Inverted numbering scheme to align to ascending pattern from HW security and SecureScore

This commit is contained in:
Chris Jackson 2019-05-29 23:11:45 -05:00
parent d4ecdbcffc
commit ac9267dbb1
7 changed files with 44 additions and 44 deletions

View File

@ -4,8 +4,8 @@
### [Security Compliance Toolkit](security-compliance-toolkit-10.md) ### [Security Compliance Toolkit](security-compliance-toolkit-10.md)
### [Get support](get-support-for-security-baselines.md) ### [Get support](get-support-for-security-baselines.md)
## [Windows security configuration framework](windows-security-configuration-framework.md) ## [Windows security configuration framework](windows-security-configuration-framework.md)
### [Level 5 Enterprise Basic Security](level-5-enterprise-security.md) ### [Level 1 enterprise basic security](level-1-enterprise-basic-security.md)
### [Level 4 Enterprise Enhanced Security](level-4-enterprise-high-security.md) ### [Level 2 enterprise enhanced security](level-2-enterprise-enhanced-security.md)
### [Level 3 Enterprise High Security](level-3-enterprise-vip-security.md) ### [Level 3 enterprise high security](level-3-enterprise-high-security.md)
### [Level 2 enterprise dev/ops workstation](level-2-enterprise-devops-security.md) ### [Level 4 enterprise dev/ops workstation](level-4-enterprise-devops-security.md)
### [Level 1 enterprise administrator workstation](level-1-enterprise-administrator-security.md) ### [Level 5 enterprise administrator workstation](level-5-enterprise-administrator-security.md)

Binary file not shown.

Before

Width:  |  Height:  |  Size: 235 KiB

After

Width:  |  Height:  |  Size: 234 KiB

View File

@ -1,6 +1,6 @@
--- ---
title: Level 5 enterprise security configuration title: Level 1 enterprise basic security configuration
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 5 enterprise security configuration. description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 1 enterprise security configuration.
keywords: virtualization, security, malware keywords: virtualization, security, malware
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -11,21 +11,21 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
ms.date: 04/05/2018 ms.date: 05/29/2019
--- ---
# Level 5 Enterprise Basic Security configuration # Level 1 Enterprise Basic Security configuration
**Applies to** **Applies to**
- Windows 10 - Windows 10
Level 5 is the minimum security configuration for an enterprise device. Level 1 is the minimum security configuration for an enterprise device.
Microsoft recommends the following configuration for level 5 devices. Microsoft recommends the following configuration for level 1 devices.
## Hardware ## Hardware
Devices targeting Level 5 should support the following hardware features: Devices targeting Level 1 should support the following hardware features:
- [Trusted Platform Module (TPM) 2.0](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-tpm) - [Trusted Platform Module (TPM) 2.0](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-tpm)
- [Bitlocker Drive Encryption](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker) - [Bitlocker Drive Encryption](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-bitlocker)
@ -34,7 +34,7 @@ Devices targeting Level 5 should support the following hardware features:
## Policies ## Policies
The policies in level 5 enforce a reasonable security level while minimizing the impact to users or to applications. The policies in level 1 enforce a reasonable security level while minimizing the impact to users or to applications.
Microsoft recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and controls, noting that the timeline can generally be short given the limited potential impact of the security controls. Microsoft recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and controls, noting that the timeline can generally be short given the limited potential impact of the security controls.
### Security Template Policies ### Security Template Policies
@ -336,7 +336,7 @@ Microsoft recommends using [the rings methodology](https://docs.microsoft.com/wi
## Controls ## Controls
The controls enabled in level 5 enforce a reasonable security level while minimizing the impact to users and applications. The controls enabled in level 1 enforce a reasonable security level while minimizing the impact to users and applications.
| Feature | Config | Description | | Feature | Config | Description |
|-----------------------------------|-------------------------------------|--------------------| |-----------------------------------|-------------------------------------|--------------------|
@ -350,7 +350,7 @@ The controls enabled in level 5 enforce a reasonable security level while minimi
## Behaviors ## Behaviors
The behaviors recommended in level 5 enforce a reasonable security level while minimizing the impact to users or to applications. The behaviors recommended in level 1 enforce a reasonable security level while minimizing the impact to users or to applications.
| Feature | Config | Description | | Feature | Config | Description |
|---------|-------------------|-------------| |---------|-------------------|-------------|

