{"id":10633,"date":"2018-09-06T09:00:37","date_gmt":"2018-09-06T16:00:37","guid":{"rendered":""},"modified":"2024-03-07T15:48:25","modified_gmt":"2024-03-07T23:48:25","slug":"everything-you-need-to-know-about-windows-server-2019-part-3","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/windows-server\/blog\/2018\/09\/06\/everything-you-need-to-know-about-windows-server-2019-part-3\/","title":{"rendered":"Everything you need to know about Windows Server 2019 \u2013 Part 3"},"content":{"rendered":"\n

This blog post was authored by Dean Wells, Principal Program Manager, Windows Server.<\/em><\/p>\n\n\n\n

In the preceding blogs, you were given a video-tour of some of the high-level advancements made in Windows Server 2019 that touched on areas such as the improvements made around hyper-converged infrastructure (HCI), hybrid capabilities such as Azure File Sync and Azure Site Recovery, our new administrative experience with the Windows Admin Center (WAC), and an array of pretty mind-blowing storage enhancements. In this article, we\u2019ll describe some of the principles that help guide our thinking when designing security solutions and delve into a few of the innovations and enhancements we made to security in this latest Windows Server release.<\/p>\n\n\n\n

How we think about security<\/h2>\n\n\n\n

Security has long been a top priority in Windows Server and that continues with Windows Server 2019. Over the years, we\u2019ve not only invested a huge amount in developing mitigation for well-known attack vectors of the day, but also in trying to better understand how the attacks evolve over time and anything they might share in common.<\/p>\n\n\n\n

The table below highlights some of the more notable takeaways from our ongoing work and research.<\/p>\n\n\n\n

1.<\/td>The network is no longer the security perimeter (it hasn\u2019t been for some time)<\/td>Identity is the (new) security perimeter<\/td><\/tr>
2.<\/td>Entry\u2014we can\u2019t stop this from happening<\/td>People will be fooled, bribed, blackmailed, etc.<\/td><\/tr>
3.<\/td>Eliminating human error isn\u2019t possible<\/td>Phishing works and will continue to do so<\/td><\/tr>
4.<\/td>Insider-attacks are a big problem<\/td>Anomalous activity monitoring helps in detection; limit access through identity management and isolation<\/td><\/tr>
5.<\/td>Compliance is very important<\/td>But compliance and security are not the same thing:
compliant != secure<\/strong><\/td><\/tr>
6.<\/td>Prevention methods aren\u2019t always technical or architectural<\/td>Many will be operational and that will impose some level of additional operational friction\u2014security has a price $$$<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

At a high-level then, our efforts boil down to 4 core, and mostly self-explanatory guiding principles (on the left) across 3 technology dimensions (on the right).  It\u2019s worth calling out that one of those technology dimensions, managing privileged identities, has never been more important than it is today given that identity and strong authentication is steadily replacing the network as the security perimeter.<\/p>\n\n\n

\"a<\/figure>\n\n\n\n

These guiding principles and areas of focus help us ensure that we not only provide reactive mitigation to what are sadly becoming commonplace threats, but that we also build in proactive measures that prevent attacks from ever starting in the first place. Stated succinctly, security isn\u2019t a bolt-on, it\u2019s an architectural principle and one that both Windows 10 and Windows Server 2019 are walking (well, running if you\u2019ll excuse the pun) incarnations of. That\u2019s enough of our mental model, let\u2019s get on with discussing some of the new capabilities in Windows Server 2019.<\/p>\n\n\n\n

The privileged identity management capabilities provided by Windows Server 2016, such as Just Enough Administration (JEA) and Credential Guard carry forward into Windows Server 2019. For the purposes of this blog then, we\u2019ll focus on a few of the other technologies that embrace the latter two dimensions: securing the OS and providing secure fabric virtualization and virtualization-based security (VBS).<\/p>\n\n\n\n

