Mastering Windows Security and Hardening E-Book

Mark Dunkerley

• Herausgeber: Packt Publishing
• Kategorie: Fachliteratur
• Sprache: Englisch

Seitenzahl: 604

Veröffentlichungsjahr: 2020

Beschreibung

Are you looking for effective ways to protect Windows-based systems from being compromised by unauthorized users?
Mastering Windows Security and Hardening is a detailed guide that helps you gain expertise when implementing efficient security measures and creating robust defense solutions.
We will begin with an introduction to Windows security fundamentals, baselining, and the importance of building a baseline for an organization. As you advance, you will learn how to effectively secure and harden your Windows-based system, protect identities, and even manage access. In the concluding chapters, the book will take you through testing, monitoring, and security operations. In addition to this, you’ll be equipped with the tools you need to ensure compliance and continuous monitoring through security operations.
By the end of this book, you’ll have developed a full understanding of the processes and tools involved in securing and hardening your Windows environment.

Leseprobe

Mastering Windows Security and Hardening

Secure and protect your Windows environment from intruders, malware attacks, and other cyber threats

Mark Dunkerley

Matt Tumbarello

BIRMINGHAM—MUMBAI

Mastering Windows Security and Hardening

Copyright © 2020 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author(s), nor Packt Publishing or its dealers and distributors, will be held liable for any damages caused or alleged to have been caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

Commissioning Editor: Vijin Boricha

Acquisition Editor: Meeta Rajani

Senior Editor: Richard Brookes-Bland

Content Development Editor: Ronn Kurien

Technical Editor: Sarvesh Jaywant

Copy Editor: Safis Editing

Project Coordinator: Neil Dmello

Proofreader: Safis Editing

Indexer: Tejal Daruwale Soni

Production Designer: Jyoti Chauhan

First published: July 2020

Production reference: 1070720

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham

B3 2PB, UK.

ISBN 978-1-83921-641-1

www.packt.com

Packt.com

Subscribe to our online digital library for full access to over 7,000 books and videos, as well as industry leading tools to help you plan your personal development and advance your career. For more information, please visit our website.

Why subscribe?

Spend less time learning and more time coding with practical eBooks and Videos from over 4,000 industry professionalsImprove your learning with Skill Plans built especially for youGet a free eBook or video every monthFully searchable for easy access to vital informationCopy and paste, print, and bookmark content

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at packt.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at [email protected] for more details.

At www.packt.com, you can also read a collection of free technical articles, sign up for a range of free newsletters, and receive exclusive discounts and offers on Packt books and eBooks.

Contributors

About the authors

Mark Dunkerley is a highly motivated and passionate technology leader. Mark was born in Newcastle Upon Tyne, UK, and resides in Orlando, Florida. He holds a bachelor's degree in business administration and a master's degree in business administration. He has worked in the technology field for 20 years and has experience in several technical areas. He has earned certifications from (ISC)², AirWatch, Microsoft, CompTIA, VMware, AXELOS, Cisco, and EMC. Mark has been invited to speak at multiple conferences, including Microsoft and VMware events, is the author of Learning AirWatch published by Packt Publishing, and has published a number of case studies.

Matt Tumbarello is a resident of Atlanta, Georgia, and a passionate solutions architect. He has been in the technology field for 15 years and has experience in working with products from Microsoft, VMware, Dell, and Citrix. He also has a background of working directly with Fortune 500 executives in a technical enablement role. Matthew was recently invited to Redmond and participates in Microsoft's Customer Connection program. He has published reviews for Azure security products, privileged access management tools, and mobile threat defense solutions. He also holds several Microsoft certifications.

About the reviewer

Steve Hardee is an information security professional with over 15 years of experience in IT, currently leading a security team at one of the largest healthcare systems in the nation. Steve has broad knowledge of securing enterprises through incident response, penetration testing, threat hunting, table-top exercises, enterprise architecture, and IT operations. He holds a degree in cyber security and has received extensive training and certifications through SANS, Microsoft, EC-Council, and ISC2. He is a technology board member at Full Sail University, is a staff member of a local security conference, BSides, and has spoken at multiple events as an information security expert.

I would like to thank my partner for her continued support and encouragement with everything that I do. You have always pushed me toward new adventures, accomplishing my goals, and doing what is right. I genuinely appreciate what you have done for us and I love you.

To my parents and brother, who raised me to be who I am today. You are always there for me, you are amazing, and your efforts have not gone unnoticed. I greatly appreciate and love you.

Packt is searching for authors like you

If you're interested in becoming an author for Packt, please visit authors.packtpub.com and apply today. We have worked with thousands of developers and tech professionals, just like you, to help them share their insight with the global tech community. You can make a general application, apply for a specific hot topic that we are recruiting an author for, or submit your own idea.

Table of Contents

Preface

Section 1: Getting Started

Chapter 1: Fundamentals of Windows Security

Understanding the security transformation22

Living in today's digital world24

Today's threats28

Identifying vulnerabilities30

Recognizing breaches34

Current security challenges36

Implementing a Zero Trust approach39

Summary40

Chapter 2: Building a Baseline

Introduction to baselining42

Policies, standards, procedures, and guidelines44

Defining policies44

Setting standards45

Creating procedures46

Recommending guidelines46

Incorporating change management48

Implementing a security framework49

Building baseline controls52

CIS52

Windows security baselines53

Implementing a baseline54

CIS54

Microsoft SCT57

Incorporating best practices59

Summary60

Chapter 3: Server Infrastructure Management

Technical requirements62

Overview of the data center and the cloud62

Types of data center63

Implementing access management in Windows servers68

Physical and user access security68

Privileged Access Management, Just-in-Time Access, and Privileged Identity Management69

