mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
Merge remote-tracking branch 'origin/master' into atp-reorg2
This commit is contained in:
Joey Caparas
@ -8,7 +8,7 @@ ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
localizationpriority: high
|
||||
author: brianlic-msft
|
||||
ms.date: 05/03/2018
|
||||
ms.date: 06/12/2018
|
||||
---
|
||||
|
||||
# BitLocker Security FAQ
|
||||
@ -27,7 +27,7 @@ The recommended practice for BitLocker configuration on an operating system driv
|
||||
|
||||
## What are the implications of using the sleep or hibernate power management options?
|
||||
|
||||
BitLocker on operating system drives in its basic configuration (with a TPM but without advanced authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an advanced authentication mode (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires BitLocker authentication. As a best practice, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method.
|
||||
BitLocker on operating system drives in its basic configuration (with a TPM but without additional startup authentication) provides additional security for the hibernate mode. However, BitLocker provides greater security when it is configured to use an additional startup authentication factor (TPM+PIN, TPM+USB, or TPM+PIN+USB) with the hibernate mode. This method is more secure because returning from hibernation requires authentication. For improved security, we recommend that sleep mode be disabled and that you use TPM+PIN for the authentication method. Startup authentication can be configured by using [Group Policy](https://docs.microsoft.com/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings#a-href-idbkmk-unlockpol1arequire-additional-authentication-at-startup) or Mobile Device Management with the [Bitlocker CSP](https://docs.microsoft.com/windows/client-management/mdm/bitlocker-csp).
|
||||
|
||||
## What are the advantages of a TPM?
|
||||
|
||||
|
||||
@ -71,7 +71,7 @@ Passive mode | Windows Defender AV will not be used as the antivirus app, and th
|
||||
Automatic disabled mode | Windows Defender AV will not be used as the antivirus app. Files will not be scanned and threats will not be remediated. | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark no](images/svg/check-no.svg)]]
|
||||
Active mode | Windows Defender AV is used as the antivirus app on the machine. All configuration made with Configuration Manager, Group Policy, Intune, or other management products will apply. Files will be scanned and threats remediated, and detection information will be reported in your configuration tool (such as Configuration Manager or the Windows Defender AV app on the machine itself). | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark no](images/svg/check-no.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)] | [!include[Check mark yes](images/svg/check-yes.svg)]
|
||||
|
||||
Passive mode is enabled if you are enrolled in Windows Defender ATP because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks.
|
||||
If you are enrolled in Windows Defender ATP and you are using a third party antimalware product then passive mode is enabled because [the service requires common information sharing from the Windows Defender AV service](../windows-defender-atp/defender-compatibility-windows-defender-advanced-threat-protection.md) in order to properly monitor your devices and network for intrusion attempts and attacks.
|
||||
|
||||
Automatic disabled mode is enabled so that if the protection offered by a third-party antivirus product expires or otherwise stops providing real-time protection from viruses, malware or other threats, Windows Defender AV will automatically enable itself to ensure antivirus protection is maintained on the endpoint. It also allows you to enable [limited periodic scanning](limited-periodic-scanning-windows-defender-antivirus.md), which uses the Windows Defender AV engine to periodically check for threats in addition to your main antivirus app.
|
||||
|
||||
|
||||
@ -18,6 +18,7 @@
|
||||
### [Merge WDAC policies](merge-windows-defender-application-control-policies.md)
|
||||
### [Enforce WDAC policies](enforce-windows-defender-application-control-policies.md)
|
||||
### [Deploy WDAC with a managed installer](use-windows-defender-application-control-with-managed-installer.md)
|
||||
### [Deploy WDAC with Intelligent Security Graph (ISG)](use-windows-defender-application-control-with-intelligent-security-graph.md)
|
||||
### [Deploy WDAC policies using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md)
|
||||
### [Deploy WDAC policies using Intune](deploy-windows-defender-application-control-policies-using-intune.md)
|
||||
### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md)
|
||||
|
||||
@ -7,7 +7,7 @@ ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
author: brianlic-msft
|
||||
ms.date: 09/21/2017
|
||||
ms.date: 06/08/2018
|
||||
---
|
||||
|
||||
# Configure an AppLocker policy for audit only
|
||||
@ -21,8 +21,6 @@ This topic for IT professionals describes how to set AppLocker policies to **Aud
|
||||
After AppLocker rules are created within the rule collection, you can configure the enforcement setting to **Enforce rules** or **Audit only**.
