Introduction

I have to admit, I’m not in love with the new Windows 8 user interface. The design formerly known as Metro is just not right for everyday work on a desktop workstation, there are plenty of other glitches, but I’m going not going to get into those right now. Because everybody is painfully aware of them and rumour has it that Microsoft has finally gotten the message.

However, under the hood, Windows 8 is not so bad and has added more security features to enforce the desktop security.

Defence Strategy

Going back to our scope here; in this article we’ll create a skeleton for a security baseline to be applied to Windows 8 desktops. Unfortunately, this can only be a generic approach, as the effective implementation in your environment needs fine tuning. Prior to this task, you should conduct a security vulnerability, risk and exposure analysis that will lead you to the requirements to be fulfilled by the Security Baseline. Basically the strategy should target following areas:

• Implementation of a Security Baseline (hardening)
• Defence against Malware
• Protection against Sensitive Data

Let’s start with some generic desktop security advices:

• Deny unauthorized device boot
• Don’t use privileged user accounts for day-to-day work
• Use a different browser to access the internet
• Use a browser with granular control on plug-ins (like Chrome or Firefox)
• Remove the windows APPs and disable the Windows APP store
• Use an alternative Adobe reader (without scripting or “active contents” support)
• Avoid local storage for important data
• Use encrypted storage to back up your files (Yes, especially on USB-sticks or external HDD)
• Activate the local firewall service and configure its policy to your needs
• Implement AppLocker as Malware prevention tool
• Disable 16-Bit and Posix subsystems (where applicable)
• Check your security settings on a regular basis (Microsoft Security Baseline Analyzer – MBSA is a good starting point)
• Last but not least: patch operating system and applications ASAP!

Baseline Settings

Here we define our skeleton for the Windows 8 Security Baseline, please note that I’ve omitted all settings already secured by default.

All credits for the settings names and descriptions goes to Microsoft Security Compliance Manager – SCM

Going Further

Here are some advanced recommendations that you may add in consideration when handling with very exposed devices (notebooks) or with access to Confidential Data:

• Secure and encrypt local boot and storage devices (with tools like BitLocker or TrueCrypt
• Use Dual-Factor user Authentication (with OTP, PKI or Challenge-Response enabled devices)
• Avoid the use of JAVA
• Avoid the use of Adobe FLASH
• Implement an Application Whitelist enforcement, leveraging features available in AppLocker / SRP
• Implement Sandboxing/Virtualization in the Operating System and/or Applications (more information below)
• Implement central Log Management to get the information and get reports out of it before it disappears

If one or more of these recommendations are not sustainable for your environment, consider a segregation/virtualization approach. This could be implementing Micro Virtualization technologies like in Bromium vSentry or a remote execution environment in a dedicated VDI infrastructure for a specific purpose (like internet browsing). Other technology that may help in these regards could be:

• “OS Enhancement” sandboxing like Sandboxie or
• Trustware’s BufferZone

The idea behind all this is to limit the privileges needed by applications and to segregate operations as much as possible, reflecting the security approach of the Principles of Least Privileges.

Conclusion

No. This is not the end… but just the beginning; because, like an old friend of mine likes to say, “The fine tuning is going to kill us all!”

Have fun and don’t get bored ;)

About the Author

Andrea Covello has been working in information security since the 1990s. His strengths are in engineering, specializing in Windows security, firewalling and advanced virtualization.

Links

• http://en.wikipedia.org/wiki/Principle_of_least_privilege
• http://technet.microsoft.com/en-us/library/cc734043.aspx
• http://technet.microsoft.com/en-us/library/hh831409.aspx
• http://technet.microsoft.com/en-us/library/hh831713.aspx
• http://winsupersite.com/windows-8/threshold-be-called-windows-9-ship-april-2015
• http://www.bromium.com/innovations/micro-virtualization.html
• http://www.bromium.com/products.html
• http://www.microsoft.com/en-us/download/details.aspx?id=16776
• http://www.sandboxie.com/
• http://www.truecrypt.org/
• http://www.trustware.com/index.php?id=products_home