Using a tiered model for privileged access 70

Enhanced security administrative environment74

Access management best practices75

Understanding Windows Server management tools76

Introducing Server Manager76

Looking at Event Viewer79

Using Windows Server Update Services 82

Introducing Windows Admin Center84

Using Azure services to manage Windows servers85

The Azure portal and Marketplace86

Implementing role-based access control 87

Azure Resource Manager91

Understanding Azure Backup91

Introducing Azure Update Management94

Leveraging Azure Site Recovery97

Summary99

Chapter 4: End User Device Management

Technical requirements101

Device management evolution103

Device Imaging and Windows Autopilot104

Windows Assessment and Deployment Kit (Windows ADK)110

Windows Configuration Designer111

Microsoft Deployment Toolkit113

Windows Deployment Services115

MDT and Configuration Manager116

Windows Autopilot117

Microsoft Endpoint Configuration Manager119

Securely deploying clients for Configuration Manager120

Client collections, settings, and communications123

Intune Mobile Device Management (MDM)129

Configuration Service Provider129

Mobile Device Management versus Mobile Application Management132

Windows enrollment methods133

Introducing Microsoft Endpoint Manager134

Summary138

Section 2: Applying Security and Hardening

Chapter 5: Hardware and Virtualization

Technical requirements142

Physical servers and virtualization143

Microsoft virtualization144

Hardware security concerns151

Virtualization security concerns153

Cloud hardware and virtualization154

Introduction to hardware certification154

BIOS and UEFI, TPM 2.0, and Secure Boot158

Unified Extensible Firmware Interface159

UEFI Secure Boot160

Trusted Platform Module (TPM 2.0)162

Advanced protection with VBS164

Credential Guard166

Device Guard171

Windows Defender Application Guard175

Hypervisor-Protected Code Integrity177

Windows Defender System Guard180

Hardware security recommendations and best practices182

Summary182

Chapter 6: Network Fundamentals for Hardening Windows

Technical requirements186

Network security fundamentals187

Understanding Windows Network Security191

Network baselining192

Windows 10193

Windows Server198

Networking and Hyper-V201

Network troubleshooting202

Windows Defender Firewall and Advanced Security202

Configuring a firewall rule with Group Policy204

Windows Defender Exploit Guard Network Protection207

Introducing Azure network security 211

Network Security Groups (NSGs)211

Summary218

Chapter 7: Identity and Access Management

Technical requirements220

Identity and access management overview221

Identity221

Authentication222

Authorization223

Accountability223

Implementing account and access management225

HR and identity management226

Integrating directory services227

Using local administrative accounts231

Managing Azure external user access (B2B)233

Understanding the Azure cloud administrative roles236

Implementing PAM security tools (PAM, PIM, and JIT)240

Using Azure RBAC245

Understanding authentication, MFA, and going passwordless246

Securing your passwords247

Introducing SSPR250

Using Azure AD Seamless SSO254

Configuring Azure SSO257

Configuring MFA258

Introducing Windows Hello262

Understanding going passwordless262

Using Conditional Access and Identity Protection264

Summary269

Chapter 8: Administration and Remote Management

Technical requirements272

Understanding device administration273

Differences between domain join, hybrid, and Azure AD joined devices273

Enforcing policies with MDM275

Creating compliance settings with Configuration Manager275

Creating Policies with Intune286

Building security baselines295

Using the Microsoft Security Compliance Toolkit295

Creating a Configuration Baseline from a GPO301

Connecting securely to servers remotely306

Remote management and support tools306

Using Azure Security Center Just-in-Time access307

Connecting with Azure Bastion311

Introducing PowerShell security313

Configuring PowerShell logging314

Using PowerShell Constrained Language Mode315

Enabling script execution316

Summary317

Chapter 9: Keeping Your Windows Client Secure

Technical requirements320

Securing your Windows clients320

Introducing Windows Update for Business321

Configuring Windows updates in Intune323

Advanced Windows hardening configurations327

Enabling Windows Hello for Business328

Managing BitLocker encryption331

Configuring Windows Defender AV334

Enabling Microsoft Defender SmartScreen336

Preventing name resolution poisoning338

Disabling the Web Proxy Autodiscovery Protocol (WPAD)352

Configuring Office security baselines354

Hardening Google Chrome360

Preventing user access to the registry363

Windows Defender Application Control364

Windows 10 privacy366

Controlling the privacy settings for each app367

Additional privacy settings368

Privacy settings for Microsoft Edge372

Summary374

Chapter 10: Keeping Your Windows Server Secure

Technical requirements376

Windows Server versions377

Installing Windows Server roles and features378

Reducing the Windows Server footprint379

Installing Nano Server 2019379

Configuring Windows updates381

Implementing Windows Server Update Services (WSUS)381

Deploying Azure Update Management387

Connecting to Microsoft Defender ATP392

Onboarding with Group Policy393

Onboarding with Configuration Manager 397

Hardening Windows Server 400

Implementing a security baseline400

Using Azure Disk Encryption409

Deploying Windows Defender Application Control415

Summary422

Section 3: Protecting, Detecting, and Responding for Windows Environments

Chapter 11: Security Monitoring and Reporting

Technical requirements426

Monitoring with MDATP426

Investigating an alert427

Onboarding workstations to the MDATP service 433

Enabling the Microsoft Intune connection435

Creating a machine risk compliance policy436

Enabling advanced features439

Deploying Log Analytics439

Installing gallery solutions441

Monitoring with Azure Monitor and activity logs448

Secure access to Azure Monitor449

Monitoring Azure activity logs449

Configuring ASC451

Creating performance baselines455

Summary458

Chapter 12: Security Operations

Technical requirements460

Introducing the SOC461

Using the M365 security portal462

Understanding Microsoft Secure Score464

Classifying your data467

Using MCAS469

Reviewing the activity log471

Looking at a user’s activity473

Configuring Azure ATP476

Planning for Azure ATP477

Activating your instance478

Understanding the kill chain478

Looking at alerts480

Investigating threats with Azure Security Center 486

Introducing Azure Sentinel488

Creating the connection489

Microsoft Defender Security Center492

Assigning permissions and machine groups492

Reviewing the alerts queue496

Automated Investigations498

Planning for business continuity and DR504

Summary507

Chapter 13: Testing and Auditing

Technical requirements510

Validating controls511

Vulnerability scanning517

Preparing for a vulnerability scan517

Planning for penetration testing520

Executing a penetration test523

Reviewing the findings525

Security awareness and training526

Summary529

Chapter 14: Top 10 Recommendations and the Future

The 10 most important to-dos532

Implementing identity protection and privileged access532

Enact a Zero Trust access model534

Define a security framework534

Get current and stay current535

Make use of modern management tools535

Certify your physical hardware devices536

Administer network security536

Always encrypt your devices536

Enable endpoint protection537

Deploy security monitoring solutions537

Other important items537

The future of device security and management540

Security and the future544

Summary546

Other Books You May Enjoy

Leave a review - let other readers know what you think548

Preface

Throughout this book, you will be provided with the knowledge needed to protect your Windows environment and the users that access it. It will cover a variety of topics that go beyond the hardening of just the operating system, including the management of devices, baselining, hardware, virtualization, networking, identity management, security operations, monitoring, auditing, and testing. The goal is to ensure that you understand the foundation of and multiple layers involved in providing improved protection for your Windows systems.

