{"id":10561,"date":"2018-05-24T16:06:17","date_gmt":"2018-05-24T23:06:17","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=10561"},"modified":"2023-06-18T13:20:39","modified_gmt":"2023-06-18T20:20:39","slug":"protecting-high-risk-environments-with-secure-admin-workstations","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-high-risk-environments-with-secure-admin-workstations\/","title":{"rendered":"Protecting high-risk environments with secure admin workstations"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
As malicious threats evolve, companies add multilayer security and take a defense-in-depth approach as they strive to protect their enterprises. One element in our network security strategy at Microsoft is the secure admin workstation (SAW). These limited-use client computers\u2014built on Windows 10\u2014help protect high-risk environments from security risks such as malware, phishing, and pass-the-hash attacks, and they provide secure access to restricted environments.<\/p>\n
Security attacks are evolving and becoming more sophisticated in large organizational environments, and to say that IT teams are concerned is an understatement. Secure admin workstations (SAWs) can be invaluable in the security toolkit for any organization. Microsoft Digital has discovered a particularly effective use for SAWs in protecting high-risk environments. Learn what SAWs are, how Microsoft uses them, and why other organizations might adopt them.<\/p>\n
Secure admin workstations are limited-use client machines that are built to substantially reduce the risk of compromise from malware, phishing attacks, bogus websites, and pass-the-hash (PtH) attacks, among other security risks. Although SAWs can\u2019t be considered a \u201csilver bullet\u201d security solution for these attacks, Microsoft has found these clients to be helpful as part of a layered, defense-in-depth approach to security.<\/p>\n
Microsoft partners with manufacturers to build these devices, and what\u2019s unique about them is what they don\u2019t include: software, such as productivity suites and other utilities that are potentially vulnerable to malware and phishing attacks. For example, users can\u2019t be tricked into clicking a link in an email phishing attack if they don\u2019t have an email program running. Productivity tools and high-risk applications that aren\u2019t required for the secure admin role are installed and used on a separate \u201cproductivity virtual machine,\u201d which is hosted on the SAW. This configuration allows the user to access the productivity tools and applications they need without increasing risk to the secure admin environment.<\/p>\n
Microsoft allows only approved applications to run on the workstation. High-risk items don\u2019t make the list. Which applications make the approved list can vary,\u00a0but the point of the process is to carefully vet the list and make security a high priority. The SAW can include a limited version of Microsoft Edge that is filtered and uses a proxy server to access the administrative sites the user needs.<\/p>\n
In the context of protecting high-risk environments, SAWs are used for making secure connections to the environment and that\u2019s pretty much their only function. As one principal IT service engineer puts it, \u201cSAWs for high-risk environments (HREs) are like giant smart cards, identifying and authenticating that the user is allowed to get in the door.\u201d<\/p>\n
Given the nature of HREs, it\u2019s understandable that an organization would want to restrict access to SAWs and have a process in place for how these machines are assigned and distributed. For Microsoft, the sequence follows this general pattern:<\/p>\n
After approved users have the SAW, they use it as needed to access the HREs. In practice, the SAW becomes a second device for them, with their standard machine used for day-to-day work and the SAW used for privileged work. Users experience a bit of a learning curve as they adjust to the limited functionality of the SAW. For more information about the user experience, see the\u00a0Recommendations and limitations\u00a0<\/i>section.<\/p>\nHow SAWs are used for HREs at Microsoft<\/h3>\n
The SAW isn\u2019t granting rights to any actual resource; it merely provides a connection to a secure server, which itself connects to the HRE. Specifically, a SAW enables users to use two-factor authentication to make a Microsoft Remote Desktop Protocol connection through a bank of Remote Desktop Services servers for each HRE.<\/p>\n