mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-05-12 13:27:23 +00:00
Inverted numbering scheme to align to ascending pattern from HW security and SecureScore
This commit is contained in:
parent
d4ecdbcffc
commit
ac9267dbb1
@ -4,8 +4,8 @@
|
|||||||
### [Security Compliance Toolkit](security-compliance-toolkit-10.md)
|
### [Security Compliance Toolkit](security-compliance-toolkit-10.md)
|
||||||
### [Get support](get-support-for-security-baselines.md)
|
### [Get support](get-support-for-security-baselines.md)
|
||||||
## [Windows security configuration framework](windows-security-configuration-framework.md)
|
## [Windows security configuration framework](windows-security-configuration-framework.md)
|
||||||
### [Level 5 Enterprise Basic Security](level-5-enterprise-security.md)
|
### [Level 1 enterprise basic security](level-1-enterprise-basic-security.md)
|
||||||
### [Level 4 Enterprise Enhanced Security](level-4-enterprise-high-security.md)
|
### [Level 2 enterprise enhanced security](level-2-enterprise-enhanced-security.md)
|
||||||
### [Level 3 Enterprise High Security](level-3-enterprise-vip-security.md)
|
### [Level 3 enterprise high security](level-3-enterprise-high-security.md)
|
||||||
### [Level 2 enterprise dev/ops workstation](level-2-enterprise-devops-security.md)
|
### [Level 4 enterprise dev/ops workstation](level-4-enterprise-devops-security.md)
|
||||||
### [Level 1 enterprise administrator workstation](level-1-enterprise-administrator-security.md)
|
### [Level 5 enterprise administrator workstation](level-5-enterprise-administrator-security.md)
|
||||||
|
Binary file not shown.
Before Width: | Height: | Size: 235 KiB After Width: | Height: | Size: 234 KiB |
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Level 5 enterprise security configuration
|
title: Level 1 enterprise basic security configuration
|
||||||
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 5 enterprise security configuration.
|
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 1 enterprise security configuration.
|
||||||
keywords: virtualization, security, malware
|
keywords: virtualization, security, malware
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
@ -11,21 +11,21 @@ manager: dansimp
|
|||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
ms.date: 04/05/2018
|
ms.date: 05/29/2019
|
||||||
---
|
---
|
||||||
|
|
||||||
# Level 5 Enterprise Basic Security configuration
|
# Level 1 Enterprise Basic Security configuration
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
|
|
||||||
Level 5 is the minimum security configuration for an enterprise device.
|
Level 1 is the minimum security configuration for an enterprise device.
|
||||||
Microsoft recommends the following configuration for level 5 devices.
|
Microsoft recommends the following configuration for level 1 devices.
|
||||||
|
|
||||||
## Hardware
|
## Hardware
|
||||||
|
|
||||||
Devices targeting Level 5 should support the following hardware features:
|
Devices targeting Level 1 should support the following hardware features:
|
||||||
|
|
||||||
- [Trusted Platform Module (TPM) 2.0](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-tpm)
|
- [Trusted Platform Module (TPM) 2.0](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-tpm)
|
||||||
- [Bitlocker Drive Encryption](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker)
|
- [Bitlocker Drive Encryption](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker)
|
||||||
@ -34,7 +34,7 @@ Devices targeting Level 5 should support the following hardware features:
|
|||||||
|
|
||||||
## Policies
|
## Policies
|
||||||
|
|
||||||
The policies in level 5 enforce a reasonable security level while minimizing the impact to users or to applications.
|
The policies in level 1 enforce a reasonable security level while minimizing the impact to users or to applications.
|
||||||
Microsoft recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and controls, noting that the timeline can generally be short given the limited potential impact of the security controls.
|
Microsoft recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and controls, noting that the timeline can generally be short given the limited potential impact of the security controls.
|
||||||
|
|
||||||
### Security Template Policies
|
### Security Template Policies
|
||||||
@ -336,7 +336,7 @@ Microsoft recommends using [the rings methodology](https://docs.microsoft.com/wi
|
|||||||
|
|
||||||
## Controls
|
## Controls
|
||||||
|
|
||||||
The controls enabled in level 5 enforce a reasonable security level while minimizing the impact to users and applications.
