Location via proxy:   [ UP ]  
[Report a bug]   [Manage cookies]                
SlideShare a Scribd company logo
Time to Inspire
Beveilig data met Windows 10
Danny de Vries
“Cyber security is a
CEO issue.”
-McKinsey
Malicious Attachment Execution
Browser or Doc Exploit Execution
Stolen Credential Use
Internet Service Compromise
Kernel-mode Malware
Kernel Exploits
Pass-the-Hash
Malicious Attachment Delivery
Browser or Doc Exploit Delivery
Phishing Attacks
ESPIONAGE, LOSS OF IPDATA THEFT RANSOMLOST PRODUCTIVITYBUSINESS DISRUPTION
ENTER
ESTABLISH
EXPAND
ENDGAME
NETWORK
DEVICE
USER
Anatomy of an attack
PASS-THE-HASH
Browser or Doc Exploit Execution
Theft of sensitive information, disruption of government.
PHISHING
NETWORK
DEVICE
USER
ENDGAME
Anatomy of an attack
PASS-THE-HASH
Browser or Doc Exploit Execution
Theft of sensitive information, disruption of government.
PHISHING
NETWORK
DEVICE
USER
ENDGAME
Anatomy of an attack
http://natoint.com/900117-spain-forces-conclude-mission-in-central-african-republic/
Browser or Doc Exploit Execution
PHISHING
ENDGAME
PASS-THE-HASH
Browser or Doc Exploit Execution
Theft of sensitive information, disruption of government.
PHISHING
NETWORK
DEVICE
USER
ENDGAME
Anatomy of an attack
PASS-THE-HASH NETWORK
DEVICE
USER
Land on exploit page
Exploit runs
Redirected to legitimate page
Total Elapsed Time: 00:00.1
The Windows 10
Defense Stack
Protect, Detect & Respond
Windows as a Service
Threat protection over
time
Attackers take advantage
of periods between
releases
P R O D U C T
R E L E A S E
CAPABILITY
Windows as a Service
P R O D U C T
R E L E A S E
T H R E A T
S O P H I S T I C A T I O N
CAPABILITY
Game change with
Windows and
Software as a Services
Disrupt and out
innovate our
adversaries by
design
Protection Gap
Windows 7 Security features
Windows 10 Security on
Legacy or Modern Devices
(Upgraded from Windows 7 or 32-bit Windows 8)
Windows 10 Security on
Modern Devices
(Fresh Install or upgraded from 64-bit Windows 8)
Virtualization Based
Security
Traditional Platform Stack
Device Hardware
Kernel
Windows Platform Services
Apps
Virtualization Based Security
Kernel
Windows Platform
Services
Apps
Kernel
System Container
Trustlet#1
Trustlet#2
Trustlet#3
Hypervisor
Device Hardware
Windows Operating System
Hyper-VHyper-V
The Future
Credential Guard
Access to one device can
lead to access to many
1.
Single IT Pro’s machine is
compromised
IT Pro manages
kiosks/shared devices on
network
Attacker steals IT Pro’s
access token
2.
Using IT Pros access
token attacker looks for
kiosk/shared devices and
mines them for tokens
3.
Repeat
Credential Guard
 Pass the Hash (PtH) attacks are
the #1 go-to tool for hackers.
Used in nearly every major
breach and APT type of attack
 Credential Guard uses VBS to
isolate Windows authentication
from Windows operating system
 Protects LSA Service (LSASS) and
derived credentials (NTLM Hash)
 Fundamentally breaks derived
credential theft using MimiKatz,
Demo:
Credential Guard
Introducing
Windows Defender
Application Guard
Application Guard for
Microsoft Edge
Application Guard for
Microsoft Edge
Information Protection
Information Protection Needs
Information Protection Needs
Market Solutions for
Data Loss Prevention
Windows Information
Protection Lifecycle
Demo:
Windows Information
Protection
Did I inspire you?
Follow me on Twitter:
@EBOOZ

More Related Content

Beveilig je data met windows 10