{"id":6821,"date":"2015-11-18T12:00:00","date_gmt":"2015-11-18T12:00:00","guid":{"rendered":"https:\/\/blogs.technet.microsoft.com\/windowsserver\/2015\/11\/18\/protecting-your-datacenter-and-cloud-november-update\/"},"modified":"2024-03-11T09:20:37","modified_gmt":"2024-03-11T16:20:37","slug":"protecting-your-datacenter-and-cloud-november-update","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/windows-server\/blog\/2015\/11\/18\/protecting-your-datacenter-and-cloud-november-update\/","title":{"rendered":"Protecting your datacenter and cloud: November update"},"content":{"rendered":"\n
This post was authored by the Windows Server Security and Assurance Team<\/em><\/p>\n\n\n\n Six months ago, in a previous blog post \u201cProtecting your datacenter and cloud from emerging threats\u201d we introduced our strategy and direction on how Microsoft can help customers protect their datacenter and private cloud from emerging threats.<\/p>\n\n\n\n In this post, we\u2019ll cover the great progress that was made since May 2015 in each of the areas we were focusing on and what offerings are already available for you to better secure your environment.<\/p>\n\n\n\n Landscape shifts that affect the way we think about security<\/strong><\/p>\n\n\n\n Looking at the datacenter and cloud through security lenses, there are two major aspects that we need to pay attention to.<\/p>\n\n\n\n 1. Virtualization is everywhere and increasing number of high value assets such as domain controllers and company sensitive workloads are virtualized. While operationally this makes a lot of sense, from a security point of view, this shift increases the attack vectors ten-fold as anyone that has access to the storage, backup, network, hosts or fabric controller where these Virtual Machines are running can compromise them.<\/p>\n\n\n\n <\/p>\n\n\n\n 2. Gaining administrative rights is a common attack vector. We trust our administrators but when their accounts are compromised through any of the ways attackers use today (such as phishing and malware), the attackers gain unprecedented access to the environment and can then stay in the system for a long time undetected.<\/p>\n\n\n\n <\/p>\n\n\n\n Principles for security and assurance solutions<\/strong><\/p>\n\n\n\n We have established a few key guiding principles that drive our work in security and assurance:<\/p>\n\n\n\n \u2022 Assume breach: analyze the environment to determine how an attack may propagate and make changes to contain any compromise by preventing lateral movement of the attacker inside the environment. <\/p>\n\n\n\n Focus areas for datacenter and private cloud security<\/strong>:<\/p>\n\n\n\n Given the \u201cAssume Breach\u201d mindset and the desire to protect existing environments, we focused our initiatives on three main areas:<\/p>\n\n\n\n Since May, 2015 we have continuously delivered security solutions in the form of cloud services, released products and technical previews so that you can start evaluating and using these solutions to protect your environment.<\/p>\n\n\n\n Protecting Virtual Machines (Workloads) from fabric attacks<\/strong><\/p>\n\n\n\n With the shift to virtualization, most of us are running critical and high value workloads as virtual machines. Consider your identity infrastructure (e.g.: Domain controllers) or your most sensitive business applications that have access to customer data running as VMs.<\/p>\n\n\n\n This leads to new attack vectors that did not exist in the past. Any administrator on the storage, network, management tools and host has access to these Virtual Machines. This includes not only the highly trusted administrators but also people that have access to the disks, network controllers, patching and so on\u2026<\/p>\n\n\n\n To put it plainly, if we \u201cassume breach\u201d of a datacenter administrator, it can lead to a lateral movement attack, where all the virtual machines running in that datacenter are accessible to the attacker who is then able to stealthily access sensitive information and inject malicious executables.<\/p>\n\n\n\n In Windows Server 2016 Technical Preview 4 and System Center Virtual Machine Manager 2016 Technical Preview 4, we are enabling an end to end solution for Shielded Virtual Machines that protects all \u201cGeneration 2\u201d Windows virtual machines (Starting from Windows Server 2012\/Windows 8) on storage, and on the network, and allows running the virtual machine only on Guarded Hosts that are hardened so that even an administrator on the host where the virtual machine is running will require to break protection techniques applied to the host in order to compromise the virtual machine data.