Over the years, security has evolved from being a shared role or a role that was non-existent within a business. Today, well-defined teams and organizational structures exist or are being created to focus solely on security. Not only are these teams maturing constantly, but the Chief Information Security Officer (CISO) has become a person of significant importance and may report directly to a Chief Executive Officer (CEO) and not the Chief Information Officer (CIO).

Over the years, many roles that never existed before have begun to appear within the security world, and new skill sets are always in demand. As an overview, here are some of the more common security roles that you can expect to see within a security program: CISO/CSO, Information Technology (IT) Security Director, IT Security Manager, Security Architect/Engineer, Security Analyst, Security/Compliance Officer, Security Administrator, Security Engineer, Software/Application Security Developer, Software/Application Security Engineer, Cryptographer/Cryptologist, Security Consultant/Specialist, Network Security Engineer, and Cloud Security Architect.

As an example, the following screenshot shows what a security organization may look like through an organization chart. Every organization is different, but this will provide you with a basis of what can be expected:

Figure 1.1 – Sample organization structure

One thing to point out regarding these roles is the shortage of a cybersecurity workforce throughout the world. Although an ongoing concern, the great news is that since the original version of this publication, there has been a significant increase in cybersecurity professionals worldwide, according to the cybersecurity workforce study by the International Information System Security Certification Consortium ((ISC)²). The updated (ISC)² 2021 Cybersecurity Workforce Study shows that a worldwide growth of 65% is still needed to meet the demand for cyber experts, which is significantly down from 2019 when 145% growth was needed. The study estimates that there are approximately 4.19 million cybersecurity professionals globally. This is an increase of more than 700,000 from 2020. The ongoing challenge continues to be with the growth of new positions that are continuously being created as cybersecurity programs continue to enhance. This makes it difficult to find well-seasoned talent and may require you to think outside the box as you look to onboard those new to the field or looking to shift careers. You can read more about the (ISC)² 2021 Cybersecurity Workforce Study here: https://www.isc2.org/Research/Workforce-Study.

One of the primary factors for a growing need for security experts correlates to the advancement of the personal computer (or PC) and its evolution throughout the years. The PC has changed the way we connect, and with this evolution comes the supporting infrastructure, which has evolved into the many data centers seen throughout the world.

As we are all aware, Windows has been the victim of numerous vulnerabilities over the years and continues to be a victim even today. The initial idea behind the Windows Operating System (OS) was a strong focus on usability and productivity. As a result of its success and adoption across the globe, it became a common target for exploits. This, in turn, created many gaps in the security of Windows that have traditionally been filled by many other companies. A good example was the need for third-party AV software. As the world has turned more toward digitization over the years and Windows usage has continued to grow, so has the need for improved security, along with dedicated roles within this area. Protecting Windows has not been an easy task, and it continues to be an ongoing challenge.

Today, we are more reliant on technology than ever and live in a world where businesses cannot survive without it. As our younger generations grow up, there is greater demand for the use of advanced technology. One scary thought is how fast the world has grown within the previous 100 years compared to the overall history of mankind. Technology continues to push the boundaries of innovation, and a significant portion of that change must include the securing of this technology, especially since the world has become a more connected place with the advancement of the internet.

To give you a rough idea of technology usage today, let’s take a look at the current desktop usage throughout the world. For these statistics, we will reference an online service called StatCounter GlobalStats: https://gs.statcounter.com/. This dataset is not all-inclusive, but there is a very large sampling of data used to give us a good idea of worldwide usage. StatCounter GlobalStats collects its data through web analytics via a tracking code on over 2 million websites globally. The aggregation of this data equates to more than 10 billion page views per month. The following screenshot shows the OS market share that is in use worldwide. More information from StatCounter can be viewed at https://gs.statcounter.com/os-market-share/desktop/worldwide:

Figure 1.2 – StatCounter desktop OS market share worldwide

As you can see, the Windows desktop market is more widely adopted than any other desktop OS available today. Seemingly, Windows has always had negative connotations because of its ongoing vulnerabilities in comparison to other OSs. Part of this is due to how widely used Windows is—a hacker isn’t going to waste their time on an OS that isn’t widely adopted. We can assume there would be a direct correlation between OS adoption rates and available security vulnerabilities. Additionally, the Windows OS is supported across many types of hardware, which opens opportunities for exploits to be developed. One reason why we see significantly fewer macOS vulnerabilities is due to the hardware control with which Apple allows its software to run on. As the platform has grown, though, we have seen an increase of vulnerabilities within its OS too. The point I’m making is that we tend to focus our efforts on areas where it makes sense, and Windows has continued to be a leader in the desktop space, making it a very attractive source to be attacked. This, in turn, has created an ecosystem of vendors and products over the years, all aimed at helping to protect and secure Windows’ systems.

