Windows 10 Creators Update: Increased Security and Advanced IT Tools
More recently, Microsoft was told about the new features of Windows 10 Creators Update , which will open up the world of mixed reality and three-dimensional graphics to users. In anticipation of the release of the available version for the participants of the Windows Insider Program, we decided to tell about new features and features for system administrators that will be available with the release of this update.
The evolution of cyber threats requires the constant and rapid development of security technologies. Updating Windows 10 Creators Update continues to expand security capabilities.
Microsoft created a single viewer of security events in Windows 10 on a centralized portal. It is called Windows Security Center . This component first appeared in the Anniversary Update update. Using the Microsoft Intelligent Security Graph tool, it will be integrated with the Advanced Threat Protection service for Office 365. As a result, IT administrators will have a more convenient, integrated way to monitor attacks against hosts and email.
')
In addition, Windows Defender Advanced Threat Protection (ATP) added new actions and information to help detect and respond to network attacks: sensors in memory, advanced analytics, and corrective actions.
Extended detection capabilities . The update will improve the ATP service sensors in Windows Defender so that it can detect threats that are hidden only in memory or exploits at the kernel level. This will help keep track of loaded drivers and active processes in memory, as well as detect patterns of introducing errors, reflecting downloads and changes in memory, which indicate a possible kernel exploit.
Extended analytics . Microsoft has already added to the threat intelligence tools partner solutions in this area, such as FireEye iSIGHT. With the release of Windows 10 Creators Update, you will have the opportunity to connect your own analytics tools to Windows Security Center so that you can receive alerts about actions based on your own hazard indicators. This additional level of analytics should improve machine learning models, which will allow faster detection and blocking of malicious programs, as well as better protect your own unique environment.
Improved fixes . In addition, new corrective actions have been added to the Windows Defender ATP service. This will allow you to isolate machines, collect evidence, stop and clean up running processes, as well as establish quarantine and block files with one click in Windows Security Center.
Moving corporate files to removable media . Some users faced the situation when, after transferring files that were marked as corporate via WIP, to removable media, it was impossible to open them as they were encrypted. Now a special notification will be added that will give the opportunity to choose exactly how we want to work with these files in the future:
Alerts when working with corporate files in personal applications . If a user tries to open a file marked as corporate in a prohibited application (in other words, using an application that is not on the trusted list for this corporate environment), he will receive a warning message. Now the system will notify the user that this file is categorized as “corporate” and cannot be converted into the category “personal” in an application that is not trusted.
Among such tools are: Windows Analytics panel, the transition to UEFI in place, a new mobile application management function and the next improvements in the Windows as a service model.
Information from the cloud thanks to Windows Analytics . Windows Upgrade Analytics is a tool that helps simplify the transition to Windows 10. This service helps you analyze your IT environment to determine application compatibility, as well as device and driver availability for upgrades. In the coming months, additional resources will appear on the Windows Analytics panel, thanks to which it will be possible to better manage and maintain devices running Windows 10. These additions will allow you to use your own telemetry data to provide new information and to comply with regulatory requirements when switching to a new system, updating and maintaining devices in the organization.
Go to UEFI on the spot . Surely, many already know that technologies such as Device Guard require devices with UEFI support. Some already have modern computers running Windows that support UEFI, but most likely these computers have Windows 7 installed with an outdated BIOS version. In this case, the transition to UEFI requires additional intervention. For example, you need to re-partition the disk and update the firmware configuration. And if you talk about the organization, you will need to reconfigure each device. Windows Update Creators Update added a simple transition tool. It automates the work that was previously done manually. Directly during the upgrade process from Windows 7 to Windows 10, this tool can be combined with management tools such as System Center Configuration Manager (ConfigMgr).
Mobile application management . The update introduced a new feature - mobile application management. It protects data on personal devices and does not require registration when using mobile device management solutions. Employees of many companies are increasingly using personal devices in their work. Thus, administrators can more reliably protect corporate information without incurring additional responsibilities for managing employees' personal devices.
Regular improvements of the “Windows as a service” model . And something else. Microsoft promised to soon introduce the function of differential downloads for both mobile devices and computers. This means that each update will only contain changes that were added after the previous update. This will reduce the size of downloads by about 35%. In addition, work is underway to improve the express updates of the System Center Configuration Manager tool, which will reduce the monthly size of the update files by 90%.