|
||||
|
||||
When AppLocker policy enforcement is set to **Enforce rules**, rules are enforced for the rule collection and all events are audited. When AppLocker policy enforcement is set to **Audit only**, rules are only evaluated but all events generated from that evaluation are written to the AppLocker log.
|
||||
|
||||
>**Note:** There is no audit mode for the DLL rule collection. DLL rules affect specific apps. Therefore, test the impact of these rules first before deploying them to production. To enable the DLL rule collection, see [Enable the DLL rule collection](enable-the-dll-rule-collection.md).
|
||||
|
||||
You can perform this task by using the Group Policy Management Console for an AppLocker policy in a Group Policy Object (GPO) or by using the Local Security Policy snap-in for an AppLocker policy on a local computer or in a security template. For info how to use these MMC snap-ins to administer AppLocker, see [Administer AppLocker](administer-applocker.md#bkmk-using-snapins).
|
||||
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: high
|
||||
author: jsuther1974
|
||||
ms.date: 05/03/2018
|
||||
ms.date: 06/08/2018
|
||||
---
|
||||
|
||||
# Microsoft recommended block rules
|
||||
@ -59,6 +59,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you
|
||||
|Alex Ionescu | @aionescu|
|
||||
|Lee Christensen|@tifkin_|
|
||||
|Vladas Bulavas | Kaspersky Lab |
|
||||
|Lasse Trolle Borup | Langkjaer Cyber Defence |
|
||||
|
||||
<br />
|
||||
|
||||
|
||||
@ -0,0 +1,97 @@
|
||||
---
|
||||
title: Deploy Windows Defender Application Control with Intelligent Security Graph (ISG) (Windows 10)
|
||||
description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation.
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: high
|
||||
author: mdsakibMSFT
|
||||
ms.date: 03/01/2018
|
||||
---
|
||||
|
||||
# Use Windows Defender Application Control (WDAC) with the Microsoft Intelligent Security Graph
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
Application execution control can be difficult to implement in enterprises that do not have processes to effectively control the deployment of applications centrally through an IT managed system.
|
||||
In such environments, users are empowered to acquire the applications they need for work, making accounting for all the applications that would need to be authorized for execution control a daunting task.
|
||||
|
||||
Windows 10, version 1709 (also known as the Windows 10 Fall Creators Update) provides a new option, known as Intelligent Security Graph (ISG) authorization, that allows IT administrators to automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. The ISG option helps IT organizations take a significant first step towards going from having no application control at all to a simple means of preventing the execution of unknown and known bad software.
|
||||
|
||||
## How does the integration between WDAC and the Intelligent Security Graph work?
|
||||
|
||||
The ISG relies on Microsoft’s vast security intelligence and machine learning analytics to help classify applications as having known good reputation. When users download applications on a system with WDAC enabled with the ISG authorization option specified, the reputation of the downloaded file, commonly an installer, is used to determine whether to run the installer and then that original reputation information is passed along to any files that were written by the installer. When any of these files try to execute after they are installed, the reputation data is used to help make the right policy authorization decision.
|
||||
|
||||
After that initial download and installation, the WDAC component will check for the presence of the positive reputation information when evaluating other application execution control rules specified in the policy. If there are no deny rules present for the file, it will be authorized based on the known good reputation classification.
|
||||
|
||||
The reputation data on the client is rechecked periodically and enterprises can also specify that any cached reputation results are flushed on reboot.