View File

@ -1,6 +1,6 @@
--- ---
title: Level 4 enterprise high security configuration title: Level 2 enterprise enhanced security configuration
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 4 enterprise security configuration. description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 2 enterprise security configuration.
keywords: virtualization, security, malware keywords: virtualization, security, malware
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -11,21 +11,21 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
ms.date: 04/05/2018 ms.date: 05/29/2019
--- ---
# Level 4 Enterprise Enhanced Security configuration # Level 2 enterprise enhanced security configuration
**Applies to** **Applies to**
- Windows 10 - Windows 10
Level 4 is the security configuration recommended as a standard for devices where users access more sensitive information. These devices are a natural target in enterprises today. While targeting high levels of security, these recommendations do not assume a large staff of highly skilled security practitioners, and therefore should be accessible to most enterprise organizations. Level 2 is the security configuration recommended as a standard for devices where users access more sensitive information. These devices are a natural target in enterprises today. While targeting high levels of security, these recommendations do not assume a large staff of highly skilled security practitioners, and therefore should be accessible to most enterprise organizations.
A level 4 configuration should include all the configurations from level 5 and add the following security policies, controls, and organizational behaviors. A level 2 configuration should include all the configurations from level 1 and add the following security policies, controls, and organizational behaviors.
## Hardware ## Hardware
Devices targeting Level 4 should support all Level 5 features, and add the following hardware features: Devices targeting level 2 should support all level 1 features, and add the following hardware features:
- [Virtualization and HVCI Enabled](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs) - [Virtualization and HVCI Enabled](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/oem-vbs)
- [Drivers and Apps HVCI-Ready](https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/driver-compatibility-with-device-guard) - [Drivers and Apps HVCI-Ready](https://docs.microsoft.com/en-us/windows-hardware/test/hlk/testref/driver-compatibility-with-device-guard)
@ -34,14 +34,14 @@ Devices targeting Level 4 should support all Level 5 features, and add the follo
## Policies ## Policies
The policies enforced in level 4 include all of the policies recommended for level 5 and adds the The policies enforced in level 2 include all of the policies recommended for level 1 and adds the
below policies to implement more controls and a more sophisticated security below policies to implement more controls and a more sophisticated security
configuration than level 5. While they may have a slightly higher impact to configuration than level 1. While they may have a slightly higher impact to
users or to applications, they enforce a level of security more commensurate users or to applications, they enforce a level of security more commensurate
with the risks facing users with access to sensitive information. Microsoft with the risks facing users with access to sensitive information. Microsoft
recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and recommends using [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for these security configurations and
controls, with a moderate timeline that is anticipated to be slightly longer controls, with a moderate timeline that is anticipated to be slightly longer
than the process in level 5. than the process in level 1.
### Security Template Policies ### Security Template Policies
@ -100,13 +100,13 @@ Microsoft recommends disabling the following services when their use is not requ
## Controls ## Controls
The controls enforced in level 4 implement more controls and a more sophisticated security The controls enforced in level 2 implement more controls and a more sophisticated security
configuration than level 5. While they may have a slightly higher impact to configuration than level 1. While they may have a slightly higher impact to
users or to applications, they enforce a level of security more commensurate users or to applications, they enforce a level of security more commensurate
with the risks facing users with access to sensitive information. Microsoft with the risks facing users with access to sensitive information. Microsoft
recommends using the Audit/Enforce methodology for controls with an Audit mode, recommends using the Audit/Enforce methodology for controls with an Audit mode,
and [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for those that do not, with a moderate timeline that and [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates) for those that do not, with a moderate timeline that
is anticipated to be slightly longer than the process in level 5. is anticipated to be slightly longer than the process in level 1.
| Feature Set | Feature | Description | | Feature Set | Feature | Description |
|-------------------------------------------------------------|-------------------------------------------------------|----------------| |-------------------------------------------------------------|-------------------------------------------------------|----------------|
@ -118,7 +118,7 @@ is anticipated to be slightly longer than the process in level 5.
## Behaviors ## Behaviors
The behaviors recommended in level 4 implement a more sophisticated security process. While they may require a more sophisticated organization, they enforce The behaviors recommended in level 2 implement a more sophisticated security process. While they may require a more sophisticated organization, they enforce
a level of security more commensurate with the risks facing users with access to a level of security more commensurate with the risks facing users with access to
sensitive information. sensitive information.