|
The controls enabled in level 1 enforce a reasonable security level while minimizing the impact to users and applications.
|
||||||
|
|
||||||
| Feature | Config | Description |
|
| Feature | Config | Description |
|
||||||
|-----------------------------------|-------------------------------------|--------------------|
|
|-----------------------------------|-------------------------------------|--------------------|
|
||||||
@ -350,7 +350,7 @@ The controls enabled in level 5 enforce a reasonable security level while minimi
|
|||||||
|
|
||||||
## Behaviors
|
## Behaviors
|
||||||
|
|
||||||
The behaviors recommended in level 5 enforce a reasonable security level while minimizing the impact to users or to applications.
|
The behaviors recommended in level 1 enforce a reasonable security level while minimizing the impact to users or to applications.
|
||||||
|
|
||||||
| Feature | Config | Description |
|
| Feature | Config | Description |
|
||||||
|---------|-------------------|-------------|
|
|---------|-------------------|-------------|
|
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Level 4 enterprise high security configuration
|
title: Level 2 enterprise enhanced security configuration
|
||||||
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 4 enterprise security configuration.
|
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 2 enterprise security configuration.
|
||||||
keywords: virtualization, security, malware
|
keywords: virtualization, security, malware
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
@ -11,21 +11,21 @@ manager: dansimp
|
|||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
ms.date: 04/05/2018
|
ms.date: 05/29/2019
|
||||||
---
|
---
|
||||||
|
|
||||||
# Level 4 Enterprise Enhanced Security configuration
|
# Level 2 enterprise enhanced security configuration
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
|
|
||||||
Level 4 is the security configuration recommended as a standard for devices where users access more sensitive information. These devices are a natural target in enterprises today. While targeting high levels of security, these recommendations do not assume a large staff of highly skilled security practitioners, and therefore should be accessible to most enterprise organizations.
|
Level 2 is the security configuration recommended as a standard for devices where users access more sensitive information. These devices are a natural target in enterprises today. While targeting high levels of security, these recommendations do not assume a large staff of highly skilled security practitioners, and therefore should be accessible to most enterprise organizations.
|
||||||
A level 4 configuration should include all the configurations from level 5 and add the following security policies, controls, and organizational behaviors.
|
A level 2 configuration should include all the configurations from level 1 and add the following security policies, controls, and organizational behaviors.
|
||||||
|
|
||||||
## Hardware
|
## Hardware
|
||||||
|
|
||||||
Devices targeting Level 4 should support all Level 5 features, and add the following hardware features:
|
Devices targeting level 2 should support all level 1 features, and add the following hardware features:
|
||||||
|
|
||||||
- [Virtualization and HVCI Enabled](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs)
|
- [Virtualization and HVCI Enabled](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs)
|
||||||
- [Drivers and Apps HVCI-Ready](https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/driver-compatibility-with-device-guard)
|
- [Drivers and Apps HVCI-Ready](https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/driver-compatibility-with-device-guard)
|
||||||
@ -34,14 +34,14 @@ Devices targeting Level 4 should support all Level 5 features, and add the follo
|
|||||||
|
|
||||||
## Policies
|
## Policies
|
||||||
|
|
||||||
The policies enforced in level 4 include all of the policies recommended for level 5 and adds the
|
The policies enforced in level 2 include all of the policies recommended for level 1 and adds the
|
||||||
below policies to implement more controls and a more sophisticated security
|
below policies to implement more controls and a more sophisticated security
|
||||||
configuration than level 5. While they may have a slightly higher impact to
|
configuration than level 1. While they may have a slightly higher impact to
|
||||||
users or to applications, they enforce a level of security more commensurate
|
users or to applications, they enforce a level of security more commensurate
|
||||||
with the risks facing users with access to sensitive information. Microsoft
|
with the risks facing users with access to sensitive information. Microsoft
|
||||||
recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and
|
recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and
|
||||||
controls, with a moderate timeline that is anticipated to be slightly longer
|
controls, with a moderate timeline that is anticipated to be slightly longer
|
||||||
than the process in level 5.
|
than the process in level 1.