<\/p>\n\n\n\n In parallel, Azure customers can take advantage of the new Azure Disk Encryption that enables encryption of Windows Virtual Machines using BitLocker Drive Encryption and Linux Virtual Machines using DM-Crypt.<\/p>\n\n\n\n <\/p>\n\n\n\n Privileged Access Management<\/strong><\/p>\n\n\n\n Security experts tell us that compromised administrator privileges are the common attack vector. Once an attacker gains access to an administrator account, they can escalate their privilege to create backdoors and eventually control an entire Active Directory domain.<\/p>\n\n\n\n There are best practices and solutions that will considerably increase the security of your organization to avoid compromise and contain the extent of the damage in case that happens:<\/p>\n\n\n\n <\/p>\n\n\n\n To help customers manage and secure their Privilege Access, in Aug. 2015, we released Microsoft Identity Manager <\/a>2016 (MIM 2016). This supports:<\/p>\n\n\n\n The focus is protecting privileged administrative access for applications in existing Windows Server environments, so that there is no need to change your groups or access control rules in order to deploy MIM 2016 Privileged Access Management in your organization.<\/p>\n\n\n\n <\/p>\n\n\n\n At the same time, we also introduced the Azure AD Privileged Identity Management <\/a>to apply Privileged Access Management and monitoring to Microsoft Online Services, such as Azure AD and Office 365.<\/p>\n\n\n\n These solutions enable you to control your administration workflows on-premises and in the cloud. MIM 2016 provide Windows PowerShell, SOAP and REST based APIs so that you can call from existing trouble ticket or service desk automation systems into these solutions.<\/p>\n\n\n\n For hardened administration workstations, we highly recommend that you take a look at the Windows 10 Device Guard <\/a>solution. This enables you to completely lock down machines that administrators use to access servers and sensitive workloads. Device Guard helps harden these workstations against malicious code that could execute while an administrator is accessing the most sensitive areas of your organization.<\/p>\n\n\n\n In addition, we are releasing our first version of Just Enough Administration <\/a>to enable PowerShell based \u201cRole Based Access Control\u201d. This is released as part of the Windows Management Framework 5.0 and will be available for Windows Server 2008 R2\/Windows 7 and later versions so that you can deploy it in existing environments.<\/p>\n\n\n\n Just Enough Administration (JEA) is all about removing administration privilege from as many user accounts as possible while still allowing them to do their job. If for example, someone is responsible for DNS management on the domain controller, they should be able to restart the DNS services and flush the DNS but they should not need to be domain administrators to do so. In the first version of JEA, we provide a flexible role-based administration framework. We also provide specific guidance on how to use JEA on domain controllers and for general server maintenance.<\/p>\n\n\n\n Threat detection and response<\/strong><\/p>\n\n\n\n This brings us to the detection and forensics. We know that the attackers are clever, and they learn and adapt. We also know that accuracy is important so that you don\u2019t find yourself drowning in false positive investigations.<\/p>\n\n\n\n Two great offerings are now publically available from Microsoft:<\/p>\n\n\n\n The first is Microsoft Advanced Threat Analytics<\/a>. This is an on-premises platform that uses Active Directory network traffic and SIEM data to discover and alert on potential threats. ATA\u2019s high-accuracy detection is enabled by a combination of its unique deterministic detection engine, network and entities resolution engine and world-class machine learning algorithms. This combination also allows ATA to map the potential impact of the attacker and tell the attack story in a clear and actionable Attack Timeline.<\/p>\n\n\n\n <\/p>\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n
\u2022 Protect existing environments without requiring major upgrades and re-architecture of your datacenter or hosting infrastructure.
\u2022 Support the extension of your datacenter into the Azure cloud while bringing the Azure security and security operations to the datacenter and private cloud.<\/p>\n\n\n\n
<\/a><\/figure>\n\n\n\n\n
<\/figure>\n\n\n\n\n
<\/figure>\n\n\n\n\n
<\/figure>\n\n\n\n
<\/figure>\n\n\n\n