From 2be8f358e3dd889df6ee4280ad49d5708aef3bb2 Mon Sep 17 00:00:00 2001 From: JanKeller1 Date: Tue, 7 Feb 2017 14:38:21 -0800 Subject: [PATCH] Added an intro to provide more context --- ...options-for-app-related-security-policies.md | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md index 0f98929851..b686486083 100644 --- a/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/keep-secure/override-mitigation-options-for-app-related-security-policies.md @@ -17,7 +17,22 @@ ms.sitesec: library - Windows 10, version 1607 - Windows Server 2016 -Use Group Policy to override individual **Process Mitigation Options** settings and help to enforce specific app-related security policies. +Windows 10 includes Group Policy-configurable “Process Mitigation Options” that add advanced protections against memory-based attacks, that is, attacks where malware manipulates memory to gain control of a system. For example, malware might attempt to use buffer overruns to inject malicious executable code into memory, but Process Mitigation Options can prevent the running of the malicious code. + +> [!IMPORTANT] +> We recommend trying these mitigations in a test lab before deploying to your organization, to determine if they interfere with your organization’s required apps. + +The Group Policy settings in this topic are related to three types of process mitigations. In Windows 10, all three types are on by default for 64-bit applications, but by using the Group Policy settings described in this topic, you can configure additional protections. The types of process mitigations are: + +- **Data Execution Prevention (DEP)** is a system-level memory protection feature that enables the operating system to mark one or more pages of memory as non-executable, preventing code from being run from that region of memory, to help prevent exploitation of buffer overruns. DEP helps prevent code from being run from data pages such as the default heap, stacks, and memory pools. For more information, see [Data Execution Prevention](windows-10-security-guide.md#data-execution-prevention). + +- **Structured Exception Handling Overwrite Protection (SEHOP)** is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps to protect apps regardless of whether they have been compiled with the latest improvements. + +- **Address Space Layout Randomization (ASLR)** loads DLLs into random memory addresses at boot time to mitigate against malware that’s designed to attack specific memory locations, where specific DLLs are expected to be loaded. For more information, see [Address Space Layout Randomization](windows-10-security-guide.md#address-space-layout-randomization). + + To find additional ASLR protections in the table below, look for `IMAGES` or `ASLR`. + +The following procedure describes how to use Group Policy to override individual **Process Mitigation Options** settings. **To modify Process Mitigation Options**