Since this is a book about security, it's important to understand what the core principles are that form an information security model and foundation. These principles are known as the CIA triad, which represents confidentiality, integrity, and availability. If you have pursued a security certification, such as the CISSP or Security +, certification for example, you will be very familiar with this model. If not, it is recommended that you familiarize yourself with it as a security professional. This book will not go into detail about the CIA triad but, as with any security, the concepts provided in this book will help you to ensure the confidentiality, integrity, and availability of information on the Windows systems you manage. At a high level, CIA represents the following:

Confidentiality involves ensuring that no one other than those authorized access information.Integrity involves ensuring that the information being protected is original and has not been modified without the correct authorization.Availability involves ensuring that information is always available when access is needed.

The book is split into three sections to help guide you and provide the understanding and knowledge needed to implement a solid Windows security foundation within your organization. The first section provides an overview of the fundamentals, including an overview of the management tools for the Windows server and client environment, and a review of the management models used to manage Windows systems and the importance of each of them. This section will also cover the concept of baselining and the importance of following a standard with defined procedures and processes that have leadership support and sign-off.

In the second section, we will dive into the technical aspects of what is needed to apply security and hardening to your Windows environment. This section will not only provide the technical details of how to harden both the Windows server and client OS, but we will review all the different management scenarios and the importance of administration and remote management from a security standpoint. Most importantly, ensuring secure administration and the remote management of your Windows systems is vital. We will review the networking components as they relate to the hardening of Windows and then provide information about identity and access management and how critical the protection of identity has become in the digital world today.

The final section provides more of an operational focus on how to best protect and monitor your Windows environment. It is critical for your security program to not only implement the recommended security controls but validate that controls are in place. To do this effectively, we need to perform auditing and testing against the configurations implemented to harden Windows environments. In addition, it's just as important to monitor environments and provide reporting. We will look at an in-depth overview of the security operations program and discuss the tools that can be used for efficient incident management.

We will primarily focus on the most current versions of Windows available today, including Windows Server 2019, Windows 10, and the resources available within Microsoft Azure. We understand migrating to the latest Windows OS and shifting workloads from on-premises to the cloud is not an overnight task and may take years. In general, the concepts we provide throughout this book can be used within most configurations of Windows but could vary slightly depending on the build or version. Upgrading to the latest version of Windows is critical to the overall hardening of your systems and should be a driving factor to push your migrations forward. It is strongly recommended to upgrade as soon as possible as Microsoft will no longer release security patches or offer support for deprecated versions.

Who this book is for

This book is intended to educate the technical and security community, which includes the following roles:

Microsoft security, cloud, and technical roles such as engineers, analysts, architects, and administratorsAnyone involved with the management of a Windows environmentAll technical related security rolesTechnical/security managers and directors

What this book covers

Chapter 1, Fundamentals of Windows Security, provides an introduction to the security world within IT and enterprises. We will cover how security is transforming the way we manage technology and discuss threats and breaches that are relevant today. We will look at current challenges and discuss a concept known as zero trust.

Chapter 2, Building a Baseline, provides an overview of baselining and the importance of building a standard to be approved by leadership and adopted by everyone. We will cover what frameworks are and provide an overview of the more common frameworks for security and hardening an environment. We will then look at best practices within enterprises and cover the importance of change management to ensure that anything that falls outside the scope of policy receives the correct approvals.

Chapter 3, Server Infrastructure Management, provides an overview of the data center and cloud models that are used today. We will then go into detail on each of the current models as they pertain to the cloud and review secure access management to Windows Server. We will also provide an overview of Windows Server management tools, as well as Azure services for managing Windows servers.

Chapter 4, End User Device Management, provides an overview of the end user computing landscape. We will discuss the evolution of device management and review some major models that have emerged over the years. You will learn the importance of a centralized management solution as it pertains to security and how device management solutions are critical for a robust and compliant model. The management solutions covered include device imaging, Windows Autopilot, Microsoft Endpoint Configuration Manager (formerly SCCM), Intune Mobile Device Management (MDM), and Microsoft Endpoint Manager Admin Center.

Chapter 5, Hardware and Virtualization, provides an overview of physical servers and virtualization. The chapter will cover hardware certification, enhancements in hardware security, and Virtualization-Based Security (VBS) concepts to secure and harden devices, including BIOS, UEFI, TPM 2.0, Secure Boot, and advanced protection with VBS.

Chapter 6, Network Fundamentals for Hardening Windows, provides an overview of networking components and how they play a big role in hardening and securing your Windows environment. You will learn about Windows Defender Firewall and Advanced Security, Windows Defender Exploit Guard Network Protection, and how to configure them on your Windows devices. Additionally, you will be provided with the knowledge needed to understand the latest technology from Microsoft as it relates to network security for your Windows VMs in Azure.

Chapter 7, Identity and Access Management, provides a comprehensive overview of identity management and the importance it plays in securing and hardening your Windows systems. Identity has become the foundation of securing users – this chapter will cover everything you need to do within the identity and access management area. We will provide more details on account and access management, authentication, MFA, passwordless authentication, conditional access, and identity protection.

Chapter 8, Administration and Remote Management, provides details on different methods for administration and remote management as they relate to the Windows infrastructure. You will be provided with the knowledge needed to ensure that best practices are applied and will learn how to apply those best practices. The topics covered include enforcing policies with Configuration Manager and Intune, building security baselines, connecting securely to servers remotely, and an overview of PowerShell security.

Chapter 9, Keeping Your Windows Client Secure, covers Windows clients and the different solutions used to keep them secure and updated. You will also learn hardening techniques to secure exploits commonly used by attackers. The chapter also covers onboarding machines to Microsoft Defender ATP and Windows Update for Business, and provides details on advanced Windows hardening configurations for Windows 10 privacy.

Chapter 10, Keeping Your Windows Server Secure, looks at the Windows Server OS and introduces server roles and the security-related features of Windows Server 2019. You will learn about techniques used to keep your Windows server secure by implementing Windows Server Update Services (WSUS) and Azure Update Management, onboarding machines to Microsoft Defender ATP, and enforcing a security baseline. You will also learn how to deploy a Windows Defender application control policy.