Let’s look at the current adoption of the different Windows OSs in use. The following screenshot from StatCounter shows the current Windows desktop version usage around the world today. To view these statistics, visit https://gs.statcounter.com/os-version-market-share/windows/desktop/worldwide:

Figure 1.3 – Desktop Windows version market share worldwide

As you can see, Windows 10 is the most adopted OS at 73%. In addition, Microsoft has recently released Windows 11, accounting for almost 9% of the desktop market share already. Microsoft continues to push more users and organizations to the latest version of Windows, and this is where it spends the majority of its development resources. There are also major changes to Windows 11 compared with older versions, which is why it is critical to migrate from older versions, especially for security-specific reasons. Microsoft ended its support (including security updates) for Windows XP in April 2014 and Windows 7 in January 2020. It has also announced the retirement of Windows 10 support for October 14, 2025.

A recent buzz term you have most likely heard in recent years is that of digital transformation. This refers to the shift from a legacy on-premises infrastructure to a modernized cloud-first strategy to support the evolving need for big data, machine learning, Artificial Intelligence (AI), and more. A significant part of this shift also falls within Windows systems and management. In Chapter 11, Server Infrastructure Management, we will look at the differences between a data center and a cloud model, including where the responsibilities fall for maintaining and securing underlying systems. Prior to digital transformation, we relied heavily on the four walls of the corporation and its network to protect a data center and its systems. This included a requirement for client devices to be physically on the corporate network in order to access data and services. With this model, our devices were a little easier to manage and lock down, as they never left the corporate office. Today, the dynamics have changed. Referencing back to StatCounter, in the following screenshot, you can see a significant shift from traditional desktop usage to a more mobile experience. The Mobile percentage reflects an increase of over 2% since the initial release of this publication 2 years ago. To view the source of this screenshot, visit https://gs.statcounter.com/platform-market-share/desktop-mobile-tablet/worldwide/#monthly-200901-202110:

Figure 1.4 – StatCounter platform comparison (January 2009 - May 2022)

Focusing on Windows security, the traditional model of an organization would have typically included the following security tools as part of its baseline:

• AV software
• Windows firewall
• Internet proxy service
• Windows updates

Depending on your organization or industry, there may have been additional tools. However, for the most part, I’d imagine the preceding list was the extent of most organizations’ security tools on Windows client devices. The same would have most likely applied to the Windows servers in the traditional model. As the digital transformation has brought change, the traditional method of Windows management has become legacy. There is an expectation that we can work and access data from anywhere, at any time. With the rapid increase in remote working during 2020 and 2021, this model and expectation have been fast-tracked. We live in an internet-connected world, and when we plug our device in, we expect to access our data with ease. With this shift, there is a major change in the security of the systems we manage and—specifically—the Windows server and client. As we shift our infrastructure to the cloud and enable our users to become less restricted, the focus of security revolves not only around the device itself but that of the user’s identity and, more importantly, the data. Today, the items we listed earlier will not suffice in the enterprise. The following tools are those that would be needed to better protect your Windows devices:

• Advanced Threat Protection (ATP): AV and threat protection, Endpoint Detection and Response (EDR), advanced analytics and behavioral monitoring, network protection, exploit protection, and more
• Data Loss Prevention (DLP) and information protection
• Identity protection: Biometric technology, Multi-Factor authentication (MFA), and more
• Application control
• Machine learning and advanced AI security services

The threat landscape within the cyber world is extremely diverse and is continually becoming more complex. The task of protecting users, data, and systems is becoming more difficult and requires the advancement of even more intelligent tools to keep bad actors out. Today, criminals are more sophisticated, and large groups have formed with significant financial backing to support the wrongdoings of these groups. The following are common cyber threats: national governments, nation-states, terrorists, spies, organized crime groups, hacktivists, hackers, business competitors, and insiders/internal employees.

Tip

To learn more about these cyber-threat sources, the Department of Homeland Security (DHS) has a great reference here: https://us-cert.cisa.gov/ics/content/cyber-threat-source-descriptions.

To shed some light on real-world examples of data-breach sources today, Verizon releases an annual report, Data Breach Investigations Report. You can view their latest report here: https://enterprise.verizon.com/resources/reports/dbir/. The report is built on a set of real-world data and contains some eye-opening data on data breaches, such as the following revelations highlighted in the 2021 report:

• 85% of breaches involved a human element.
• 61% of breaches involved credentials.
• 3% of breaches involved vulnerability exploitation.
• Action variants in breaches: phishing 36%, up by 25% from 2020; use of stolen credentials 25%; ransomware 10%, which more than doubled from 2020.
• Credentials remain one of the most wanted data types.
• The most common motivation for attacks continues to be financial.
• The number-one threat actor is currently organized crime.