Secure the OS<\/h2>\n\n\n\n

Technologies for mitigating code execution attacks<\/h3>\n\n\n\n

This example takes us well-down into the weeds of just two of the ways that the OS protects itself by ensuring that only legitimate, whitelisted code can run and that, when it does, it runs in the manner it was intended to.<\/p>\n\n\n\n

With Windows Defender Application Control (WDAC), administrators can create policies that block anything from running unless it\u2019s included in the whitelisted policy. Because the WDAC policy is enforced by the hypervisor, its control extends even to kernel mode components like drivers.<\/p>\n\n\n\n

Note <\/strong>that we mentioned that the policy is enforced by the hypervisor, not Hyper-V. It\u2019s pretty easy to conflate hypervisor and Hyper-V as one and the same thing\u2014they\u2019re actually not the same thing. At its core, a hypervisor controls the hardware\u2019s native virtualization capabilities and Windows uses it in two distinct ways:<\/p>\n\n\n\n

    \n
  1. Hyper-V uses the Windows hypervisor to allow you to create and run virtual machines attached to virtual networks, etc.<\/li>\n\n\n\n
  2. Windows itself (without Hyper-V) leverages the hypervisor\u2019s control over the virtualization hardware extensions to isolate various OS components from one another for the purposes of OS integrity and confidentiality.<\/li>\n<\/ol>\n\n\n\n

    With WDAC in Windows Server 2019, you can now \u201cstack\u201d multiple policies on top of one another to create a whitelist that is the aggregate of all stacked policies. It\u2019s even possible to create a policy that allows the WDAC policy to be changed without requiring a reboot!<\/p>\n\n\n\n

    Control Flow Guard (CFG) provides built-in platform security designed to combat intentional memory corruption vulnerabilities by placing restrictions on where an application can execute code from thereby making it much harder for malicious software to execute arbitrary code through vulnerabilities such as buffer overflows. With Windows Server 2019, we\u2019ve added support for kernel-mode CFG, too.<\/p>\n\n\n

    \"a<\/figure>\n\n\n\n

    Secure fabric virtualization and virtualization-based security (VBS)<\/h2>\n\n\n\n

    Support for shielding Linux VMs<\/h3>\n\n\n\n

    With Windows Server 2019, you\u2019re now able to protect your Linux workloads by running them inside shielded VMs. By leveraging the same protections as Windows VMs including Secure Boot, template disk signing, a secure provisioning process, and TPM-sealed disk encryption keys, you\u2019re able to protect data in your Linux VMs at rest and in flight when migrating the VM between two Hyper-V hosts. Under the hood, we\u2019re leveraging the native dm-crypt disk encryption technology to enable the VM to encrypt itself and ensure the VM owner is the only entity with access to the disk encryption passphrases. Learn how to get started with Linux shielded VMs<\/a> and check out the open source tools<\/a> that power them.<\/p>\n\n\n\n

    Simplified host attestation model<\/h3>\n\n\n\n

    In Windows Server 2019, we are introducing a new attestation mode based on asymmetric key pairs called Host Key attestation. This mode is designed to greatly simplify setup in environments where TPM attestation is not possible. It offers similar assurances to the existing Active Directory attestation mode, in that possession of the key is enough to be able to run shielded VMs, but does not require an Active Directory trust to be established (the hosts don\u2019t even need to be domain joined). A TPM is not required on the Hyper-V host, which also means that HGS will not validate the hardware or software configuration on the host as it does with TPM mode. Check out how to deploy the Host Guardian Service and configure it and Hyper-V hosts for Host Key attestation<\/a>.<\/p>\n\n\n\n

    What next?<\/h2>\n\n\n\n

    There\u2019s a huge array of new capabilities in Windows Server 2019 so it\u2019s well worthwhile getting yourself ahead of the learning curve by downloading the Windows Server 2019 preview<\/a> release and giving these new capabilities a test drive yourself. You can also join the conversation going on in the Windows Server Tech Community space<\/a>.<\/p>\n\n\n\n

    Check out the previous blog posts in this series:<\/p>\n\n\n\n