Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

2/10/2017
01:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
100%
0%

Microsoft Beefs Up Enterprise Security In Windows 10, Surface

Microsoft's wave of security news targets hardware, Azure, Office 365, Windows 10, and SQL Server to safeguard business data.

Microsoft is making a series of announcements at next week's RSA Conference as part of its broader enterprise security strategy.

It has been more than a year since Microsoft announced plans to invest $1B in an integrated security strategy across products and services including Windows, Azure, and Office. Initiatives have driven progress in identity protection, data management, and staying ahead of attackers.

Now Microsoft is expanding on its security efforts with updates related to Windows 10, Surface hardware, Windows Defender Advanced Threat Protection (WDATP), Windows Hello, and Windows Analytics.

Surface is getting extra protection at the hardware layer with Surface Enterprise Management Mode (SEMM). This is geared towards heavily regulated industries that need physical protection; for example, the option to disable cameras or microphones in classified areas.

SEMM lets businesses control hardware configuration and OS processes within device firmware. Configuration can be applied to specific times of day, WiFi networks, Ethernet, Bluetooth, app access, and certificates that can be launched via initial deployments or pushed to cloud.

"In some of the most secure and locked-down environments, customers want to know how software is deployed and whether it's in policy," says Rob Lefferts, Microsoft's director of program management for Windows Enterprise and Security.

Admins must have physical possession of the device, and unique certificate signatures, to make any changes. This Surface security update can be deployed on Surface Pro 4, Surface Book, or Surface Studio.

Microsoft is also broadening device management in Windows 10 by bringing security configurations in Security Baseline Policies to MDM solutions. Previously, these settings were limited to Group Policy. It's also shipping the MDM Migration Analytics Tool to help report on Group Policy settings and configure policies for Windows 10 MDM managed devices.

WDATP, first announced at last year's RSA Conference, is getting a few adjustments. Users will be able to add customize detection rules and use "time travel" detections to look back through the previous six months of data and find undiscovered attacks.

Microsoft is also integrating security alerts from across the Windows security stack. Users can view malware reports, state of antivirus, and other advanced threats in one place.

In a one-year update following the $1B security investment, Microsoft CVP and CISO Bret Arsenault said one of his goals was to completely eliminate passwords within the next two years.

It's getting one step closer with new adjustments to Windows Hello, which is being expanded to all organizations with on-prem Active Directory-only environments. Previously, it was only available to devices with Windows 10.

"We want to make sure as many customers as possible can take advantage of new security features," says Lefferts of the news.

Windows Hello is also being updated with Dynamic Lock, which automatically locks down a device when the user walks away. Bluetooth signals determine the distance between the user's mobile phone and Windows 10 device, and can help block unauthorized device access.

Microsoft is working with Intel on an initiative called Project EVO, which will integrate Windows Hello with Intel's Authentice tech. The idea is to bring the hardware-based authentication of Intel's tool to protect Hello users from more advanced threats.

On the analytics front, Microsoft is broadening its Windows Analytics portfolio to include Update Compliance. The idea behind this is to give a broad view of Windows 10 update compliance for both monthly and feature updates. Businesses can use it to watch deployment progress, pinpoint problems, and maintain a broader view of their patched environment.

Update Compliance will be free; it's in public preview starting today.

Finally, Microsoft is announcing that the National Security Agency (NSA) is adding Surface devices (Pro 3, Pro 4, and Surface Book) to its list of Commercial Solutions for Classified Programs (CSfC).

"The cybersecurity landscape is in a situation of ever-increasing threats," says Lefferts. "As the world becomes more connected, the opportunities keep coming up for bad guys to do bag things, and profit from it."

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.
CVE-2020-24119
PUBLISHED: 2021-05-14
A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect.
CVE-2020-27833
PUBLISHED: 2021-05-14
A Zip Slip vulnerability was found in the oc binary in openshift-clients where an arbitrary file write is achieved by using a specially crafted raw container image (.tar file) which contains symbolic links. The vulnerability is limited to the command `oc image extract`. If a symbolic link is first c...