windows vista security rafal lukawiecki, strategic consultant project...

Download Windows Vista Security Rafal Lukawiecki, Strategic Consultant Project Botticelli Ltd This presentation is based on work by

Post on 23-Dec-2015




0 download

Embed Size (px)


  • Slide 1
  • Windows Vista Security Rafal Lukawiecki, Strategic Consultant Project Botticelli Ltd This presentation is based on work by Microsoft TechNet, MSDN and various Microsoft authors including, with special thanks: Ramprabhu Rathnam, Tony Northrup, and Austin Wilson Copyright 2006 Microsoft Corp & Project Botticelli Ltd. E&OE. For informational purposes only. No warranties of any kind are made and you have to verify all information before relying on it. You can re-use this presentation as long as you read, agree, and follow the guidelines described in the Comments field in File/Properties.
  • Slide 2
  • Objectives Overview new security features of Windows Vista explaining their purpose Relate Vista to emergent security technologies Excite you about the new opportunities
  • Slide 3
  • Session Agenda Introduction A Corporate Scenario Foundational Protection Networking User Account Control Authentication & Authorization Integrated Security Control Secure Startup Data Protection Summary
  • Slide 4
  • Engineering Excellence Windows Vista Development Process Microsoft followed their Security Development Lifecycle (SDL) process while creating Windows Vista Periodic mandatory security training Assignment of security advisors for all components Threat modeling as part of design phase Security reviews and testing built into the schedule Security metrics for product teams Common Criteria (CC) Certification compliance is one of major goals (see later) CC is maintained by US National Institute of Standards and Technology (who are also responsible for FIPS)
  • Slide 5
  • A Corporate Scenario
  • Slide 6
  • With Windows Vista 1. While starting up, system is protected through BitLocker and TPM (Trusted Platform Module), preventing off-line modifications 2. NAP (Network Access Protection) ensures computer adheres to your policy (e.g. has required updates, virus signatures etc.) before Longhorn servers allow it to use the network If PC is non-compliant, it will be given a chance to update 3. Multiple types of logon devices and identities can be selected by the user without losing a consistent UI 4. User logs on using non-admin accounts. If admin rights are truly needed users approval is requested. For legacy apps, virtualisation of admin changes is offered. 5. IE improvements help user browse the web with no fear of malware and better privacy protection 6. When updates are available, Restart Manager ensures minimum of disruption, even if running applications are left on a locked workstation Read: evaluate/admin/ evaluate/admin/mngsec.mspx
  • Slide 7
  • Foundational Protection
  • Slide 8
  • Windows Service Hardening Defense-in-Depth: Factoring and Profiling of Windows Kernel DD D Reduce size of high risk layers Segment the services Increase number of layers Kernel Drivers D D User-mode Drivers D DD Service1 Service2 Service3 Service Service ServiceA ServiceB
  • Slide 9
  • Windows Service Hardening Windows Services became a large surface attack area due to privileges and being always-on Improvements: SID (per-service Security Identifier) recognised in ACLs (Access Control Lists), so service can protect its resources Firewall policy prohibiting network access by services (subject to ACLs and SIDs) Stripping of unnecessary privileges on per-service basis Moving from LocalSystem to LocalService or NetworkService when possible Use of write-restricted tokens for service processes
  • Slide 10
  • Integrated Windows Defender Integrated detection, cleaning, and real-time blocking of malware: Malware, rootkits, and spyware Targeted at consumers enterprise manageability will be available as a separate product Integrated Microsoft Malicious Software Removal Tool (MSRT) will remove worst worms, bots, and trojans during an upgrade and on a monthly basis
  • Slide 11
  • Windows Live OneCare Optional fee-based service Antivirus Integration with Antispyware (Windows Defender) System tuning Update assurance Backup
  • Slide 12
  • Internet Explorer 7 In addition to building on UAC (see later), IE includes: Protected Mode (planned for Vista Beta 2) that only allows IE to browse with no other rights, even if the user has them, such as to install software Read-only mode, except for Temporary Internet Files when browser is in the Internet Zone of security All cached data cleared with a single click