In a few weeks, some of the Windows 10 Creators Update update features will be available to participants in the Windows Pre-Evaluation Program
Security analysis for devices, networks and the cloud
The evolution of cyber threats requires the constant and rapid development of security technologies. Updating Windows 10 Creators Update continues to expand security capabilities.
Microsoft created a single viewer of security events in Windows 10 on a centralized portal. It is called Windows Security Center . This component first appeared in the Anniversary Update update. Using the Microsoft Intelligent Security Graph tool, it will be integrated with the Advanced Threat Protection service for Office 365. As a result, IT administrators will have a more convenient, integrated way to monitor attacks against hosts and email.
')
In addition, Windows Defender Advanced Threat Protection (ATP) added new actions and information to help detect and respond to network attacks: sensors in memory, advanced analytics, and corrective actions.
Extended detection capabilities . The update will improve the ATP service sensors in Windows Defender so that it can detect threats that are hidden only in memory or exploits at the kernel level. This will help keep track of loaded drivers and active processes in memory, as well as detect patterns of introducing errors, reflecting downloads and changes in memory, which indicate a possible kernel exploit.
Extended analytics . Microsoft has already added to the threat intelligence tools partner solutions in this area, such as FireEye iSIGHT. With the release of Windows 10 Creators Update, you will have the opportunity to connect your own analytics tools to Windows Security Center so that you can receive alerts about actions based on your own hazard indicators. This additional level of analytics should improve machine learning models, which will allow faster detection and blocking of malicious programs, as well as better protect your own unique environment.
Improved fixes . In addition, new corrective actions have been added to the Windows Defender ATP service. This will allow you to isolate machines, collect evidence, stop and clean up running processes, as well as establish quarantine and block files with one click in Windows Security Center.
Improvements in Windows Information Protection
Moving corporate files to removable media . Some users faced the situation when, after transferring files that were marked as corporate via WIP, to removable media, it was impossible to open them as they were encrypted. Now a special notification will be added that will give the opportunity to choose exactly how we want to work with these files in the future:
- The first option is to leave files marked “corporate”, convert to “personal” data, or cancel copying.
- The second option is to leave the files marked "corporate", convert to "personal" or save to another location.
Alerts when working with corporate files in personal applications . If a user tries to open a file marked as corporate in a prohibited application (in other words, using an application that is not on the trusted list for this corporate environment), he will receive a warning message. Now the system will notify the user that this file is categorized as “corporate” and cannot be converted into the category “personal” in an application that is not trusted.
IT management optimization tools
Among such tools are: Windows Analytics panel, the transition to UEFI in place, a new mobile application management function and the next improvements in the Windows as a service model.
Information from the cloud thanks to Windows Analytics . Windows Upgrade Analytics is a tool that helps simplify the transition to Windows 10. This service helps you analyze your IT environment to determine application compatibility, as well as device and driver availability for upgrades. In the coming months, additional resources will appear on the Windows Analytics panel, thanks to which it will be possible to better manage and maintain devices running Windows 10. These additions will allow you to use your own telemetry data to provide new information and to comply with regulatory requirements when switching to a new system, updating and maintaining devices in the organization.
Go to UEFI on the spot . Surely, many already know that technologies such as Device Guard require devices with UEFI support. Some already have modern computers running Windows that support UEFI, but most likely these computers have Windows 7 installed with an outdated BIOS version. In this case, the transition to UEFI requires additional intervention. For example, you need to re-partition the disk and update the firmware configuration. And if you talk about the organization, you will need to reconfigure each device. Windows Update Creators Update added a simple transition tool. It automates the work that was previously done manually. Directly during the upgrade process from Windows 7 to Windows 10, this tool can be combined with management tools such as System Center Configuration Manager (ConfigMgr).
Mobile application management . The update introduced a new feature - mobile application management. It protects data on personal devices and does not require registration when using mobile device management solutions. Employees of many companies are increasingly using personal devices in their work. Thus, administrators can more reliably protect corporate information without incurring additional responsibilities for managing employees' personal devices.
Regular improvements of the “Windows as a service” model . And something else. Microsoft promised to soon introduce the function of differential downloads for both mobile devices and computers. This means that each update will only contain changes that were added after the previous update. This will reduce the size of downloads by about 35%. In addition, work is underway to improve the express updates of the System Center Configuration Manager tool, which will reduce the monthly size of the update files by 90%.
In a few weeks, some of the Windows 10 Creators Update update features will be available to participants in the Windows Pre-Evaluation Program
Source: https://habr.com/ru/post/319986/
All Articles