Chapter 11, Security Monitoring and Reporting, talks about the different tools available that provide telemetry as well as insights and recommendations to help secure your environment. This chapter will inform you about the ways to act on recommendations to help secure your environment. Technologies covered include Microsoft Defender ATP, Log Analytics, Azure Monitor, and Azure Security Center.

Chapter 12, Security Operations, talks about the Security Operations Center (SOC) in an organization and discusses various tools used to ingest and analyze data to detect, protect, and alert you to incidents.

Chapter 13, Testing and Auditing, goes through validating that controls are in place and enforced. You will also learn about the importance of continual vulnerability scanning and testing in addition to the importance of penetration testing to ensure that the environment is assessed in terms of its ability to protect against the latest threats.

Chapter 14, Top 10 Recommendations and the Future, provides recommendations and actions to take away after reading this book. It also provides some insight into the direction of where the future of device security and management is headed, as well as some insight into our thoughts on the importance of security in the future.

To get the most out of this book

In order to get the most out of this book, the following items will be needed to follow along with the examples provided. Thanks to cloud technology, you will be able to quickly enable an environment to build the infrastructure and foundation needed to support your journey throughout this book.

It is recommended that you set up an Office 365 subscription (add your own custom domain), which will in turn create an Azure Active Directory (AAD) tenant. Once the AAD tenant has been set up, this will allow you to add an Azure subscription to begin consuming Azure resources tied to your Office 365 subscription and your custom domains.

Office 365 E5 30-day free trial: https://go.microsoft.com/fwlink/p/?LinkID=698279&culture=en-US&country=US

Azure account with $200 credit for 30 days: https://azure.microsoft.com/en-us/free/

Cloud subscriptions required

An Azure subscriptionMicrosoft Enterprise E5An Intune subscription and licenseMicrosoft Defender ATP licensing (Windows 10 E5 or M365 E5)Enterprise Mobility + Security E3 or E5 (includes AAD Premium P2)

Permissions

Global administrator rights to your Office 365 subscriptionOwner role or appropriate RBAC to your Azure subscription to deploy resourcesDomain admin rights on your domain controller or equivalent rights to modify Group Policy

Azure resources

Azure VMs (Windows 10 and Windows Server 2019 Core and Desktop versions from Marketplace)A virtual network, subnet, network security group, and resource group AADAzure Security Center StandardAzure SentinelAzure BastionMicrosoft Cloud App SecurityA Log Analytics workspaceAn Azure Automation accountAzure Update ManagementAzure Privileged Identity Management

Applications, tools, and services

PowerShell (version 5.1 recommended) with the AAD module and the Azure PowerShell Az moduleText viewer to edit and open JSON filesWindows Assessment and Deployment KitWindows Deployment Services (Windows Server roles and features)Microsoft Deployment ToolkitSystem Center (Configuration Manager) hierarchyWindows 2016 Active Directory and domain functional levelMicrosoft Security Compliance ToolkitWSUSWindows 10 Pro/Enterprise, Windows Server 2016+ Core/Datacenter

All licensing and pricing is subject to change by Microsoft. Additionally, many of the products that are mentioned are covered under a license bundle, or available à la carte if you only want to enable a small subset of features.

For information about licensing Microsoft 365, visit this link:

http://download.microsoft.com/download/8/7/7/877B1713-671E-43AA-BB79-AF8478C64AFF/Licensing-Microsoft-365.pdf

To compare the different products available in the Microsoft 365 plans, visit this link:

https://www.microsoft.com/en-us/microsoft-365/compare-microsoft-365-enterprise-plans

For AAD pricing and features, visit this link:

https://azure.microsoft.com/en-us/pricing/details/active-directory/

If you are using the digital version of this book, we advise you to type the code yourself. Doing so will help you avoid any potential errors related to the copying and pasting of code.

Code in Action

Code in Action videos for this book can be viewed at (https://bit.ly/2VEPO3t).

Download the color images

We also provide a PDF file that has color images of the screenshots/diagrams used in this book. You can download it here: http://www.packtpub.com/sites/default/files/downloads/9781839216411_ColorImages.pdf.

Conventions used

There are a number of text conventions used throughout this book.

Code in text: Indicates code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles. Here is an example: "Mount the downloaded WebStorm-10*.dmg disk image file as another disk in your system."

A block of code is set as follows:

html, body, #map {

height: 100%;

margin: 0;

padding: 0

}

When we wish to draw your attention to a particular part of a code block, the relevant lines or items are set in bold:

[default]

exten => s,1,Dial(Zap/1|30)

exten => s,2,Voicemail(u100)

exten => s,102,Voicemail(b100)

exten => i,1,Voicemail(s0)

Any command-line input or output is written as follows:

$ mkdir css

$ cd css

Bold: Indicates a new term, an important word, or words that you see onscreen. For example, words in menus or dialog boxes appear in the text like this. Here is an example: "Select System info from the Administration panel."

Tips or important notes

Appear like this.

Get in touch

Feedback from our readers is always welcome.

General feedback: If you have questions about any aspect of this book, mention the book title in the subject of your message and email us at [email protected].

Errata: Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you have found a mistake in this book, we would be grateful if you would report this to us. Please visit www.packtpub.com/support/errata, selecting your book, clicking on the Errata Submission Form link, and entering the details.

Piracy: If you come across any illegal copies of our works in any form on the Internet, we would be grateful if you would provide us with the location address or website name. Please contact us at [email protected] with a link to the material.

If you are interested in becoming an author: If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, please visit authors.packtpub.com.

Reviews

Please leave a review. Once you have read and used this book, why not leave a review on the site that you purchased it from? Potential readers can then see and use your unbiased opinion to make purchase decisions, we at Packt can understand what you think about our products, and our authors can see your feedback on their book. Thank you!

For more information about Packt, please visit packt.com.

Section 1: Getting Started

This section will provide you with an overview of security fundamentals and the importance of building a baseline. It will also provide information on infrastructure models, and talk about end user computing evolutions and the solutions we can use to manage them.

This section includes the following chapters:

Chapter 1, Fundamentals of Windows SecurityChapter 2, Building a BaselineChapter 3, Server Infrastructure ManagementChapter 4, End User Device Management

Chapter 1: Fundamentals of Windows Security

Nowadays, the conversation of cybersecurity has become a hot topic throughout the world. And even more so with leadership teams and board members of many major organizations asking the question, are we secure? The short answer is no: no one is secure in today's digital world, and there has never been a more critical time to ensure that you are doing everything within your power to protect your organization and its users.

