Coming up, i'm going to give you a tour of the defense
in-depth security measures we've taken on the surface of operating systems
that keep your data and users safe.
First at the physical hardware level and the pre-boot environment.
Then, at the OS and application level,
blocking attacks on the Surface Hub when it's in use.
And, finally from the user session perspective,
all the way through clean up with content
and credentials at the end of each session.
So I'm here with the 84-inch Surface Hub,
and we're going to talk a little bit about some of the physical hardware protections we have in place.
The first thing is, we have an SSD hard disk here
thats key to the TPM chip that's on the embedded compute in the Surface Hub.
So for instance, if you take that device out
and you try to inject any code, the operating system won't boot.
Next, we have BitLocker enabled by default
and enforced on all Surface Hubs.
So again if you take that SSD away from the Surface Hub,
all of that content is encrypted.
Let's talk about Secure Boot next.
I'm going to go over and turn off the Surface Hub.
Now you'll notice, as the Surface Hub comes back up
You're going to get a view of our custom UEFI BIOS here.
What you'll notice is that there are no bios boot options
and we've also removed any API access.
So, through kernel-mode integrity and the enforcement of Secure Boot,
that can't be disabled.
We can make sure that only genuine windows operating systems will ever run on the Surface Hub.
Now let's explore tack vectors during normal use
with defense in depth at the operating system and application level.
So with the Surface Hub,
walk up and use is a very important thing.
So I can step up, take out a pen,
and immediately start inking
and getting my ideas down on the whiteboard.
Typically on a Windows 10 PC,
this would all be secured behind a Windows user account.
But on the Surface Hub, there is no unlock.
We don't want users to have to
step in and log in to get up and using.
But, how do we secure that environment if anybody can walk up and use it?
First thing we do is make sure that only administrators can make durable changes to the machine.
If I go to the start, here.
As a user, I can run all these applications.
But, if I go in and for instance try to modify any of the settings on the device
I'm blocked by an administrator prompt.
Now, even administrators can only run universal Windows applications on the machine
that have to be deployed from the store.
And even then, only that set of applications
that are target to the Surface Hub,
which can be identified by this icon that you see on your screen.
Now let's talk about another common threat to the device.
Files that I bring with me on a USB drive.
So, I have a file here that I want to share with my meeting.
But it's also got some bad stuff on it.
If I watch the file explorer,
you can see that it's a familiar file explorer.
But you'll notice that I can only get it approved user locations.
I can't navigate all the way through the operating system.
That's actually true for applications as well.
So, if I start word.
You'll notice that if I browse,
I can still only get to those same approved locations.
I can get to my removable storage and my USB drive .
And I can access the files that I want to.
But I can't get into any of the system locations.
I can't type arbitrary file locations either.
Back in the file explorer,
you see that I have my presentation here and I can go ahead and launch that.
So, now I've got my deck and I'm going to share it into the meeting.
You'll notice I also have some not great stuff on the USB drive.
I have a batch file here.
And, I have a script that would install a keylogger.
If I try to execute those,
those are blocked by device guard at run time.
So in fact,
Not only can I not launch PowerShell, nor command line.
Only approved file extensions can execute at run time on the Surface Hub.
Through code-signing and device guard, we block everything else.
Next we're going to talk about the browser.
Which is another common vector for attack on devices.
The first thing to know, is that we only run the edge browser
on the Surface Hub.
And we take full advantage of smart filtering.
So for instance, if i try to navigate to a malicious website.
In this case, we'll use the system internal site.
And, we'll download Access check.
So, I get the download prompt and i'm going to save that.
Now I was able to download it, but if I get over here and try to execute that thing,
the same thing happened.
Lastly, in the OS and application section
let's talk about bad device drivers.
So I have here a third-party USB ethernet adapter
that i'm going to plug into the Surface Hub.
Now on a Windows 10 PC,
what you'd be seeing here is a notification that a device driver is being downloaded and installed.
But on the Surface Hub, you see nothing.
You didn't hear a device charm and you don't see any sort of notification.
That's because only device drivers
that are checked into the Windows build that runs on the Surface Hub
will ever load.
So, no third-party drivers and no drivers downloaded from the internet.
Now let's look at our last level of security
with what's going on at the user level,
and their data between sessions.
So, we've talked a lot about what I can't do on the Surface Hub.
I can't run Win32 applications.
I can't download and install my own stuff from the internet.
But, the thing to remember,
is that I can always bring my personal device.
So I have my Surface book here.
And i'm projecting up to the Surface Hub
and I've got USB plugged in to get touch back and ink back.
So in that application I can run anything I want.
I'm running JT2GO here, but I could run any of my favorite browsers or anything else.
I can use touch.
I can use ink.
But the thing to remember is,
when I come back to my Surface Book and I unplug it.
I take this with me
and nothing remains on the Service Hub.
So I get the power of anything I want to run on my personal device
without compromising the Surface Hub itself.
So now we're at the end of our meeting
and we've done a lot of stuff on the Surface Hub.
We've run some applications, we did some browsing, and we did some thinking and white board.
If I were to leave and the device were to timeout and go back to welcome,
we save all of that content.
So I don't lose any of it and I can resume my session
until the nightly reboot when we clean up.
What If I explicitly want to clean up
and make sure that none of my data is left on the Surface Hub after the fact?
That's when I hit the "I'm done" button.
Now what's happening here,
is the Service Hub is cleaning up everything that we did during the session.
It's actually de-registering and re-registration all the Universal Windows applications.
It's clearing the browser cache.
It's getting rid of the Skype call logs.
It's getting rid of the inking that we did and white board.
Now, all of that is back to a pristine state.
So it's ready for the next user to start their meeting.
But more importantly, all of my data is safe.
So now if I go into "Start",
I can see that my inking is gone and there's no running application.
All of my calls are turned off, etc.
So we hope that you found this tour of Surface Hub Defense and Depth useful.
You can learn more at the URL below.
Keep watching Microsoft Mechanics for the latest in Surface Hub design and management.
That's it for now, thanks for watching.
Microsoft Mechanics
www.microsoft.com/mechanics