|
||||||
|
|
||||||
### Security Template Policies
|
### Security Template Policies
|
||||||
|
|
||||||
@ -100,13 +100,13 @@ Microsoft recommends disabling the following services when their use is not requ
|
|||||||
|
|
||||||
## Controls
|
## Controls
|
||||||
|
|
||||||
The controls enforced in level 4 implement more controls and a more sophisticated security
|
The controls enforced in level 2 implement more controls and a more sophisticated security
|
||||||
configuration than level 5. While they may have a slightly higher impact to
|
configuration than level 1. While they may have a slightly higher impact to
|
||||||
users or to applications, they enforce a level of security more commensurate
|
users or to applications, they enforce a level of security more commensurate
|
||||||
with the risks facing users with access to sensitive information. Microsoft
|
with the risks facing users with access to sensitive information. Microsoft
|
||||||
recommends using the Audit/Enforce methodology for controls with an Audit mode,
|
recommends using the Audit/Enforce methodology for controls with an Audit mode,
|
||||||
and [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for those that do not, with a moderate timeline that
|
and [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for those that do not, with a moderate timeline that
|
||||||
is anticipated to be slightly longer than the process in level 5.
|
is anticipated to be slightly longer than the process in level 1.
|
||||||
|
|
||||||
| Feature Set | Feature | Description |
|
| Feature Set | Feature | Description |
|
||||||
|-------------------------------------------------------------|-------------------------------------------------------|----------------|
|
|-------------------------------------------------------------|-------------------------------------------------------|----------------|
|
||||||
@ -118,7 +118,7 @@ is anticipated to be slightly longer than the process in level 5.
|
|||||||
|
|
||||||
## Behaviors
|
## Behaviors
|
||||||
|
|
||||||
The behaviors recommended in level 4 implement a more sophisticated security process. While they may require a more sophisticated organization, they enforce
|
The behaviors recommended in level 2 implement a more sophisticated security process. While they may require a more sophisticated organization, they enforce
|
||||||
a level of security more commensurate with the risks facing users with access to
|
a level of security more commensurate with the risks facing users with access to
|
||||||
sensitive information.
|
sensitive information.
|
||||||
|
|
@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: Level 3 enterprise VIP security configuration
|
title: Level 3 enterprise high security configuration
|
||||||
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 3 enterprise VIP security configuration.
|
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 3 enterprise VIP security configuration.
|
||||||
keywords: virtualization, security, malware
|
keywords: virtualization, security, malware
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -11,28 +11,28 @@ manager: dansimp
|
|||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
ms.date: 04/05/2018
|
ms.date: 05/29/2019
|
||||||
---
|
---
|
||||||
|
|
||||||
# Level 3 Enterprise High Security configuration
|
# Level 3 enterprise high security configuration
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
|
|
||||||
Level 3 is the security configuration recommended as a standard for organizations with large and sophisticated security organizations, or for specific users and groups who will be uniquely targeted by adversaries. Such organizations are typically targeted by well-funded and sophisticated adversaries, and as such merit the additional constraints and controls described here.
|
Level 3 is the security configuration recommended as a standard for organizations with large and sophisticated security organizations, or for specific users and groups who will be uniquely targeted by adversaries. Such organizations are typically targeted by well-funded and sophisticated adversaries, and as such merit the additional constraints and controls described here.
|
||||||
A level 3 configuration should include all the configurations from level 5 and level 4 and add the following security policies, controls, and organizational behaviors.
|
A level 3 configuration should include all the configurations from level 2 and level 1 and add the following security policies, controls, and organizational behaviors.
|
||||||
|
|
||||||
## Hardware
|
## Hardware
|
||||||
|
|
||||||
Devices targeting Level 3 should support all Level 5 and Level 4 features, and add the following hardware features:
|
Devices targeting Level 3 should support all Level 2 and Level 1 features, and add the following hardware features:
|
||||||
|
|
||||||
- [System Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows)
|
- [System Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows)
|
||||||
- [Modern Standby](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby)
|
- [Modern Standby](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby)
|
||||||
|
|
||||||
## Policies
|
## Policies
|
||||||
|
|
||||||
The policies enforced in level 3 include all of the policies recommended for levels 5 and 4, and adds the below policies to
|
The policies enforced in level 3 include all of the policies recommended for levels 2 and 1, and adds the below policies to
|
||||||
implement strict security configuration and controls. They can have a potentially significant impact to users or to applications, enforcing
|
implement strict security configuration and controls. They can have a potentially significant impact to users or to applications, enforcing
|
||||||
a level of security commensurate with the risks facing targeted organizations. Microsoft recommends disciplined testing and deployment using
|
a level of security commensurate with the risks facing targeted organizations. Microsoft recommends disciplined testing and deployment using
|
||||||
[the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates).