As we continue to receive daily news of breaches throughout the world, it is clear how severe the issue of cybercrime has become. To put it bluntly, we simply need to do a better job of protecting the data that we collect and manage within our organizations today. This isn't an easy task, especially with the advancement of organized cyber and state-sponsored groups with budgets, most likely, far exceeding that of most organizations. As security professionals, we need to do our due diligence and ensure we identify all risks within the organization. Once identified, they will need to be addressed or accepted as a risk by leadership.

As a consumer, it is most likely that your data has already been breached, and there's a chance your account information and passwords are sitting on the dark web somewhere. We need to work with the assumption that our personal data has already been breached and build better barriers around our data and account information. For example, in the U.S., purchasing identity protection as a service to monitor your identity can serve as an insurance policy if you incur any damages. In addition to this, the ability to place your credit reports on hold to prevent bad actors from opening accounts under your name is another example of a defensive approach that you can take to protect your personal identity.

As the cybersecurity workforce continues to evolve and strengthen with more and more talented individuals, we want to help contribute to the importance of securing our data, and we hope this book provides you with the necessary knowledge to do the right thing for your organization. As you read this book, you will not only learn the technical aspects of securing Windows, but you will also learn what else is necessary to ensure the protection of Windows and the users that use it. Protecting Windows has become a lot more than making a few simple configuration changes and installing an antivirus (AV) tool. There is an entire ecosystem of controls, tools, and technology to help protect your Windows systems and users.

As you read through this chapter, you will learn about the broader fundamentals of security and the principles behind the foundation that is needed to protect your Windows environment. Specifically, you will learn about the following:

An overview of the security transformation within the industryA look at security trends as they relate to today's digital world A review of the current threat landscape and common vulnerabilitiesAn overview of some recent publicly known breachesAn overview of the current security challenges faced todayWhat Zero Trust security is, and why we need to adopt this approach moving forward

Understanding the security transformation

Over the years, security has evolved from being just a shared role or a role that didn't even exist within a business. Today, well-defined teams and organizational structures do actually exist or are being created to focus solely on security. Not only are these teams maturing constantly, but the Chief Information Security Officer (CISO) has become a person of significant importance who may report directly to a Chief Executive Officer (CEO) within an organization and not the CIO.

Over the years, many roles that never existed before have begun to appear within the security world, and new skill sets are always in demand. As an overview, the following is a list of some of the more common security roles that you can expect to see within a security program: 

CISO/CSO (Chief Information Security Officer/Chief Security Officer)IT Security DirectorIT Security ManagerSecurity Architect/EngineerSecurity AnalystSecurity/Compliance OfficerSecurity AdministratorSecurity EngineerSoftware/Application Security DeveloperSoftware/Application Security EngineerCryptographer/CryptologistSecurity Consultant/SpecialistNetwork Security EngineerCloud Security Architect

One thing to point out, in regard to these roles, is the major shortage of the cybersecurity workforce throughout the world. A cybersecurity workforce study by (ISC)² shows that a worldwide growth of 145% is needed to meet the demand for cyber experts. In the US, this number needs to grow by 62%. These numbers clearly show the demand for skilled cybersecurity experts along with opportunities for growth. The challenge with this growth is that new positions are continuously being created as new skills are needed, which makes it difficult to find well-seasoned talent (read more about the (ISC)² 2019 Cybersecurity Workforce Study here: https://www.isc2.org/Research/Workforce-Study).

One of the primary factors for the growing need of security experts correlates to the advancement of the PC (or personal computer) and its evolution throughout the years. The PC has changed the way we connect. And, with this evolution comes the supporting infrastructure, which has evolved into many data centers seen throughout the world.

As we are all aware, Windows has been the victim of numerous vulnerabilities over the years and continues to be a victim even today. The initial idea behind the Windows Operating System (OS) was a strong focus on usability and productivity. As a result of its success and adoption across the globe, it became a common target for exploits. This, in turn, created many gaps in the security of Windows that have traditionally been filled by many other companies. A good example is a need for third-party AV software. As the world has turned more toward digitization over the years, and the adoption of Windows usage has continued to grow, so has the need for improved security along with dedicated roles within this area. Protecting Windows has not been an easy task, and it continues to be an ongoing challenge.

Living in today's digital world

Today, we are more reliant on technology than ever and live in a world where businesses cannot survive without it. As our younger generations grow up, there is greater demand for the use of advanced technology. One scary thought is how fast the world has grown within the previous 100 years compared to the overall history of mankind. Technology continues to push the boundaries of innovation, and a significant portion of that change must include the securing of this technology. Especially since the world has become a more connected place with the advancement of the internet.

To give you a rough idea of technology usage today, let's take a look at the current desktop usage throughout the world. For these statistics, we will reference an online service, called Statcounter GlobalStats: https://gs.statcounter.com/. This dataset is not all-inclusive, but there is a very large sampling of data used to give us a good idea of worldwide usage. Statcounter GlobalStats collects its data through web analytics via tracking code on over 2 million websites globally. The aggregation of this data equates to more than 10 billion page views per month. The following screenshot shows the OS market share that is in use worldwide. More information from Statcounter can be viewed at https://gs.statcounter.com/os-market-share/desktop/worldwide:

Figure 1.1 – Statcounter Desktop Operating System Market Share Worldwide

As you can see, the Windows desktop market is more widely adopted than any other OS available today. Seemingly, Windows has always had negative connotations because of its ongoing vulnerabilities in comparison to other OSes. Part of this is due to how widely used Windows actually is. A hacker isn't going to waste their time on an OS that isn't widely adopted. We can assume there would be a direct correlation between OS adoption rates and available security vulnerabilities. Additionally, the Windows OS is supported across many types of hardware, which opens up opportunities for exploits to be developed. One reason as to why we see significantly fewer macOS vulnerabilities is due to the hardware control with which Apple allows its software to run. As the platform has grown, though, we have seen an increase of vulnerabilities within its OS too. The point we're making is that we tend to focus our efforts on areas where it makes sense, and Windows has continued to be a leader in the desktop space, making it a very attractive source to be attacked. This, in turn, has created an ecosystem of vendors and products over the years, all aimed at helping to protect and secure Windows' systems.

