Slashdot Mirror
Microsoft Publishes SECCON Framework For Securing Windows 10 (zdnet.com)
An anonymous reader writes: Microsoft published today a generic "security configuration framework" that contains guidance for systems administrators about the basic security settings they should be applying in order to secure Windows 10 devices. The SECCON framework, the name Microsoft gave this framework, is are five different recommendations for securing a Windows 10 device, depending on its role inside an organization (Enterprise security, Enterprise high-security, Enterprise VIP security, DevOps, Administrator). [Note: last two docs are empty and don't include any info just yet].
For each of these security levels, Microsoft has published default templates for Windows policies that sysadmins can apply to desired PCs, based on the access levels those workstations have. Microsoft hopes this will automate a system administrator's job in deploying a basic minimum of security features to Windows 10 systems, on which custom modifications can then be made, depending on each enterprise's needs.
For each of these security levels, Microsoft has published default templates for Windows policies that sysadmins can apply to desired PCs, based on the access levels those workstations have. Microsoft hopes this will automate a system administrator's job in deploying a basic minimum of security features to Windows 10 systems, on which custom modifications can then be made, depending on each enterprise's needs.
If you want proprietary and proprietary games, you deserve security problems.
1. Reformat!
2. Install linux!
3. Partaaaay!
practical
Most of us would want to make sure it disables all the user-tracking stuff.
Of course, a lot of the settings I saw can only be set if you have the Enterprise version of Windows, so home and pro users are stuck...
Disconnect PC from any network or other connectivity protocol.
This was an actual requirement for security certification for the NT 3.51 OS
"A person is smart. People are dumb, panicky dangerous animals and you know it." - K
1. Run inside a virtual machine, it get's limited network access
2. limit the network access even further on the router - it gets no updates
3. limit the internal network access even further, it sees nothing on the LAN, it only sees a network share, and that only contains the files it needs to see.
4. limit the hardware it can see, windows actually performs nicely on simple hardware, the more complex the hardware, the more crashes
5. a pi-hole further limits what gets to the machine
6. exfiltration of data is limited on the router
No? Then it is not a security guide or rather one that is worthless...
(I assume it does not. In good /. tradition, I have not looked at the documents...)
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Next, lets have the inmates run the asylum!
'Microsoft' and 'security' in the same sentence? AAAHahahahahaha, that's hilarious, my sides, they're exploding, I'm laughing so hard!
The only 'security' I'd want if I had to use Windows anymore (and I don't; Ubuntu master-race, here) is securing it against Microsoft intrusion into my computer that I bought and paid for. Bugger off Microsoft.
Ever waited for 10 or more minutes on the Welcome or Logout screens?
I did. An its freaking annoying.
A couple months ago I was asked to use the "Windows 10 security baseline" to determine the security of our v1809 image before we rolled it out.... The baseline turned out to be a vague spreadsheet full of random registry key changes and a GPO policy that you're supposed to import. It was hard to believe that the closest thing MS had to an official security framework for their own OS was a half-assed spreadsheet and a policy!
At least now we have official configuration frameworks to compare our workstations against. If every OS had an in-depth security framework the world would be a *slightly* safer place.
--Yep. "Windows security" is kind of like "Military intelligence"... Especially if you're on the front lines. Fully patched Win boxes are still prone to probably hundreds of different exploits, not the least being social hacks and encryption malware.
https://thehackernews.com/2018...
--And don't forget the 0-day hax, 3rd-party software vulns, and shared DLL libraries that have been around since the 90's and never code-audited. Last but not least, they now have to worry about the WSL layer as a possible attack vector.
/ there's a reason I've been a Linux guy for a LONG time now
// and an extra slashy for OSX/iMac being my primary desktop these days
.
== WolfriderV6 == I'm willing to admit that *I just might* be wrong... Are you??
I have to admit that after 20 years of dealing with Windows to the point where it was childs' play I have to struggle a little with non-routine tasks and problems with Ubuntu but I know it's worth it in the long run and so far I've been able to solve 99% of anything that comes up. Com-port problems with WINE are still kicking my ass though, as are com-port problems in general.
Fully patched Win boxes are still prone to probably hundreds of different exploits, not the least being social hacks and encryption malware.
Keep in mind "security policy" is not the same thing as "the state of your security"
"Security policy" are the way you *want* it to behave. Actual security is how well it does that.
An exploit, by definition, is code working in an intended way and not following the security policy.
If it was intended, it wouldn't be an exploit but instead be a back door.
The types of things here, being security policy, are for example what defines a complex password, how often to force a password change, and how many previous passwords to keep stored to prevent reuse.
Separate from that would be an exploit allowing one to bypass the authentication system completely.
This isn't a fault in the policy itself, it is a fault in the software not enforcing the policy as stated.
That what microsoft is offering here is only policies, it would of course have no effect what so ever on the software properly enforcing them, so details like you provide are fairly off topic.
Only really their track record of so poorly enforcing your policy would be relevant.
In fact these same policies could be applied to any OS. I can tell Linux you must use a 16 character minimum password just as well as Windows.
That's the extent of a security policies scope.
Stating "16 char minimum password" wouldn't raise the likelihood of an Linux exploit, nor patch a Linux exploit, any more than in Windows. That's a different subject matter all together.
So yes, the only relevant part of bringing up exploits would be akin to trusting Linux developers more than Windows developers to write code that does what it says it will do.