The full 2021 report can be found here: https://www.verizon.com/business/resources/reports/dbir/2021/masters-guide/.

There are many types of cyberattacks in the world today, and this creates a diverse set of challenges for organizations. While not all threats are Windows-specific, there’s a chance that Windows is the median or attack vector in which an attacker gains access by exploiting a vulnerability. An example of this could be an unpatched OS or an out-of-date application. Next, we list many types of threats that could cause damage directly using a vulnerability within the Windows OS or by using the Windows OS as an attack vector.

Malware is software or code designed with malicious intent that exploits vulnerabilities found within the system. The following types of threats are considered malware: adware, spyware, virus (polymorphic, multipartite, macro, or boot sector), worm, Trojan, rootkit, bots/botnets, ransomware, and logic bombs.

In addition to malware, the following types of attack techniques can be used to exploit vulnerabilities:

• Keylogger
• Phishing (email phishing, spear phishing, whale phishing, vishing, smishing, or pharming)
• Social engineering
• Business Email Compromise (BEC)
• Structured Query Language (SQL) injection attack
• Cross-Site Scripting (XSS)
• Denial of Service (DoS) and Distributed Denial of Service (DDoS)
• Session hijacking
• Man-in-the-Middle (MITM) attacks
• Password attacks (brute-force, dictionary, or birthday attacks)
• Credential stuffing or reuse
• Identity theft
• Advanced Persistent Threats (APTs)
• Intellectual property theft
• Shoulder surfing
• Golden Ticket: Kerberos attacks
• Domain Name System (DNS) tunneling and dangling DNS
• Zero-day

  Tip

  To learn more about the threats listed earlier, the National Institute of Standards and Technology (NIST) has a glossary that provides more information on most, if not all, of the threats in the preceding list: https://csrc.nist.gov/glossary.

Now that we’ve just reviewed today’s threats, let’s take a look at an extremely important topic that has everyone’s attention. Ransomware preparedness is on everyone’s security priority list.

In the previous section, we introduced many of the threats and cyberattacks that continue to challenge us as cybersecurity professionals. One specific type of malware we want to cover in more detail is ransomware. Since the original release of this publication, ransomware incidents have grown exponentially, and ransomware is currently one of the biggest threats to organizations today. In short, a ransomware attack refers to an intruder encrypting data belonging to a user or organization, making it inaccessible. For the user or organization to gain access back to their data, they are held to a ransom in exchange for the decryption keys. The intruders will use many tactics to try to force payment, including threats to leak the data and list the data for sale on the dark web, to the extent of erasing backups, to name a few.

Ransomware has been around for a long time, and the first documented incident occurred in 1989, known as PC Cyborg or the AIDS Trojan. Since then, ransomware has evolved substantially into a business with high payoffs for attackers. There is even a ransomware-as-a-service (RaaS) model that allows hackers to subscribe and use the service to commit their own attacks. A report released by the Federal Bureau of Investigation’s (FBI’s) Internet Crime Complaint Center (IC3) (https://www.ic3.gov/) received 2,084 ransomware incidents between January and July 2021 alone. The cost of complaints from the 2,084 incidents totaled over US dollars (USD) $16.8 million. This is a 62% increase in reported incidents and a 20% increase in losses from the same period in 2020. These numbers alone show a significant increase in ransomware. You can read more on the report here: https://www.ic3.gov/Media/News/2021/210831.pdf.

When it comes to ransomware (or any other threat), the first action should be to protect your environment as best as possible. Although there is a lot that can be done to prevent ransomware from occurring, there is no way to make your environment 100% resilient from such an attack. Because of this, the second action you need to take is being prepared to respond. Ransomware can impact anyone at any time, and the better prepared you are, the better you will be able to handle the situation and the quicker you will be able to recover your environment. Time is of the essence in these situations as you may be losing millions of dollars, customers, and a reputation that has taken years to build.

There are many great resources available for ransomware preparedness and response. Our review of ransomware preparedness and response will be referencing the following two excellent resources for recommendations and information:

• Cybersecurity and Infrastructure Security Agency (CISA): https://www.cisa.gov/stopransomware
• NIST: https://csrc.nist.gov/projects/ransomware-protection-and-response

First, let’s review some best practices for protecting your environment from a ransomware attack. A lot of the following recommendations should be part of your standard security best practices, but it’s best to review and validate any gaps you may have in your infrastructure:

• Enforce MFA, use least privileges or just-enough privilege, and implement Privileged Access Management (PAM) and Privileged Identity Management (PIM).
• Patch and update all software and OSs (including network devices) to the latest supported versions.
• Ensure you are using the latest protection solutions including EDR or Extended Detection and Response (XDR).
• Implement next-generation network protection: firewalls, Intrusion and Detection Prevention (IDP), Intrusion Prevention Systems (IPSs), and so on.
• Implement network segmentation.
• Restrict the use of scripting to approved users.
• Secure your Domain Controllers (DCs).
• Block access to malicious sites.
• Only allow trusted devices on your network.
• Disable the use of macros.
• Only allow approved software to be used by your users.
• Remove local admin permissions.
• Enable advanced filtering for email.
• Use Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC).
• Block the Server Message Block (SMB) outbound protocol and remove outdated versions.
• Follow best practices to harden your end-user and infrastructure devices.
• Protect your cloud environment with best practices, especially public file shares.
• Review your remote strategy and ensure outside connections into your environment are secure. If Remote Desktop Protocol (RDP) is needed, ensure best practices are deployed.
• For backups, maintain an offline backup or air gap, encrypt all backups, and validate recovery by testing regularly.
• Implement and focus attention on a well-defined Vulnerability Management Program (VMP).
• Implement a good cybersecurity and awareness program. Train users not to click on links or open attachments unless they are confident they are legitimate.
• Build a mature Vendor Risk Management (VRM) program.

This is a very high-level summary and may not be inclusive of everything that you may need to account for when protecting your network from a ransomware attack. This is a great starting point, but a lot of effort and time will be needed to best protect against malicious attackers.

Additional Information

The preceding list has been derived from the CISA Ransomware Guide (https://www.cisa.gov/sites/default/files/publications/CISA_MS-ISAC_Ransomware Guide_S508C_.pdf) and the NIST Tips and Tactics | Preparing Your Organization for Ransomware Attacks document (https://csrc.nist.gov/CSRC/media/Projects/ransomware-protection-and-response/documents/NIST_Tips_for_Preparing_for_Ransomware_Attacks.pdf), which contain a lot more detail for review.

As already stated, there is no way of completely preventing a ransomware attack in any environment—it could happen to anyone. No matter how much you protect your environment, there will always be a way to circumvent it. Because of this, the next best action you can take is responsiveness. Being prepared and ready to respond to a ransomware attack will allow you to handle the situation much more efficiently and get your environment up and running much faster. Here are some critical items to help with your response:

• Have an up-to-date Incident Response Plan (IRP). This should include all critical information needed to respond to a ransomware attack, including contact information (local law enforcement), responsibilities, communications, and so on.
• Ensure you have a ransomware playbook as part of your IRP.
• Ensure you have a well-documented Disaster Recovery (DR) plan and Business Continuity Plan (BCP) that is up to date and tested.
• Ensure you have a mature Security Operations Center (SOC) or Managed Security Service Provider (MSSP).
• Conduct a tabletop exercise using ransomware as your theme. Ensure executives are involved in these exercises as they will ultimately need to make some of the important final decisions.
• Carry cybersecurity insurance and understand what options are available with ransomware payment from your cyber insurance policy if this becomes a decision point. Check if you need to obtain a cryptocurrency account or if this is part of the service they provide. Make sure you are not breaking any laws if payment will proceed.
• At a minimum, contract with a couple of respected Incident Response (IR) vendors with whom you have Service Level Agreements (SLAs) for engagement. Ensure that they also provide Digital Forensics Incident Response (DFIR) and are approved for use by your cybersecurity insurance policy. A couple to review are Secureworks (https://www.secureworks.com/services/incident-response/incident-management-retainer) and KPMG (https://advisory.kpmg.us/services/cyber-response-services.html).

  Information

  We will cover the IRP in more detail in Chapter 14, Security Operations.

Everything we have covered for ransomware response should be part of the overall hardening of your environment as part of your security program. Implementing these recommendations will help protect you against many threats. In addition, having an IRP is intended for any security incident within your environment, and this should be a requirement for your security program in general. As we take you through this book, you will learn how to harden your Windows environment to best protect yourself from a ransomware attack.

Now that we know more about the kinds of threats you may face, it’s even more important for you to know where to access information about these vulnerabilities. You also need to be aware of any resources that are available so that you can educate yourself on what’s required to remediate any vulnerabilities. As you are already aware, Windows is renowned for its ongoing vulnerabilities, and patching/updating these systems has morphed into a full-time and very specialized role over the years. The following website is the authoritative source regarding Microsoft security updates: https://msrc.microsoft.com/update-guide/en-us.

Useful Information

Here is a link to the Microsoft Security Response Center (MSRC): https://www.microsoft.com/en-us/msrc?rtc=1.