|
[the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates).
|
@ -1,6 +1,6 @@
|
|||||||
---
|
---
|
||||||
title: Level 2 enterprise dev/ops security workstation configuration
|
title: Level 4 enterprise dev/ops security workstation configuration
|
||||||
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 2 enterprise dev/ops security configuration.
|
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 4 enterprise dev/ops security configuration.
|
||||||
keywords: virtualization, security, malware
|
keywords: virtualization, security, malware
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
ms.mktglfcycl: deploy
|
ms.mktglfcycl: deploy
|
||||||
@ -11,16 +11,16 @@ manager: dansimp
|
|||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
ms.date: 04/05/2018
|
ms.date: 05/29/2019
|
||||||
---
|
---
|
||||||
|
|
||||||
# Level 2 enterprise dev/ops workstation security configuration
|
# Level 4 enterprise dev/ops workstation security configuration
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
- Windows 10
|
- Windows 10
|
||||||
|
|
||||||
We recommend this configuration for developers and testers, who are an attractive target both for supply chain attacks and access to servers and systems containing high value data or where critical business functions could be disrupted. A level 2 configuration should include all the configurations from levels 5, 4, and 3 and additional controls. We are planning recommendations for the additional controls now, so check back soon for level 2 enterprise dev/ops security configuration guidance!
|
We recommend this configuration for developers and testers, who are an attractive target both for supply chain attacks and access to servers and systems containing high value data or where critical business functions could be disrupted. A level 4 configuration should include all the configurations from levels 3, 2, and 1 and additional controls. We are planning recommendations for the additional controls now, so check back soon for level 4 enterprise dev/ops security configuration guidance!
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,5 +1,5 @@
|
|||||||
---
|
---
|
||||||
title: Level 1 enterprise administrator workstation security
|
title: Level 5 enterprise administrator workstation security
|
||||||
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 1 enterprise administrator security configuration.
|
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 1 enterprise administrator security configuration.
|
||||||
keywords: virtualization, security, malware
|
keywords: virtualization, security, malware
|
||||||
ms.prod: w10
|
ms.prod: w10
|
||||||
@ -11,10 +11,10 @@ manager: dansimp
|
|||||||
audience: ITPro
|
audience: ITPro
|
||||||
ms.collection: M365-security-compliance
|
ms.collection: M365-security-compliance
|
||||||
ms.topic: conceptual
|
ms.topic: conceptual
|
||||||
ms.date: 04/05/2018
|
ms.date: 05/29/2019
|
||||||
---
|
---
|
||||||
|
|
||||||
# Level 1 enterprise administrator workstation security configuration
|
# Level 5 enterprise administrator workstation security configuration
|
||||||
|
|
||||||
**Applies to**
|
**Applies to**
|
||||||
|
|
||||||
@ -22,4 +22,4 @@ ms.date: 04/05/2018
|
|||||||
|
|
||||||
|
|
||||||
Administrators (particularly of identity or security systems) present the highest risk to the organization−through data theft, data alteration, or service disruption.
|
Administrators (particularly of identity or security systems) present the highest risk to the organization−through data theft, data alteration, or service disruption.
|
||||||
A level 1 configuration should include all the configurations from levels 5, 4, 3, and 2 and additional controls. We are planning recommendations for the additional controls now, so check back soon for level 1 enterprise administrator security configuration guidance!
|
A level 5 configuration should include all the configurations from levels 4, 3, 2, and 1 and adds additional controls. We are planning recommendations for the additional controls now, so check back soon for level 5 enterprise administrator security configuration guidance!
|
Loading…
x
Reference in New Issue
Block a user