  • Slide 13
  • Phishing Filter in IE Dynamic Protection Against Fraudulent Websites 3 checks to protect users from phishing scams: 1. Compares web site with local list of known legitimate sites 2. Scans the web site for characteristics common to phishing sites 3. Double checks site with online Microsoft service of reported phishing sites updated several times every hour Two Levels of Warning and Protection in IE7 Security Status Bar Level 1: Warn Suspicious Website Signaled Level 2: Block Confirmed Phishing Site Signaled and Blocked
  • Slide 14
  • Developers: WinFX and WCF WinFX, the new.NET-based set of APIs provides a stronger support for Code Access Security and Evidence Based Security In essence, the improvements of.NET Framework 2.0 Windows Communication Foundation (WCF) introduces a model of abstracted security and full support for WS-* Security Guidelines Formerly known as Indigo
  • Slide 15
  • Networking
  • Slide 16
  • NG TCP/IP Next Generation TCP/IP in Vista and Longhorn A new, fully re-worked replacement of the old TCP/IP stack Dual-stack IPv6 implementation, with now obligatory IPSec IPv6 is more secure than IPv4 by design, esp.: Privacy, tracking, network port scanning, confidentiality and integrity Other network-level security enhancements for both IPv4 and IPv6 Strong Host model Windows Filtering Platform Improved stack-level resistance to all known TCP/IP-based denial of service and other types of network attacks Routing Compartments Auto-configuration and no-restart reconfiguration Read:
  • Slide 17
  • Windows Vista Firewall Both inbound and outbound Authentication and authorization aware Outbound application- aware filtering is now possible Includes IPSec management Of course, policy-based administration Great for Peer-to-Peer control
  • Slide 18
  • Network Access Protection NAP is a new technology that has roots in VPN quarantine, but now extends to all network clients, not just remote access Relies on NAP-aware servers, which means Windows Longhorn Servers for now You specify a policy of: required OS patches, virus signature updates, presence or absence of certain applications, any arbitrary checks and the system disallows all access to network if policy has not been met, except: access to a location where updates etc. can be downloaded
  • Slide 19
  • Network Access Protection 1 RestrictedNetwork MicrosoftNetwork Policy Server 3 Policy Servers e.g. Microsoft Security Center, SMS, Antigen or 3 rd party Policy compliant DHCP, VPN Switch/Router 2 Windows Vista Client Fix Up Servers e.g. WSUS, SMS & 3 rd party Corporate Network 5 Not policy compliant 4
  • Slide 20
  • User Account Control
  • Slide 21
  • Helps implement Least Privilege principle in two distinct ways: 1. Every user is a standard user Older, legacy, or just greedy applications attempts to change your systems settings will be virtualised so they do not break anything 2. Each genuine need to use administrative privileges will require: Selection of a user who has those permissions, or Confirmation of the intent to carry on with the operation Read:
  • Slide 22
  • Credential Prompting
  • Slide 23
  • Consent Prompting Applies in a situation when the user has all the necessary rights, but before they have been exercised A new, secondary protection
  • Slide 24
  • UAC: Fundamental Change to Windows Operation Fixes the system to work well as a standard user Registry and file virtualization to provide compatibility Per-machine registry writes are redirected to per-user locations if the user does not have administrative privileges Effectively: standard accounts can run admin- required legacy applications safely! You can redirect the virtualization store
  • Slide 25
  • Authentication & Authorization
  • Slide 26
  • Windows Logon Experience GINA has been replaced with Credential Service Provider interfaces Logon UI can interact with multiple plug-in Credential Providers Direct support for multi-factor authentication: smartcards and tokens, biometrics etc. Plug-and-play for smartcards Common CSPs (Cryptographic Service Providers), and Card Communication Modules Key Storage Providers Root certificate propagation Integrated smartcard unblocking
  • Slide 27
  • "InfoCard" Consistent user experience Helps eliminate unames and passwords Helps protect users from many forms of phishing & phraud attack Support for two- factor authentication EasierSafer Built on WS-* Web Services Protocols
  • Slide 28


View more >