|
||||
|
||||
>[!NOTE]
|
||||
>Admins needs to ensure that there is a WDAC policy in place to allow the system to boot and run any other authorized applications that may not be classified as being known good by the Intelligent Security Graph, for example custom line-of-business (LOB) apps. Since the Intelligent Security Graph is powered by global prevalence data, internal LOB apps may not be recognized as being known good. Other mechanisms like managed installer and explicit rules will help cover internal applications. Both System Center Configuration Manager (SCCM) and Microsoft Intune can be used to create and push a WDAC policy to your client machines.
|
||||
|
||||
Other examples of WDAC policies are available in C:\Windows\schemas\CodeIntegrity\ExamplePolicies and can help authorize Windows OS components, WHQL signed drivers and all Store apps. Admins can reference and customize them as needed for their Windows Defender Application Control deployment or [create a custom WDAC policy](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy).
|
||||
|
||||
## Configuring Intelligent Security Graph authorization for Windows Defender Application Control
|
||||
|
||||
Setting up the ISG authorization is easy regardless of what management solution you use. Configuring the ISG option involves these basic steps:
|
||||
|
||||
- [Ensure that the ISG option is enabled in the WDAC policy XML](#ensure-that-the-intelligent-security-graph-option-is-enabled-in-the-wdac-policy-xml)
|
||||
- [Enable the necessary services to allow WDAC to use the ISG correctly on the client](#enable-the-necessary-services-to-allow-wdac-to-use-the-isg-correctly-on-the-client)
|
||||
|
||||
### Ensure that the Intelligent Security Graph option is enabled in the WDAC policy XML
|
||||
|
||||
In order to enable trust for executables based on classifications in the ISG, the **Enabled: Intelligent Security Graph authorization** option must be specified in the WDAC policy. This can be done with the Set-RuleOption cmdlet. In addition, it is recommended from a security perspective to also enable the **Enabled:Invalidate EAs on Reboot** option to invalidate the cached ISG results on reboot to force rechecking of applications against the ISG. Caution is advised if devices will regularly transition to and from environments that may not be able to access the ISG. The following example shows both options being set.
|
||||
|
||||
```code
|
||||
<Rules>
|
||||
<Rule>
|
||||
<Option>Enabled:Unsigned System Integrity Policy</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Advanced Boot Options Menu</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Required:Enforce Store Applications</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:UMCI</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Managed Installer</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Intelligent Security Graph Authorization</Option>
|
||||
</Rule>
|
||||
<Rule>
|
||||
<Option>Enabled:Invalidate EAs on Reboot</Option>
|
||||
</Rule>
|
||||
</Rules>
|
||||
```
|
||||
|
||||
### Enable the necessary services to allow WDAC to use the ISG correctly on the client
|
||||
|
||||
In order for the heuristics used by the ISG to function properly, a number of component in Windows need to be enabled. The easiest way to do this is to run the appidtel executable in c:\windows\system32.
|
||||
|
||||
```
|
||||
appidtel start
|
||||
```
|
||||
|
||||
For WDAC policies deployed over MDM using the AppLocker CSP this step is not required as the CSP will enable the necessary components. ISG enabled through the SCCM WDAC UX will not need this step but if custom policies are being deployed outside of the WDAC UX through SCCM then this step is required.
|
||||
|
||||
## Security considerations with using the Intelligent Security Graph
|
||||
|
||||
Since the ISG is a heuristic-based mechanism, it does not provide the same security guarantees that explicit allow or deny rules do. It is best suited for deployment to systems where each user is configured as a standard user and there are other monitoring systems in place like Windows Defender Advanced Threat Protection to help provide optics into what users are doing.
|
||||
|
||||
Users with administrator privileges or malware running as an administrator user on the system may be able to circumvent the intent of WDAC when the ISG option is allowed by circumventing or corrupting the heuristics used to assign reputation to application executables. The ISG option uses the same heuristic tracking as managed installer and so for application installers that include an option to automatically run the application at the end of the installation process the heuristic may over-authorize.