Let's take a look at the current adoption of the different Windows OSes in use. The following screenshot from Statcounter shows the current Windows desktop version usage around the world today. To view these statistics, visit https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide:

Figure 1.2 – Desktop Windows Version Market Share Worldwide

As you can see, Windows 10 has become the most adopted OS. Microsoft continues to push more users and organizations to Windows 10, and this is where they spend the majority of their development resources. There are also major changes to Windows 10 compared to older versions, which is why it is critical to migrate from older versions, especially for security-specific reasons. Microsoft ended its support (including security updates) for Windows XP in April 2014 and Windows 7 in January 2020.

NetMarketShare is another analytical site similar to Statcounter GlobalStats with its own set of statistics for reference: https://netmarketshare.com/.

A recent buzz term you have most likely heard in recent years is that of digital transformation. This refers to the shift from a legacy on-premises infrastructure to a modernized cloud-first strategy to support the evolving need of big data, machine learning, Artificial Intelligence (AI), and more. A significant part of this shift also falls within Windows systems and management. In Chapter 3, Server Infrastructure Management, we will look at the differences between a data center and a cloud model, including where the responsibilities fall for maintaining and securing underlying systems. Prior to digital transformation, we relied heavily on the four walls of the corporation and its network to protect a data center and its systems. This included a requirement for client devices to be physically on the corporate network in order to access data and services. With this model, our devices were a little easier to manage and lock down, as they never left the corporate office. Today, the dynamics have changed, and, referencing back to Statcounter in the following screenshot, you can see a significant shift from traditional desktop usage to a more mobile experience and requirement. To view the source of this diagram, visit https://gs.statcounter.com/platform-market-share/desktop-mobile-tablet/worldwide/#monthly-200901-202003:

Figure 1.3 – Statcounter platform comparison Jan 2009 – Mar 2020

Focusing on Windows security, the traditional model of an organization would have typically included the following security tools as part of its baseline:

AV (antivirus software)Windows FirewallInternet proxy serviceWindows updates

Depending on your organization or industry, there may have been additional tools. However, for the most part, I'd imagine the preceding list was the extent of most organizations' security tools on Windows client devices. The same would have most likely applied to the Windows servers in the traditional model. As this digital transformation has brought change, the traditional method of Windows management has become a legacy. There is an expectation that we can work and access data from anywhere at any time. We live in an internet-connected world, and, when we plug our device in, we expect to access our data with ease. With this shift, there is a major change in the security of the systems we manage and, specifically, the Windows server and client. As we shift our infrastructure to the cloud and enable our users to become less restricted, the focus of security revolves not only around the device itself but that of the user's identity and, more importantly, the data. Today, the items that we listed earlier will not suffice. The following tools are those that would be needed to better protect your Windows devices:

Advanced Threat Protection (ATP): AV and threat protection, advanced analytics and behavioral monitoring, network protection, exploit protection, and moreAdvanced data loss preventionInformation protectionIdentity protection: biometric technology, multi-factor authentication, and moreApplication controlMachine learning and advanced AI security services

Today's threats

The threat landscape within the cyber world is extremely diverse and is continually becoming more complex. The task of protecting users, data, and systems is becoming more difficult and requires the advancement of even more intelligent tools to keep the bad actors out. Today, criminals are more sophisticated, and large groups have formed with significant financial backing to support the wrongdoings of these groups. The following is a list of cyber threats:

National governmentsNationstates TerroristsSpiesOrganized crime groupsHacktivistsHackersBusiness competitorsInsiders/internal employees

Tip

To learn more about these cyber threat sources, the Department of Homeland Security has a great reference here: https://www.us-cert.gov/ics/content/cyber-threat-source-descriptions.

To shed some light on real-world examples of data breach sources today, Verizon has created a 2020 Data Breach Investigations Report (https://enterprise.verizon.com/resources/reports/dbir/). The report is built on a set of real-world data and contains some eye-opening data on attack sources:

External actors: 70%Organized criminal groups: 55%Internal actors: 30%Partners: 1%Multiple parties involved: 1%

The full report can be found here:

https://enterprise.verizon.com/resources/reports/2020-data-breach-investigations-report.pdf

There are many types of cyberattacks in the world today, and this creates a diverse set of challenges for organizations. While not all threats are Windows-specific, there's a chance that Windows is the median or attack vector in which an attacker gains access by exploiting a vulnerability. An example of this could be an unpatched OS or an out-of-date application. The following list contains many common types of threats that could cause damage directly from a vulnerability within the Windows OS or by using the Windows OS as an attack vector.

Malware is software or code designed with malicious intent that exploits vulnerabilities found within the system. The following types of threats are considered malware:

AdwareSpywareVirus (polymorphic, multipartite, macro, or boot sector)WormTrojanRootkitBots/botnetsRansomwareLogic bomb

In addition to malware, the following are types of attack techniques that can be used to exploit vulnerabilities:

KeyloggerPhishingSpear phishingWhale phishingSQL injection attackCross-Site Scripting (XSS)Denial of Service (DoS)Session hijackingMan-in-the-Middle Attacks (MITM)Password attacks (brute-force, dictionary, or birthday attacks)Credential reuseIdentity theftAdvanced persistent threatsDistributed Denial of Service (DDoS)Intellectual property theftShoulder surfingGolden Ticket: Kerberos attacks

Tip

To learn more about the threats listed earlier, the National Institute of Standards and Technology (NIST) contains a glossary that provides more information on most, if not all, of the preceding list: https://csrc.nist.gov/glossary.

Identifying vulnerabilities

Now that we know more about the threats, it's even more important for you to know where to access information about these vulnerabilities. You also need to be aware of any resources that are available so that you can educate yourself on what's required to remediate any vulnerabilities. As you are already aware, Windows is renowned for its ongoing vulnerabilities, and patching/updating these systems has morphed into a full-time and very specialized role over the years. The following website is the authoritative source with regard to Microsoft security updates: https://portal.msrc.microsoft.com/en-us/security-guidance.

Useful information

Here is the link to the Microsoft Security Response Center (MSRC): https://www.microsoft.com/en-us/msrc?rtc=1.

As shown in the following screenshot, you will be provided with a list of all identified vulnerabilities from Microsoft within a selected time range with additional filtering options. To give you an idea of the risk profile for Windows, the following filter is scoped to Windows 10 for x64-based systems over the last month, which returned 47 uniquely addressed vulnerabilities:

Figure 1.4 – Microsoft Security Update Guide

One term you may have heard as part of vulnerability management with Microsoft is the famous Patch Tuesday (also referred to as Update Tuesday). Patch Tuesday occurs on the second Tuesday of every month and is the day that Microsoft releases its monthly patches for Windows and other Microsoft products. There are many references on the internet for Patch Tuesday in addition to the MSRC. One example of a common resource used to track Patch Tuesday releases is the Patch Tuesday Dashboard: https://patchtuesdaydashboard.com/. Another example to better manage your notifications when vulnerabilities are released is PatchManagement.org:http://patchmanagement.org/.