As shown in the following screenshot, you will be provided with a list of all identified vulnerabilities from Microsoft within a selected time range, with additional filtering options. To give you an idea of the risk profile for Windows, the following filter is scoped to Windows 11 for x64-based systems over November 2021, which returned 47 uniquely addressed vulnerabilities:

Figure 1.5 – Microsoft Security Update Guide

One term you may have heard as part of vulnerability management with Microsoft is the famous Patch Tuesday (also referred to as Update Tuesday). Patch Tuesday occurs on the second Tuesday of every month and is the day that Microsoft will release its monthly patches for Windows and other Microsoft products. There are many references on the internet for Patch Tuesday, in addition to the MSRC. One example of a common resource used to track Patch Tuesday releases is the Patch Tuesday dashboard: https://patchtuesdaydashboard.com/.

As you review the updates needed for your Windows systems, you will notice that each of them has a unique identifier (UID) to reference the update, beginning with CVE. CVE stands for Common Vulnerabilities and Exposures and is the standard for vulnerability management, allowing one source to catalog and uniquely identify vulnerabilities. CVE is not a database of vulnerabilities but a dictionary providing definitions for vulnerabilities and exposures that have been publicly disclosed. The US DHS and CISA sponsor the CVE.

Tip

Visit this website to learn more about CVE: https://www.cve.org/About/Overview.

The following screenshot shows an overview of what the CVE provides and can be found at https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Windows:

Figure 1.6 – CVE Windows search results

In addition to the CVE is the NVD. NVD is the National Vulnerability Database, which is an additional resource for vulnerability management provided by NIST. The NVD is synced with the CVE to ensure the latest updates appear within its repository. NVD provides additional analysis of the vulnerabilities listed in the CVE dictionary by using the following:

• Common Vulnerability Scoring System (CVSS) for impact analysis
• Common Weakness Enumeration (CWE) for vulnerability types
• Common Platform Enumeration (CPE) for structured naming standards

The following screenshot shows an overview of what the NVD provides and can be found via https://nvd.nist.gov/vuln/search/results?form_type=Basic&results_type=overview&query=Windows&search_type=all&isCpeNameSearch=false:

Figure 1.7 – NVD Windows search results

Information

CISA has released a known exploited vulnerabilities catalog that will be continuously maintained. This should be incorporated into your VMP for review. You can find the catalog here: https://www.cisa.gov/known-exploited-vulnerabilities-catalog.

One additional resource that we should mention is the Open Web Application Security Project (OWASP). OWASP is a nonprofit organization that helps improve the security of software for individuals and enterprises. It provides a tremendous amount of resources such as tools, documentation, and a community of professionals, all looking to continually enhance software security. Although OWASP is focused on application and web application security, there is a high possibility that an application or a web application will be running on your Windows servers and Windows clients. Because of this, it is critical, as a security professional, for you to be able to intelligently discuss these concerns and challenges with the business, developer(s), and application/web application owners.

Tip

You can find more information about OWASP at https://owasp.org/.

One of the more common projects that OWASP provides is the OWASP Top 10, which provides the most critical web application security risks. The latest version available was recently published in 2021 and is presented here:

1. Broken Access Control
2. Cryptographic Failures
3. Injection
4. Insecure Design
5. Security Misconfiguration
6. Vulnerable and Outdated Components
7. Identification and Authentication Failures
8. Software and Data Integrity Failures
9. Security Logging and Monitoring Failures
10. Server-Side Request Forgery (SSRF)

    Tip

    View OWASP Top Ten Web Application Security Risks for 2021 here: https://owasp.org/www-project-top-ten/.

If you follow the news, you are probably aware that there is no shortage of breaches nowadays. They are happening so frequently that it is not uncommon for several breaches to occur weekly or even daily. What is even scarier is that these are just the ones that we hear about. To give you an idea of how serious the issue has become, the following list has some of the more notable breaches that are documented on Wikipedia’s List of data breaches page. There are many sources on the internet identifying top breaches, but Wikipedia has the most comprehensive information we have found with references to each of the listings:

Figure 1.8 – Wikipedia list of data breaches

You can find the source of the preceding screenshot at https://en.wikipedia.org/wiki/List_of_data_breaches and a list of security incidents here: https://en.wikipedia.org/wiki/List_of_security_hacking_incidents.

As you review the breaches and understand how they occurred, you will see a common trend where, for the most part, the breach occurred from hacking or poor security practices. You might also notice that other common methods of breaches include lost or stolen equipment. These statistics are alarming, and they indicate how critical it is to secure and harden our systems as best as possible.

