Session objectives Takeaways Yahoo Reveals Massive Breach of

Session objectives: Takeaways:

Yahoo Reveals Massive Breach of Data from 500 M Accounts “ Credential theft is today’s crisis … , ” Paul Blake, ABC News September 22 2016 Source: “Yahoo Reveals Massive Data Breach. . ABC News Sep 22 2016

Equifax data breach may affect half US population “ And the hits keep on coming. . Alfred Ng, CNET September 7 2017 Source: https: //www. cnet. com/news/equifax-data-leak-hits-nearly-half-ofthe-us-population/

What is Single Sign-on (SSO)? Users enter credentials once Applications authenticate transparently

What are credentials? Usernames & passwords Certificates or public/private key pairs Derived credentials

What data can an admin access? Well-behaved admins Admins can elevate to system

How on-prem credential theft attacks work Step 3: Step 1: Get Administrator privilege on device Step 2: Read secrets from protected memory Use secrets to attack other devices to obtain administrator privilege Repeat until obtain domain administrator privilege

How this results in gaining domain admin Control Data and Services Access

Conditions required for credential theft attacks Admin privilege Attacker can elevate to SYSTEM Available Credentials present to extract Extractable Ability to remove credential from device Usable Ability to use credential from another device

Credential Protections to date Win 10 v 1507 WS 2016 Win 10 v 1607 Remote Credential Guard for signed-in user PKINIT freshness extension clientside Kerberos key trust PKINIT freshness extension DC-side Rolling public key user's NTLM secrets Allowing network NTLM when user restricted to specific devices Remote Credential Guard for supplied credentials Token Binding protocol w/ VBS protection Win 10 v 1709 MDM support for Credential Guard & VBS 2017 2014 Reduces plaintext password exposure Delete credentials on sign-off Protected Users Restricted Admin Local account & member of administrators group Protected Users DC-side protections Authentication Policies 2015 Win 8. 1 Credential Guard for signed-in user Domain-joined device can sign on with public key Kerberos IPV 4/6 address hostname support 2016 WS 2012 R 2 Win 10 v 1703

Saved Domain credentials NTLM secrets Credential Guard Virtualization Based Security (VBS) Private Key MSA secrets AAD secrets Private Key TPM Token Binding Keys Hello Kerberos secrets Auth blob Azure AD Microsoft Accounts Smart Cards The “Guards” Key Guard VBS Key

What is virtualization-based security? The technology Credential Guard is built on Uses the hypervisor for memory protection Isolated User Mode (IUM)

Attempts to read & write data fail

Why is this better? The attack surface of Windows is very large Virtual trust levels move the bar

Device Guard and Credential Guard Hardware Readiness Tool: https: //www. microsoft. com/download/details. aspx? id=53337

Note since Credential Guard protected signed on credentials, MS-CHAPv 2 will prompt for credentials. Upgrade Wi-Fi & VPN if needed

Move to bound public keys for sign on See

Deep Dive into Credential Guard Windows 10 Virtual Secure Mode Isolated User Mode in Windows 10 Isolated User Mode Processes and Features in Windows 10 Mitigating Credential Theft using the Windows 10 Isolated User Mode Protect derived domain credentials with Credential Guard

Token binding • Details: https: //docs. microsoft. com/en-us/windows-server/security/token- binding/introducing-token-binding

https: //docs. microsoft. com/en-us/windows/client-management/mdm/policy-csp -deviceguard https: //docs. microsoft. com/en-us/windows/clientmanagement/mdm/devicestatus-csp

Import-Pfx. Certificate -Protect. Private. Key VSM test. pfx When importing via the Import wizard:

https: //docs. microsoft. com/en-us/windows/access-protection/remotecredential-guard#remote-credential-guard-requirements

Protect Remote Desktop credentials with Remote Credential Guard Link: https: //technet. microsoft. com/en-us/itpro/windows/keep-secure/remote-credential-guard

Windows Insider Lab for Enterprise Give us feedback: ymehta@microsoft. com

https: //myignite. microsoft. com/evaluations https: //aka. ms/ignite. mobileapp