|
||||
|
||||
## Known limitations with using the Intelligent Security Graph
|
||||
|
||||
Since the ISG relies on identifying executables as being known good, there are cases where it may classify legitimate executables as unknown, leading to blocks that need to be resolved either with a rule in the WDAC policy, a catalog signed by a certificate trusted in the WDAC policy or by deployment through a WDAC managed installer. Typically, this is due to an installer or application using a dynamic file as part of execution. These files do not tend to build up known good reputation. Auto-updating applications have also been observed using this mechanism and may be flagged by the ISG.
|
||||
|
||||
Modern apps are not supported with the ISG heuristic and will need to be separately authorized in your WDAC policy. As modern apps are signed by the Microsoft Store and Microsoft Store for Business. it is straightforward to authorize modern apps with signer rules in the WDAC policy.
|
||||
|
||||
The ISG heuristic does not authorize kernel mode drivers. The WDAC policy must have rules that allow the necessary drivers to run.
|
||||
|
||||
In some cases, the code integrity logs where WDAC errors and warnings are written will contain error events for native images generated for .NET assemblies. Typically, the error is functionally benign as a blocked native image will result in the corresponding assembly being re-interpreted. Review for functionality and performance for the related applications using the native images maybe necessary in some cases.
|
||||
@ -6,7 +6,7 @@ ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.localizationpriority: high
|
||||
author: mdsakibMSFT
|
||||
ms.date: 03/01/2018
|
||||
ms.date: 06/13/2018
|
||||
---
|
||||
|
||||
# Deploy Managed Installer for Windows Defender Application Control
|
||||
|
||||
@ -10,7 +10,7 @@ ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: high
|
||||
ms.date: 03/06/2018
|
||||
ms.date: 06/13/2018
|
||||
---
|
||||
|
||||
# Windows Defender ATP data storage and privacy
|
||||
@ -27,7 +27,7 @@ This section covers some of the most frequently asked questions regarding privac
|
||||
|
||||
## What data does Windows Defender ATP collect?
|
||||
|
||||
Microsoft will collect and store information from your configured machines in a database specific to the service for administration, tracking, and reporting purposes.
|
||||
Windows Defender ATP will collect and store information from your configured machines in a customer dedicated and segregated tenant specific to the service for administration, tracking, and reporting purposes.
|
||||
|
||||
Information collected includes file data (such as file names, sizes, and hashes), process data (running processes, hashes), registry data, network connection data (host IPs and ports), and machine details (such as machine identifiers, names, and the operating system version).
|
||||
|
||||
@ -51,7 +51,7 @@ In all scenarios, data is encrypted using 256-bit [AES encyption](https://en.wik
|
||||
|
||||
## Do I have the flexibility to select where to store my data?
|
||||
|
||||
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the United Kingdom, Europe, or in the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States.
|
||||
When onboarding the service for the first time, you can choose to store your data in Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Customer data in de-identified form may also be stored in the central storage and processing systems in the United States.
|
||||
|
||||
## Is my data isolated from other customer data?
|
||||
Yes, your data is isolated through access authentication and logical segregation based on customer identifier. Each customer can only access data collected from its own organization and generic data that Microsoft provides.
|
||||
|
||||
@ -66,7 +66,7 @@ When accessing the [Windows Defender ATP portal](https://SecurityCenter.Windows.
|
||||
|
||||
You will need to set up your preferences for the Windows Defender ATP portal.
|
||||
|
||||
3. When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the United Kingdom, Europe, or The United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation.
|
||||
3. When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the European Union, the United Kingdom, or the United States. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation.
|
||||
|
||||
> [!WARNING]
|
||||
> This option cannot be changed without completely offboarding from Windows Defender ATP and completing a new enrollment process.
|
||||
|
||||
@ -36,14 +36,14 @@ For more information, see [Windows 10 Enterprise edition](https://www.microsoft.
|
||||
### Licensing requirements
|
||||
Windows Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers:
|
||||
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Education E5
|
||||
- Windows 10 Enterprise E5
|
||||
- Windows 10 Education E5
|
||||
- Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5
|
||||
|
||||
For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2).
