Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

02:30 PM
Josh Mayfield
Josh Mayfield
Connect Directly
E-Mail vvv

5 Essentials for Securing and Managing Windows 10

It's possible to intelligently deploy and utilize Windows 10's many security enhancements while avoiding common and costly migration pitfalls.

With upward of 700 million devices running Windows 10, it's the most rapidly adopted version of the operating system since Windows 95, proving the allure of its updated features, including security enhancements such as virtualization-based security, kernel isolation, and recursive data encryption. In fact, 85% of organizations had started their Windows 10 migration by the end of 2017, according to a Gartner survey.

But many are experiencing challenges, including 21% of migrating users experiencing software compatibility issues such as programs not working properly or at all. Today's hybridized environments involve multiple operating systems across managed devices, bring-your-own-device, and other non-managed devices where people tend to update to Windows 10 quickly, treating their machine like their mobile device. Migration complexities for Windows 7 stragglers are compounded by pressures to rush the upgrade to meet Microsoft's January 2020 deadline for end of life.

When it comes to the security and manageability of Windows 10, there are five key essentials to assist the migration.

1. See everything, get smarter: It's important to understand your environment, your hardware, and its compatibility with the OS. This also means going beyond the device itself to include intelligence around the applications or software on the device, looking at whether a certain application is being used by an individual, whether it needs to be migrated, and whether it will be compatible once migrated. All of this insight helps you assess risk and understand where your gaps are, and helps you plan for filling those gaps.

2. Protections and controls: Let's not forget the data that's on the device. Organizations rely on access to that data; often it's sensitive and needs protecting while the organization gives users the data access they need to do their jobs. Organizations benefit from this intent-based approach. Not only is it less wasteful — you're not overbuying on hardware and software — but you also eliminate many of the security risks by factoring the user persona and business purpose.

But Windows 10 adds complexity and requires decision-making related to policies, configurations, settings, apps, and which services in the OS support your business intent. For example, Credential Guard (which separates login information from the rest of the OS) is attractive to most IT and security pros, with its hardened enclave away from the host OS. But Credential Guard relies on Defender ATP, which is problematic for those who prefer a third-party anti-malware vendor. Running multiple anti-malware tools erases any simplicity you were expecting, which confounds the decision process. This leads to a trade-off between business intent and Microsoft dependence.

3. Monitoring progress and transition: The transition to Windows 10 is really a journey, and it won't work at the flip of a switch. You need to look at all the rich data available to you throughout this journey, understanding where you are in the process, and watching for new variations as they come online. If a certain user brings in a new device, you must understand if it's compatible with Windows 10 and with the applications the user requires.

4. Reduce complexity and risk: As migration nears completion, complexities are often introduced. For example: endpoints are like snowflakes. They are all composed of the same material, but they're arranged in unique ways. If that set of attributes changes in any way — and this is inevitable — you need to maintain visibility and be quickly informed if changes have occurred. It may mean your security and risk posture is drifting toward more exposure.

I also recommend evolving the definition of "asset" and moving to align it with the way real-world security teams define this term within the endpoint domain, which is to encompass devices, data, users, and apps. We must be aware of the interplay between all four components because you could easily find yourself in a situation where controls may be in place and apps are all consistent, but a particular user is utilizing those tools and technologies differently from another. You have to monitor the entire environment on the endpoint to reduce complexity and risk associated with all of the variables. 

5. Don't Set It and Forget It: It's not enough to set and forget security controls. Not only do devices experience natural decay of security controls over time, but this reality is accelerated because of the complexities and dependencies addressed above. It's not just a matter of installing encryption, but you need to make sure it's active and that if something does change on that device you can bring it back to health. Once you work through the Windows 10 migration, it's important to think about how to make sure your devices are hardened with security controls that remain on the devices and stay healthy.  

There are a lot of utopian aspects to Windows 10 and the potential big payoff after migration. Despite the migration journey posing challenges for IT and security teams, it's possible to intelligently deploy and utilize Windows 10's many security enhancements while avoiding common and costly migration pitfalls. Ultimately, the goal here is to reap the new OS gains and sustain them over time, too.

Related Content:



Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Josh Mayfield is Absolute's Director of Security Strategy and works with Absolute customers to leverage technology for stronger cybersecurity, continuous compliance, and reduced risk on the attack surface. He has spent years in cybersecurity with a special focus on network ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.