As you review the updates needed for your Windows systems, you will notice that each of them has a unique identifier to reference the update beginning with CVE®. CVE stands for Common Vulnerabilities and Exposures and is the standard for vulnerability management, allowing one source to catalog and uniquely identify vulnerabilities. CVE is not a database of vulnerabilities but a dictionary providing definitions for vulnerabilities and exposures that have been publicly disclosed. The U.S. Department of Homeland Security (DHS) and the Cybersecurity and Infrastructure Security Agency (CISA) sponsor the CVE.

Tip

Visit this website to learn more about CVE: https://cve.mitre.org/about/index.html.

The following screenshot shows an overview of what the CVE provides and can be found at https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows:

Figure 1.5 – CVE® Windows Search Results

In addition to the CVE there's the NVD. The NVD is the National Vulnerability Database, which is an additional resource for vulnerability management provided by NIST. The NVD is synced with the CVE to ensure the latest updates appear within its repository. The NVD provides additional analysis of the vulnerabilities listed in the CVE dictionary by using the following:

Common Vulnerability Scoring System (CVSS) for impact analysisCommon Weakness Enumeration (CWE) for vulnerability typesCommon Platform Enumeration (CPE) for a structured naming standard

The following screenshot shows an overview of what the NVD provides and can be found via https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=Windows&search_type=all:

Figure 1.6 – NVD Windows Search Results

One additional resource that we should mention is the Open Web Application Security Project (OWASP). OWASP is a nonprofit organization to help improve the security of software for individuals and enterprises. They provide a tremendous amount of resources such as tools, documentation, and a community of professionals all looking to continually enhance software security. Although application and web-specific, there is a high possibility that the application or web app will be running on both your Windows server and Windows client. Because of this, it is critical, as a security professional, for you to be able to intelligently discuss these concerns and challenges with the business, developer(s), and application/web app owners.

Tip

You can find more information about OWASP at https://www.owasp.org/index.php/Main_Page.

One of the more common projects that OWASP provides is the OWASP Top 10, which provides the most critical web application security risks. The latest version available was published in 2017 and is presented here:

InjectionBroken authenticationSensitive data exposureXML External Entities (XXE)Broken access controlSecurity misconfigurationCross-Site Scripting (XSS)Insecure deserializationUsing components with known vulnerabilitiesInsufficient logging and monitoring

Tip

View OWASP Top 10 2017 – The Ten Most Critical Web Application Security Risks here: https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/.

Recognizing breaches

If you follow the news, you are probably aware that there is no shortage of breaches today. They are happening so frequently that it is not uncommon for several breaches to occur weekly or even daily. What is an even scarier thought is these are just the ones that we hear about. To give you an idea of how serious the issue has become, the following list has some of the more notable breaches that are documented on Wikipedia's List of data breaches page. There are many sources on the internet of top breaches, but Wikipedia has the most comprehensive I have found with references to each of the listings:

Figure 1.7 – Wikipedia List of data breaches

You can find the source for the preceding screenshot here: https://en.wikipedia.org/wiki/List_of_data_breaches.

As you review the breaches and understand how they occurred, you will see a common trend where, for the most part, the breach occurred from hacking or poor security practices. You might also notice that other common methods of breaches include lost or stolen equipment. These statistics are alarming, and they indicate how critical it is to secure and harden our systems as best as possible.

To give you an idea of the importance of securing and hardening your environment, the article referenced next shows that the cost of a user record from a data breach is $242 per record. A quick calculation of this multiplied by 100,000 customers calculates a potential loss estimated at $24.2 million. When you look at the number of breached records shown in the table, you will understand how this could be extremely damaging to a business's value and reputation.

View the table at What's the Real Cost of a Data Breach? here: https://www.pkware.com/blog/what-s-the-real-cost-of-a-data-breach.

Tip

An interesting site for reference is Have I Been Pwned. This site will show you whether your email has ever been breached and, if so, where it was breached: https://haveibeenpwned.com/. You can also sign up for notifications for any breaches related to a specific domain.

There are many sources available where you can view security news and follow the latest trends and best practices. The following are some of the resources used to keep up to date with what is happening in the security world today:

DarkReading: https://www.darkreading.com/Cyware: https://cyware.com/cyber-security-news-articles (recommended phone app)Business Insider: https://www.businessinsider.com/saiZDNet: https://www.zdnet.com/topic/security/Newsfusion Cyber Security News: https://www.newsfusion.com/cyber-security (recommended phone app)BBC: https://www.bbc.com/news/technologyThe Hacker News: https://thehackernews.com/

Current security challenges

By the time you finish reading through the chapter, you will have hopefully been provided with a sense of how important security has become today and the challenges that come with it. We are continually becoming more reliant on technology than ever before with no signs of slowing down. We have an expectancy of everything being digitized, and, as IoT begins to take off, everything around us will be connected to the internet, thus creating even more challenges to ensure security is efficient.

As we briefly covered earlier, attacks are becoming more and more sophisticated every day. There is an ever-growing army of bad actors working around the clock trying to breach any data they can get their hands on because the cost of private data is very expensive. With the advancement of cloud technology, supercomputers, and the reality of quantum computing coming to light, hackers and organized groups are easily able to crack passwords and their hashes much more easily, making them obsolete as the only factor of authentication. No one should be using only passwords anymore; however, the reality is, most still are. The same applies to encryption. The advancement of computers is making algorithms insecure with the ongoing need for stronger encryption. These are just some of the ongoing challenges we are faced with when protecting our assets.

Keeping up with vulnerabilities today is a full-time role. It's critical that we keep on top of what they are, and which Windows systems need to be updated. We will discuss the management of Windows updates later in the book, but having a program in place to manage the overwhelming amount of Windows updates is critical. Additionally, third-party applications will need to be carefully monitored and updated accordingly. An example of a commonly used application is Adobe Acrobat Reader DC to view PDFs. The following screenshot is a vulnerability report from Microsoft Defender Security Center. It provides a software inventory of all machines with the application installed and lists the number of vulnerabilities detected across all machines in your organization:

Figure 1.8 – Acrobat Reader DC identified vulnerabilities

As you can see, out-of-date applications have critical known vulnerabilities that are used by attackers.

