know Something you are Example USBToken, or TPM chip Password Fingerprint SINGLE-FACTOR: MULTI-FACTOR: Something you have (TPM chip) Something you have (TPM chip) Something you have (TPM chip and token) Something you know (password) ******* 29

30 Three Windows 7 Applications RMS, EFS, and BitLocker Three levels of protection: Rights Management Services (RMS) Per-document enforcement of policy-based rights Encrypting File Systems (EFS) Per file or folder encryption of data for confidentiality BitLocker Full Volume Encryption Per volume encryption (see earlier) 30

31 Rights Management Services (RMS) Rights Management Services embeds usage policies in documents to control their use Protecting confidential messages Enforcing document rights Distributing media content RMS components RMS-enabled application Client SW Server SW 31

32 Encrypting File System (EFS) Only files and folders on NTFS volumes can be encrypted. Encrypted files can become decrypted if you copy or move the file to a volume that is not an NTFS volume. Moving unencrypted files into an encrypted folder will automatically encrypt those files in the new folder. However, the reverse operation will not automatically decrypt files. Files must be explicitly decrypted. 32

33 Encrypting File System (EFS) 33

34 BitLocker & BitLocker To Go 34

35 Video Bitlocker 35

36 Who are you protecting against? Other users or administrators on the machine? EFS Unauthorized users with physical access? BitLocker Scenarios BitLocker EFS RMS Laptops Branch office server Local single-user file & folder protection Local multi-user file & folder protection Remote file & folder protection Untrusted network admin Remote document policy enforcement 37

37 Section 4: User and Group Changes 38

38 Learning Objectives In this module you will learn: Add a new user More new groups available User Account Control to mitigates risk 39

39 New Users 40

40 New Groups 41

41 User Account Control User provides explicit consent before using elevated privilege. 42

42 User Account Control Setup 43

43 Changes to UAC in Windows 7 Four levels of notification for UAC in Windows 7: Most Secure Always Notify Me Displays all prompts Prompts dim screen Default for standard users Notify Me Only When Programs Try to Make Changes to My Computer (default) Display only prompts from applications Prompts dim screen Default for administrators Do not Dim Desktop Displays only prompts from applications No screen dimming Not default Least secure Never Notify Me Displays no prompts No screen dimming Not default 44

44 ACL 45

45 Section 5: Kernel Changes 46

46 Learning Objectives In this module you will learn: New security features via Windows 7 kernel improvement 47

47 Security Enhancements User Account Control level Virtual Accounts BitLocker and BitLocker-to-go 48

48 Virtual Accounts Want better isolation than existing service account Don t want to manage passwords Virtual accounts are like service accounts Process runs with virtual SID as principal System-managed password Show up as computer account when accessing network Services can specify a virtual account Account name must be NT SERVICE\<service> Service control manager verifies the service account and creates a user profile for the account 49

49 Section 6: Audit Changes 50

50 Learning Objective In this module you will learn: How Windows 7 has improved upon auditing capabilities. 51

51 Improved Auditing More Granularity Support for many auditing subcategories: Logon, logoff, file system access, registry access, use of administrative privilege Previous versions of Windows only support high-level categories such as System, Logon/Logoff, and Object Access, with little granularity New Logging Infrastructure Easier to filter out noise in logs and find the event you re looking for Tasks tied to events: When an event occurs, such as administrative privilege use, tasks such as sending an to an auditor can run automatically 52

52 Granular Audit Policy 53

53 Added Auditing For Registry value change audit events (old + new values) AD change audit events (old + new values) Improved operation-based audit Audit events for UAC Improved IPSec audit events including support for AuthIP RPC Call audit events Share Access audit events Share Management events Cryptographic function audit events IAS (RADIUS) audit events (server only) 54

54 Section 6: New and Changed Security Options 55

55 Learning Objectives In this module you will learn following features: Windows Biometric Framework AppLocker DirectAccess Windows Firewall Windows Security Essential Internet Explorer 8 56

56 AppLocker 58

57 DirectAccess 59

58 Windows 7 Firewall Both inbound and outbound Authentication and authorization aware Outbound applicationaware filtering is now possible Includes IPSec management Policy-based administration 60

59 Multiple Active Firewall Profiles New feature in Windows 7 Previously, Windows Firewall rules applied over all network connections (wired, wireless, VPN, hotspot, home, etc.) Now, can have different firewall rules for three classes of connections. Win7 Firewall Profile Domain Private Public Connection Most secure Least secure Firewall policies Least restrictive Most restrictive Example VPN Home wireless network All non-domain connections, by default 61

60 Microsoft Security Essentials Free anti-virus/spyware/malware tool from Microsoft designed for home PCs Not included in Windows 7 installation; needs to be downloaded separately from Microsoft No central management capabilities unlike Windows Defender not ideal solution for large organizations 62

61 Security Essentials Scanning Modes Real-Time Protection Warns users when potential spyware is executed or tries to perform certain operations 63

62 MS vs Other Brand Name Vendors

63

64 Security Essentials Scanning Modes Scheduled & On-Demand Scans Quick: scans only system files likely to be targeted by malware and viruses or likely culprits such as processes currently running and files currently open on the machine Full: scans all files, much longer process 66

65 Internet Explorer 8 Secure Features SmartScreen Domain Highlighting InPrivate Browsing Cross Site Scripting Filter 67

66 SmartScreen and SmartScreen Filter 68

67 SmartScreen Filter 69

68 Domain Highlighting The Microsoft domain is easy to read. 70

69 Cross Site Scripting Filtering Internet Explorer 8 detects potential cross-site scripting Vulnerabilities and disables harmful scripts. 71

70 InPrivate Browsing 72

71 Click-jacking prevention Data Execution Prevention (DEP) InPrivate Filtering Automatic crash recovery

72 Windows 7 Conclusion Many features already exist in other operating systems. Incorporates most major security changes introduced in Windows 7. UAC password requirements seen as less annoying in Windows 7 due to more customization and better software design. Improved security by additional features and options. 74

73 Questions? 75

74 References Windows 7: Evolved for the modern enterprise 7/default.aspx Understanding and Configuring User Account Control 76

75 References Windows 7 Windows 7 on Microsoft TechNet (for IT Pros) Windows 7 UAC Microsoft Security Essentials 77