It is also important to point out that the tactics of some malicious actors are not to breach records but to hold a company at ransom for a large payout. One of the more notable ransomware attacks recently was against Colonial Pipeline, which is one of the largest fuel pipelines in the US. This ransomware was so impactful that it forced the company to shut down its fuel distribution operations, causing gas shortages for consumers throughout the east coast. Another attack becoming more common is that of the supply chain, where hackers look to compromise a vendor that can then in turn compromise all its downstream customers. One of the most infamous such attacks was the SolarWinds cyberattack, where hackers implanted malicious code into their software, which was received by thousands of customers. Once installed, hackers were provided the ability to infiltrate customers’ networks.

To give you an idea of the importance of securing and hardening your environment, the International Business Machines Corporation (IBM) data breach report of 2021 provides some data points that are not to be taken lightly. In 2021, the average cost of a data breach was $4.24 million, which is the highest average cost since the report began. The most common initial attack vector was compromised credentials. In addition, the report shows that the average cost of a user record from a data breach is $161 per record. A quick calculation of this multiplied by 100,000 customers calculates a potential loss estimated at $16.1 million. When you look at the number of breached records shown in Figure 1.8, you will understand how this could be extremely damaging to a business’s value and reputation.

You can download and view more details on the IBM Cost of a Data Breach Report here: https://www.ibm.com/security/data-breach.

Tip

An interesting site for reference is Have I Been Pwned. This site will show you whether any of your accounts that use your email address have ever been breached and, if so, where the breach was: https://haveibeenpwned.com/. You can also sign up for notifications for any breaches using your email address or submit a specific domain to be notified on.

There are many sources available where you can view security news and follow the latest trends and best practices. Here are some recommended resources to help keep you up to date with the latest happenings in the security world today:

• DarkReading: https://www.darkreading.com/
• Cyware: https://cyware.com/cyber-security-news-articles (recommended phone app)
• Cybersecurity Insiders: https://www.cybersecurity-insiders.com/
• CSO: https://www.csoonline.com/
• Krebs on Security: https://krebsonsecurity.com/
• The Hacker News: https://thehackernews.com/
• Darknet Diaries podcast: https://darknetdiaries.com/
• Risky Business podcast: https://risky.biz/

Next, we will discuss the security challenges we face in today’s world and within the enterprise.

By the time you have finished reading through the chapter, you will have hopefully been provided with a sense of how important security has become today and the challenges that come with it. We are continually becoming more reliant on technology than ever before, with no signs of slowing down. We have an expectancy of everything being digitized, and, as the IoT is taking off, everything around us will be connected to the internet, thus creating even more challenges to ensure security is efficient.

As we briefly covered earlier, attacks are becoming more and more sophisticated every day. There is an ever-growing army of bad actors working around the clock, trying to breach any data they can get their hands on because the cost of private data is very expensive. There is also a shift in the way bad actors are threatening organizations by looking for weakness in the supply chain and holding companies to ransom. With the advancement of cloud technology, supercomputers, and the reality of quantum computing coming to light, hackers and organized groups now have access to much more powerful systems and are easily able to crack passwords and their hashes much more easily, making them obsolete as the only factor of authentication. No one should be using just passwords anymore; however, the reality is, most still are. The same applies to encryption. The advancement of computers is making algorithms insecure, with the ongoing need for stronger encryption. These are just some of the ongoing challenges we are faced with when protecting our assets.

Keeping up with vulnerabilities today is a full-time role. It’s critical that we keep on top of what they are and which Windows systems need to be updated. We will discuss the management of Windows updates later in the book, but having a program in place to manage the overwhelming amount of Windows updates is critical. Additionally, third-party applications will need to be carefully monitored and updated accordingly. An example of a commonly used application is Adobe Acrobat Reader DC to view Portable Document Format documents (PDFs). The following screenshot is a vulnerability report from Microsoft Defender Security Center. It provides a software inventory of all machines with the application installed and lists the number of vulnerabilities detected across all machines in your organization:

Figure 1.9 – Acrobat Reader DC identified vulnerabilities

As you can see, out-of-date applications have critical known vulnerabilities that are used by attackers.

Most organizations are reluctant to release the latest Windows updates to their servers straight away because of the risk that a patch could break a production system. The downside to this is that your system will have a known vulnerability, which opens up an opportunity for it to be exploited between the time of the patch release and the system being patched. Another challenge we are faced with is zero-day vulnerabilities. A zero-day vulnerability is one that has been identified but currently has no remediation or mitigation available from the vendor. Because of these challenges, it is critical we build a layered defense strategy into our Windows clients and servers. For example, never make your database server accessible via the internet, encrypt the traffic to your web servers, and only open the ports needed to communicate, such as allowing port 443 for secure (HyperText Transfer Protocol Secure (HTTPS)) traffic only.