Most organizations are reluctant to release the latest Windows updates to their servers straight away because of the risk that a patch could break a production system. The downside to this is that your system will have a known vulnerability, which opens an opportunity for it to be exploited between the time of the patch release and the system being patched. Another challenge we are faced with is zero-day vulnerabilities. A zero-day vulnerability is one that has been identified but, currently, has no remediation or mitigation available from the vendor. Because of these challenges, it is critical we build in a layered defense strategy with our Windows clients and servers. For example, never make your database server accessible via the internet, encrypt the traffic to your web servers, and only open the ports needed to communicate, such as only allowing port 443 for secure (HTTPS) traffic only.

As we focus on securing Windows devices within our environments, we can't turn a blind eye to the fundamentals, including the overarching ecosystem that also needs to be considered when protecting your Windows devices. This book will cover a lot of detail on the specifics of securing and hardening your Windows systems and devices, but we also want to ensure the bigger picture is covered; for example, simple concepts of identity and access management. A user whose account has been compromised to allow an intruder on your Windows system has just made all the securing and hardening of that system irrelevant. The concept of weak physical access controls and policies could allow someone to simply walk into a server room and gain physical access to your systems. Other examples are allowing a developer to install an insecure web app with vulnerabilities on it, or a business that develops a process without security best practices in mind. All the controls you put in place with Windows become irrelevant as an educated hacker could use the web app or exploit a process as an attack vector to gain access to your system. These examples show the criticality of not only being familiar with how to secure and harden the Windows OS, but all the other factors that fall within a mature security platform to ensure your environment is as secure as possible. This, of course, doesn't come easily, and it is critical you stay current and continue to learn and learn and learn!

Managing and securing your Windows systems is not a simple task, especially if you are working toward securing them correctly. There is a lot involved, and in order to efficiently and effectively secure your Windows systems, you need well-defined policies, procedures, and standards in place along with a rigorous change control process to ensure anything that falls outside of the standards receives the appropriate approval to minimize risk. Full-time roles exist today to manage and secure your Windows systems along with specialized roles that are necessary to manage your Windows environments. Examples include Windows desktop engineers, Windows server engineers, Windows update administrators, Windows security administrators, Windows Intune/MDM engineers, and others. As part of these roles, it is critical that the staff are continuously educated and trained to provide the best security for Windows. The landscape is changing daily, and if your staff isn't dynamic or doesn't stay educated, mistakes and gaps will occur with your security posture.

Other tasks to think about that must be addressed with your Windows devices are inventory management, that is, ensuring you know where all your devices are and who has access to them. Even more important is ensuring that devices are collected upon any terminations, especially those pertaining to disgruntled employees. Enforcing policies on your Windows devices is also another challenge; for instance, how do you ensure all your devices have the latest policies and how can you ensure accurate reporting on non-compliant devices? Remote management can also be a challenge, that is, to make sure that not just anyone can remotely access your devices, including the auditing of support staff for anything that they shouldn't be doing. Running legacy applications on your Windows devices creates an instant security concern and making sure they are patched to the latest supported version is critical. This list goes on, and we will be diving in much greater detail in the following chapters to help provide the information you need to protect your Windows environment.

Before we move on to the last topic, one additional challenge that needs mentioning is Shadow IT. In short, Shadow IT is the setup and use of servers and infrastructure without IT or the security team's approval or knowledge, for example, a business function. This instantly creates a significant security concern as Windows systems will most likely be used with no standards or hardening in place. This can be a challenge to manage, but it is something that needs to be understood and prevented within any business.

Implementing a Zero Trust approach

To close out the chapter, we wanted to touch on a concept known as Zero Trust. The Zero Trust architecture model was created by John Kindervag while he was at Forrester Research Inc. back in 2010. You may be wondering what exactly Zero Trust is. Essentially, it is a model where we trust no one until we can validate who they are, who they are meant to be, and whether they are authorized to have access to the system or information. Effectively implementing a Zero Trust model is going to require a multilayered approach to the security strategy along with the use of the most current and modern technology available. The method of allowing a user to access the environment with only a username and password is outdated and insecure. With Microsoft's version of a Zero Trust model, they are recommending the use of a strong identity, ensuring devices are enrolled within a management tool, enforcing the concept of least privilege, and verifying the health of both devices and services. To support this model, some of the technologies include Azure Active Directory, multi-factor authentication, biometrics, Conditional Access, Microsoft Intune, and Microsoft Defender ATP. As you read through this book, you will find the guidance and instructions that are provided will ultimately lead to a Zero Trust model.

Tip

You can read more about the Zero Trust Microsoft model here: https://www.microsoft.com/en-us/itshowcase/implementing-a-zero-trust-security-model-at-microsoft.

Summary

In this chapter, we covered, at a high level, what you can expect to read throughout this book. We provided an overview of the security in an enterprise and briefly covered the different roles that you can expect to see within security departments. Next, we looked at how security relates to the digital world and how relevant it's become as the world becomes more digital. We also looked at the usage of the Windows OS throughout the world to better understand the adoption by users.

We then reviewed the current threat landscape and the types of cyber threat sources. We moved on to provide an overview of the threats we typically see in an enterprise today. We then provided details on where you can go to learn and view all of the recent Microsoft vulnerabilities with correlating patches and instructions on how to keep your devices up to date. In addition to Microsoft's vulnerability resources, we provided additional insight into where the patches get their naming standards via CVE along with NVD, which is provided by NIST. Next, we looked at some of the biggest breaches that have occurred to date and provided some popular sources to keep you up to date with the latest cyber news. We finished the chapter with an insight into some of today's general security challenges and, more specifically, those with Windows systems, before closing with an overview of Zero Trust security and what it entails.

In the next chapter, we will review building a baseline. The chapter will review what a baseline is, and then go into detail as to why a baseline must be formed. As part of the baseline, you need to ensure your policies, standards, and procedures are in place, that they are well-defined, and that they are signed off by the leadership and all the stakeholders who are liable for protecting the data. Having these documented is important for security reasons as well as for compliance and auditing purposes. Following this, we will briefly cover change management and its importance as it relates to baselining. We will then review frameworks and what they entail before moving on to some common frameworks that should be referenced to build your baseline. We will finish the chapter with a review of baseline controls and how to implement them before providing the best practices around baselining.