|
||||
|
||||
### Network and data storage and configuration requirements
|
||||
When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the United Kingdom, Europe, or United States datacenter.
|
||||
When you run the onboarding wizard for the first time, you must choose where your Windows Defender Advanced Threat Protection-related information is stored: in the European Union, the United Kingdom, or the United States datacenter.
|
||||
|
||||
> [!NOTE]
|
||||
> - You cannot change your data storage location after the first-time setup.
|
||||
|
||||
@ -63,10 +63,10 @@ If you encounter an error when trying to get a refresh token when using the thre
|
||||
- For Threat intelligence API: `https://WindowsDefenderATPCustomerTiConnector`
|
||||
|
||||
5. Add the following URL:
|
||||
- For US: `https://winatpmanagement-us.securitycenter.windows.com/UserAuthenticationCallback`.
|
||||
- For Europe: `https://winatpmanagement-eu.securitycenter.windows.com/UserAuthenticationCallback`
|
||||
- For United Kingdom: `https://winatpmanagement-uk.securitycenter.windows.com/UserAuthenticationCallback`
|
||||
|
||||
- For the European Union: `https://winatpmanagement-eu.securitycenter.windows.com/UserAuthenticationCallback`
|
||||
- For the United Kingdom: `https://winatpmanagement-uk.securitycenter.windows.com/UserAuthenticationCallback`
|
||||
- For the United States: `https://winatpmanagement-us.securitycenter.windows.com/UserAuthenticationCallback`.
|
||||
|
||||
6. Click **Save**.
|
||||
|
||||
>Want to experience Windows Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-troubleshootsiem-belowfoldlink)
|
||||
|
||||
@ -11,7 +11,7 @@ ms.pagetype: security
|
||||
localizationpriority: medium
|
||||
author: andreabichsel
|
||||
ms.author: v-anbic
|
||||
ms.date: 05/30/2018
|
||||
ms.date: 06/13/2018
|
||||
---
|
||||
|
||||
|
||||
@ -123,7 +123,7 @@ This rule blocks the following file types from being run or launched from an ema
|
||||
|
||||
### Rule: Block Office applications from creating child processes
|
||||
|
||||
Office apps, such as Word or Excel, will not be allowed to create child processes.
|
||||
Office apps will not be allowed to create child processes. This includes Word, Excel, PowerPoint, OneNote, Outlook, and Access.
|
||||
|
||||
This is a typical malware behavior, especially for macro-based attacks that attempt to use Office apps to launch or download malicious executables.
|
||||
|
||||
@ -174,7 +174,6 @@ This rule attempts to block Office files that contain macro code that is capable
|
||||
This rule blocks the following file types from being run or launched unless they meet prevalence or age criteria set by admins, or they are in a trusted list or exclusion list:
|
||||
|
||||
- Executable files (such as .exe, .dll, or .scr)
|
||||
- Script files (such as a PowerShell .ps, VisualBasic .vbs, or JavaScript .js file)
|
||||
|
||||
### Rule: Use advanced protection against ransomware
|
||||
|
||||
@ -187,6 +186,9 @@ Local Security Authority Subsystem Service (LSASS) authenticates users who log i
|
||||
>[!IMPORTANT]
|
||||
>[Exclusions do not apply to this rule](customize-attack-surface-reduction.md#exclude-files-and-folders).
|
||||
|
||||
>[!NOTE]
|
||||
>Some apps are coded to enumerate all running processes and to attempt opening them with exhaustive permissions. This results in the app accessing LSASS even when it's not necessary. ASR will deny the app's process open action and log the details to the security event log. Entry in the event log for access denial by itself is not an indication of the presence of a malicious threat.
|
||||
|
||||
### Rule: Block process creations originating from PSExec and WMI commands
|
||||
|
||||
This rule blocks processes through PsExec and WMI commands from running, to prevent remote code execution that can spread malware attacks.
|
||||
|
||||
Reference in New Issue
Block a user