As we focus on securing Windows devices within our environments, we can’t turn a blind eye to the fundamentals, including the overarching ecosystem that also needs to be considered when protecting your Windows devices. This book will cover a lot of detail on the specifics of securing and hardening your Windows systems and devices, but we also want to ensure the bigger picture is covered—for example, simple concepts of identity and access management (IAM). A user whose account has been compromised to allow an intruder on your Windows system has just made all the securing and hardening of that system irrelevant. The concept of weak physical access controls and policies could allow someone to simply walk into a server room and gain physical access to your systems. Other examples are allowing a developer to install an insecure web application with vulnerabilities on it, or a business that develops a process without security best practices in mind. All the controls you put in place with Windows become irrelevant, as an educated hacker could use the web application or exploit a process as an attack vector to gain access to your system. These examples show the criticality of not only being familiar with how to secure and harden the Windows OS but also ensuring all the other factors that fall within a mature security program work together to ensure your environment is as secure as possible. This, of course, doesn’t come easily, and it is critical you stay current and continue to learn and learn and learn!

Managing and securing your Windows systems is not a simple task, especially if you are working toward securing them correctly. There is a lot involved, and to efficiently and effectively secure your Windows systems, you need well-defined policies, procedures, and standards in place, along with a rigorous change-control process to ensure anything that falls outside of the standards receives the appropriate approval to minimize risk. Full-time roles exist today to manage and secure your Windows systems, along with specialized roles that are necessary to manage your Windows environments. Examples include Windows desktop engineers, Windows server engineers, Windows update administrators, Windows security administrators, Windows Mobile Device Management (MDM) engineers, and more. As part of these roles, it is critical that staff are continuously educated and trained to provide the best security for Windows. The landscape is changing daily, and if your staff aren’t dynamic or don’t stay educated, mistakes and gaps will occur with your security posture.

Another task to think about that must be addressed with your Windows devices is inventory management. It is important to ensure you know where all your devices are and who has access to them. Even more important is ensuring that devices are collected upon any terminations, especially those pertaining to disgruntled employees. Enforcing policies on your Windows devices is also another challenge; for instance, how do you ensure all your devices have the latest policies, and how can you ensure accurate reporting on non-compliant devices? Remote management can also be a challenge—that is, to make sure that not just anyone can remotely access your devices, including the auditing of support staff for anything that they shouldn’t be doing. Running legacy applications on your Windows devices creates an instant security concern, and making sure they are patched to the latest supported version is critical. This list goes on, and we will be diving into much greater detail within the following chapters to help provide the information you need to protect your Windows environment.

Before we move on to the next topic, one additional challenge that needs mentioning is shadow IT. In short, shadow IT is the setup and use of servers and infrastructure without IT or the security team’s approval or knowledge—for example, a business function. This instantly creates a significant security concern as the Windows systems will most likely be used with no standards or hardening in place. In addition, hackers are known to target application-managed identities to gain access to other systems due to their privileged permissions. This can be a challenge to manage, but it is something that needs to be understood and prevented within any business.

Within only a couple of years since the first edition of the book was released, zero trust has gained tremendous momentum and has become a buzz and marketing term for most security vendors. As a reminder, the zero-trust architecture model was created by John Kindervag while he was at Forrester Research Inc. back in 2009. If you are not clear on what exactly zero trust is, essentially, it is a model where we trust no one until we can validate who they are, who they are meant to be, and whether they are authorized to have access to the system or information. In simple terms, zero trust is well known for the concept of never trust, always verify.

There are a lot of zero trust references from many vendors, and depending on which vendor you work with, there will be slight differences in their approach to zero trust. No matter which vendor you work with or which approach you take, the core of a zero-trust model will always fall back on the principle of never trust, always verify. Effectively implementing a zero-trust model requires a multilayered approach with your security strategy, along with the use of the most current and modern technology available. The method of allowing a user to access the environment with only a username and password is outdated and insecure.

Since we are focusing our security on Microsoft products, we will review zero trust as Microsoft has approached it. With Microsoft’s approach to zero trust, they have created their strategy for customers around six different pillars, as follows:

1. Identities are the new perimeter of zero trust. An identity is something (typically a user) that needs to access an app, data, or some other form of resource. It is critical that identities have multiple layers of protection to prevent unauthorized access.
2. Device and endpoint protection is an essential component of zero trust. Whether a mobile device, laptop, server, IoT, and so on, we need to ensure recommended baselines are deployed and that devices stay compliant and are constantly being scanned for vulnerabilities.
3. Data is at the core of the zero-trust model. It is ultimately data that the intruders are looking to exfiltrate from your environment. This is the true asset that needs to be protected. Because of this, it is critical that you know where all your data lives, who has access to it; whether it’s classified correctly and encrypted, and that you have the correct controls to prevent it from being removed from your environment.
4. Applications and application programming interfaces (APIs) are gateways to your data. They need to be governed and deployed with best practices to prevent unauthorized access to data, whether intentionally or unintentionally. Ensuring the business is following enterprise standards is critical for preventing shadow IT.
5. Infrastructure pertains to everything within your environment that provides the means to store your data and/or run applications such as servers, VMs, appliances, Infrastructure as a Service (IaaS), Platform as a Service (PaaS), and Software as a Service (SaaS). Preventing unwanted access to your infrastructure is crucial by ensuring you have best practices and baselines in place, along with effective monitoring.
6. A network is a medium where your data travels. Once considered the perimeter for defense, this pillar still holds a critical role as part of zero trust to ensure all data is encrypted during transport, next-generation protection is deployed, micro-segmentation is in place, and ongoing monitoring is taking place to detect unauthorized access to your data in transit.

   Information

   You can read more about the zero-trust Microsoft model here: https://www.microsoft.com/en-us/security/business/zero-trust.

The following screenshot represents the six pillars, with some examples of the technologies and solutions that should be implemented to support your broader zero-trust strategy:

Figure 1.10 – Microsoft’s six pillars of zero trust

Now that you have an idea of what zero trust is and the technologies involved, you will need to have a plan in place to ensure success. Zero trust is not going to happen overnight or within a few weeks. Zero trust is a strategy and a foundation that needs to be planned over months or even years, depending on your organization’s maturity. With this, you will need to be able to measure your success, along with your current maturity. Microsoft has a very high-level and simplified maturity model that can help you better understand your current state and what will be needed to obtain zero trust. The following screenshot provides an example of how the Microsoft maturity model is presented:

Figure 1.11 – An example based on Microsoft’s zero-trust maturity model

For more details on the maturity model example, browse to https://download.microsoft.com/download/f/9/2/f92129bc-0d6e-4b8e-a47b-288432bae68e/Zero_Trust_Vision_Paper_Final%2010.28.pdf to view Microsoft’s maturity model with more details across all six pillars.

Once you have a good understanding of the technologies involved in zero trust and how the maturity model works, the next step is to build your strategy around accomplishing this transition. Remember—this transformation isn’t going to happen overnight, so you’ll need to build a roadmap based on where you are today with the technologies you have in place versus where you would like to be. Accomplishing this journey is not going to be easy, but the better you document your strategy and vision, the easier your journey will become. Here is a high-level idea of how you could build out your roadmap:

Figure 1.12 – Example of a zero-trust roadmap

There are many variations and vendors providing guidance on how to adopt a zero-trust approach. A couple of additional notable models to review as part of your planning include the NIST zero-trust architecture and the CISA zero-trust maturity model, as listed here:

• NIST zero trust: https://www.nist.gov/publications/zero-trust-architecture
• CISA zero trust: https://www.cisa.gov/publication/zero-trust-maturity-model

As you read through this book, you will find that the guidance and instructions provided will ultimately lead to a zero-trust model.

Tip

Microsoft also provides deployment guides to each of its pillars. The following link provides specific guidance to securing endpoints with zero trust. The same Uniform Resource Locator (URL) also has links to the other deployment guidelines for each of the pillars: https://docs.microsoft.com/en-us/security/zero-trust/deploy/endpoints.

In this chapter, we covered—at a high level—what you can expect to read throughout this book. We provided an overview of security in an enterprise and covered the different roles that you can expect to see within security departments. Next, we looked at how security relates to the digital world and its relevance as the world becomes more digital. We also looked at the usage of Windows throughout the world to better understand its adoption by users.

We then reviewed the current threat landscape and the types of cyber threats and covered ransomware preparedness. After reviewing threats in the enterprise, we then provided details on where you can go to learn about recent Microsoft vulnerabilities, with correlating patches and instructions on how to update. In addition to Microsoft’s vulnerability resources, we provided insight into where patches get their naming standards via CVE, along with NVD (NIST). Next, we looked at some of the biggest breaches that have occurred to date and provided some popular sources to keep you up to date with the latest cyber news. We finished the chapter with an insight into some of today’s general security challenges and—more specifically—those with Windows systems, before closing with an overview of zero-trust security and what it entails.

In the next chapter, we will review building a baseline. This chapter will review what a baseline is and then go into detail as to why a baseline must be formed. As part of the baseline, you need to ensure your policies, standards, and procedures are in place and are well defined and signed off by the leadership team and all the stakeholders who are liable for protecting the data. Having these documented is important for security reasons, as well as for compliance and auditing purposes. Following this, we will briefly cover change management and its importance as it relates to baselining. We will then review frameworks and what they entail before moving on to some common frameworks that should be referenced when building your baseline. We will finish the chapter with a review of baseline controls and how to implement them.