View File

@ -1,5 +1,5 @@
--- ---
title: Level 3 enterprise VIP security configuration title: Level 3 enterprise high security configuration
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 3 enterprise VIP security configuration. description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 3 enterprise VIP security configuration.
keywords: virtualization, security, malware keywords: virtualization, security, malware
ms.prod: w10 ms.prod: w10
@ -11,28 +11,28 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
ms.date: 04/05/2018 ms.date: 05/29/2019
--- ---
# Level 3 Enterprise High Security configuration # Level 3 enterprise high security configuration
**Applies to** **Applies to**
- Windows 10 - Windows 10
Level 3 is the security configuration recommended as a standard for organizations with large and sophisticated security organizations, or for specific users and groups who will be uniquely targeted by adversaries. Such organizations are typically targeted by well-funded and sophisticated adversaries, and as such merit the additional constraints and controls described here. Level 3 is the security configuration recommended as a standard for organizations with large and sophisticated security organizations, or for specific users and groups who will be uniquely targeted by adversaries. Such organizations are typically targeted by well-funded and sophisticated adversaries, and as such merit the additional constraints and controls described here.
A level 3 configuration should include all the configurations from level 5 and level 4 and add the following security policies, controls, and organizational behaviors. A level 3 configuration should include all the configurations from level 2 and level 1 and add the following security policies, controls, and organizational behaviors.
## Hardware ## Hardware
Devices targeting Level 3 should support all Level 5 and Level 4 features, and add the following hardware features: Devices targeting Level 3 should support all Level 2 and Level 1 features, and add the following hardware features:
- [System Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows) - [System Guard](https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows)
- [Modern Standby](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby) - [Modern Standby](https://docs.microsoft.com/en-us/windows-hardware/design/device-experiences/modern-standby)
## Policies ## Policies
The policies enforced in level 3 include all of the policies recommended for levels 5 and 4, and adds the below policies to The policies enforced in level 3 include all of the policies recommended for levels 2 and 1, and adds the below policies to
implement strict security configuration and controls. They can have a potentially significant impact to users or to applications, enforcing implement strict security configuration and controls. They can have a potentially significant impact to users or to applications, enforcing
a level of security commensurate with the risks facing targeted organizations. Microsoft recommends disciplined testing and deployment using a level of security commensurate with the risks facing targeted organizations. Microsoft recommends disciplined testing and deployment using
[the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates). [the rings methodology](https://docs.microsoft.com/windows/deployment/update/waas-deployment-rings-windows-10-updates).

View File

@ -1,6 +1,6 @@
--- ---
title: Level 2 enterprise dev/ops security workstation configuration title: Level 4 enterprise dev/ops security workstation configuration
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 2 enterprise dev/ops security configuration. description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 4 enterprise dev/ops security configuration.
keywords: virtualization, security, malware keywords: virtualization, security, malware
ms.prod: w10 ms.prod: w10
ms.mktglfcycl: deploy ms.mktglfcycl: deploy
@ -11,16 +11,16 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
ms.date: 04/05/2018 ms.date: 05/29/2019
--- ---
# Level 2 enterprise dev/ops workstation security configuration # Level 4 enterprise dev/ops workstation security configuration
**Applies to** **Applies to**
- Windows 10 - Windows 10
We recommend this configuration for developers and testers, who are an attractive target both for supply chain attacks and access to servers and systems containing high value data or where critical business functions could be disrupted. A level 2 configuration should include all the configurations from levels 5, 4, and 3 and additional controls. We are planning recommendations for the additional controls now, so check back soon for level 2 enterprise dev/ops security configuration guidance! We recommend this configuration for developers and testers, who are an attractive target both for supply chain attacks and access to servers and systems containing high value data or where critical business functions could be disrupted. A level 4 configuration should include all the configurations from levels 3, 2, and 1 and additional controls. We are planning recommendations for the additional controls now, so check back soon for level 4 enterprise dev/ops security configuration guidance!

View File

@ -1,5 +1,5 @@
--- ---
title: Level 1 enterprise administrator workstation security title: Level 5 enterprise administrator workstation security
description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 1 enterprise administrator security configuration. description: Describes the policies, controls, and organizational behaviors for Windows security configuration framework level 1 enterprise administrator security configuration.
keywords: virtualization, security, malware keywords: virtualization, security, malware
ms.prod: w10 ms.prod: w10
@ -11,10 +11,10 @@ manager: dansimp
audience: ITPro audience: ITPro
ms.collection: M365-security-compliance ms.collection: M365-security-compliance
ms.topic: conceptual ms.topic: conceptual
ms.date: 04/05/2018 ms.date: 05/29/2019
--- ---
# Level 1 enterprise administrator workstation security configuration # Level 5 enterprise administrator workstation security configuration
**Applies to** **Applies to**
@ -22,4 +22,4 @@ ms.date: 04/05/2018
Administrators (particularly of identity or security systems) present the highest risk to the organizationthrough data theft, data alteration, or service disruption. Administrators (particularly of identity or security systems) present the highest risk to the organizationthrough data theft, data alteration, or service disruption.
A level 1 configuration should include all the configurations from levels 5, 4, 3, and 2 and additional controls. We are planning recommendations for the additional controls now, so check back soon for level 1 enterprise administrator security configuration guidance! A level 5 configuration should include all the configurations from levels 4, 3, 2, and 1 and adds additional controls. We are planning recommendations for the additional controls now, so check back soon for level 5 enterprise administrator security configuration guidance!