Windows 8 is Coming to a BYOD Near You

UltimateWindowsSecurity.com

Windows 8 Is Coming
to a BYOD Near You:
Are the New Security Features
Enough?

© 2012 Monterey Technology Group Inc.

Brought to you by

www.lumension.com

Speaker
 Russ Ernst – Group Product Manager

© 2012 Monterey Technology Group Inc. 1


Preview of Key Points

New security features
RT vs. Regular Windows
Differences between editions
Mobile device management
Gaps


New security features

Protecting against advanced malware – Trusted
Boot
UEFI
Secure Boot
Measured Boot
ELAM





 UEFI
 Modern replacement for BIOS
 Secure Boot
 Requires UEFI but not TPM
 Firmware checks bootloader against OS vender certificate
 Protects against rootkits/bootkits
 http://tinyurl.com/3z2shwn

Any OS
BIOS OS Start
Loader

Verified
UEFI OS Loader OS Start
Only


 Measured Boot
Requires TPM but not UEFI
Uses the TPM to verify components have not been
tampered with
Enhanced version of what was available in Windows
Vista and 7
 ELAM
Early Launch Anti-Malware
Allows AV to launch before OS fully loaded
Also allows AV to check what still loaded before it
Can attest to a remote server for verification
Great MS whitepaper: http://tinyurl.com/acr2oke




More good links
http://msdn.microsoft.com/en-
us/library/windows/hardware/br259096.aspx



BitLocker enhancements
Boot configuration data (BCD) validation moved to
SecureBoot when available
Provisioning possible prior to OS setup
Used diskspace only
Reduced helpdesk calls
• Standard users can change PIN/passwords
• Network unlock
Support for encrypted hard drives
• Not the same as self-encrypted drives (SEDs)





SmartScreen
Unrecognized apps and files downloaded from the
Internet
Moved from IE to Windows so other files from any
browser subject
Memory Management
Comprehensive randomization and guard pages
More defense against memory exploit tactics
AppContainers
Enhanced sandbox



Picture Password





 Picture Password
 Password stored in clear text?
• Not so much
• But is available to any admin on the system
 Actually stored in reversible encryption
• Everyone crying that’s a no-no for password storage
• Hashes would not work in this case
 Microsoft blog post on the “math” behind picture passwords
• http://tinyurl.com/bmua4fc
• Math adds up
• But the facts don’t
 Key point though:
• You only get 5 chances
• Same with 4 digit PIN



Windows Defender
http://mashable.com/2012/10/22/windows-8-
security-now-things-get-interesting/
http://news.softpedia.com/news/15-of-Malware-
Can-Get-Past-Windows-8-s-Defender-Experts-
Find-305535.shtml
Nice to have? yes
Replacement for corporate A/V?
Far from it




RT vs. Real Windows

ARM based RT
Better
• Battery life and weight
Worse
• Doesn’t run x86 Windows apps
• Traditional desktop mode not available to 3rd party
• 3rd party browsers restricted to certain APIs
• No AD membership or group policy
• Not BitLocker but has encryption
Different
• Management infrastructure


Differences between editions
of real Windows
http://en.wikipedia.org/wiki/Windows_8_editions
Partial Yes Yes Yes
Supported third-party
Windows Store apps only Windows Store and desktop Windows Store and desktop Windows Store and desktop
apps[2][16]
Remote Desktop Client only Client only Client and host Client and host
Storage Spaces No Yes Yes Yes
Encryption features Device encryption[b] Unavailable BitLocker and EFS BitLocker and EFS

Sideload Windows Store apps Yes [18] No[11] Yes [19] Yes [11]

Boot from VHD No No Yes Yes

Can join a Windows domain? No No Yes Yes
Group Policy No No Yes Yes
Hyper-V[20] No No On 64-bit versions only with SLAT capable CPU
AppLocker[c] No No No Yes
Windows To Go No No No Yes
DirectAccess No No No Yes
BranchCache[d] No No No Yes
Can be virtualized by
No No No Yes
RemoteFX?
Services for Network File
No No No Yes
System [23]
Microsoft Office apps bundled
Yes No No No
with OS[e]
Windows Media Center No No Via an add-in[24] No
Windows RT Windows 8 Windows 8 Pro Windows 8 Enterprise

© 2012 Monterey Technology Group Inc. From wikipedia



Mobile Device Management

Management Infrastructure
Designed to address corporate security concerns
on employee-owned devices (BYOD)
• RT & Real Windows
Integrates with System Center
• Agent and self-service-portal



 Management Infrastructure
Policies
• Allow Convenience Logon
• VPN
• Maximum Failed Password
Attempts • Drive Encryption Status
• Maximum Inactivity Time Lock • Auto Update Status
• Minimum Device Password • Antivirus Status
Complex Characters • AntiSpyWare Status
• Minimum Password Length
• Password Enabled
• Password Expiration
• Password History





Management Infrastructure Disconnect can be
initiated by admin remotely or user locally
• Everything reversed
• Business data wiped?


Gaps

Enterprise anti-malware
Full virus coverage
Reporting
Application control
Full configuration management
Compliance
Device control




lumension.com/windows-8

Comprehensive Endpoint Management and Security for
Microsoft Windows 8 and Windows Server 2012
Lumension® Supports Your Windows 8 and Windows Server 2012
Migration Plans with Solution Readiness

Download the FAQ today at
lumension.com/windows-8

Brought to you by

www.lumension.com

Speaker
 Russ Ernst – Group Product Manager


Windows 8 is Coming to a BYOD Near You

Recommandé

Recommandé

Contenu connexe

En vedette

En vedette (9)

Plus de Lumension

Plus de Lumension (20)

Dernier

Dernier (20)

Windows 8 is Coming to a BYOD Near You