hello everyone welcome to this presentations last demonstration on
protecting Windows virtual desktop in haja using so for security quick
information about me my name is David o Quixote and I'm a cloud security
architect I specialized in security of cloud platforms like as your AWS in
Google cloud so short introduction on Windows virtual desktop it is a virtual
desktop and application solution that is all set on the other platform and this
solution has some interesting capabilities like support for multi
session Windows 10 experience it's also much easier to setup when we compare
this solution with other remote desktop solutions and one of the reason for that
is that a big part of the solution is managed by Microsoft and abstracted from
the administrator and in light of the recent events in our world with kovat 19
this has become a popular solution for organizations that are looking to enable
workers to work remotely and have access to the applications and services that
they use for their day-to-day work so here is a high-level architecture of the
solution now it's clear from this diagram that certain components of the
service are managed by Microsoft but it is equally clear that the customer are
certain components that they manage and are responsible for and that is a hereas
of focus in this presentations large demonstrations the core of what we're
discussing is that Windows virtual desktop is not as secure by default
solution and we have certain responsibilities as customers to secure
it now how many closer look at this act each diagram the same one I showed you
earlier we can see mentions of access management Diagnostics but there's no
mention of security and this is where the so for security solutions comes in
to help us secure the aspect of this solution that we manage and ultimately
secure in our digital assets so here's the value deaths of a security solution
brings to this service so we have visibility and the texture
analysis and investigation and incident response now to the demo this would be a
two-part series video and the first part I would deploy Windows virtual desktop
into haja and then I'm going to protect the session host of the solution using
the surface intercept X solution so they'll be the first part in the second
part of this video our deployed surface HD firewall to provide an added layer of
security on the network front so that's called the fencin date so let's get
right into the current environment and then I'll go ahead and show you the demo
so here's the current environment that I have so I have a virtual network imager
that has two subnets one of the subnet as a domain controller now in the other
subnet I will be deploying the Windows virtual desktop solution the session
Aust into the other subnets how Delhi protecting - using the surface intercept
X solution which will be registered to so for Central and I'll be able to get
policies from so far centrally into that the next part of the video as I
mentioned I will be deploying the surface exa firewall into another
virtual network in Asia how cold are the security virtual network how will create
a peer in relationship between the network that Windows virtual desktop
solution resides and my security virtual network our configure a would evolve out
the wire you pronounce that so that's traffic that's going out to
the internet or traffic that's even going out to other networks it's gotta
be voltage through my so force actually firewall solution so that way I will be
able to do security checks and be able to gain visibility and be able to
enforce compliance on the network level also so let's get right into that sort
of the deployment of the Windows virtual desktop I'll go ahead and search for
Windows virtual desktop and one of the options that I get is this option in the
marketplace for Windows virtual desktop provision a host for if I go ahead and
click on that option I click on create I'll fill in the
information about my resource group I'll go ahead and specify the region that I
want to deploy this into so it's going to be in the region where my virtual
network exists our select UK South the Oh school name I'm going to be creating
a new Oslo so I'll be giving it that name and for
this case I'll be specifying port so that multiple users can share the same
pool so for desktop users I have to use this that I'll start with so that with
David and Brenda and I'll leave the metadata location as United States I'll
click Next to configure usage profile the light because it's a test
environment and total number of users are set stat to so diabetes is the
number of virtual machines are redeployed to one for the virtual
machine name prefix I'll specify a name that's less than two characters cause of
it less than twelve characters I mean now for the virtual machine settings
I'll be using the Windows 10 and the price multi-session image our putting
information to join this Aust to my domain so how great I'm putting
information of an admin I won't specify any or you in this case our selects the
virtual network that has my domain controller and I'll specify the submit
that I want to deploy this hospital into which is this other subnet
so our wired and click Next for the virtual desktop information I'll put in
my tenants name if you are not familiar with what this is this is my video to go
into details about this service I'll put make a link to Microsoft documentation
in the description below and you can have a quick look at those so it guides
you in charter creates lieutenant so in this case I put in my tenants name that
I created already and I will put in information about the service principle
that I created already also so I've got a service participant I've got an
application Heidi called the password
and I've also got my eyes ahead eaten and Heidi's are great and puts that in
there I'll go ahead and click on review and create so that was a review and
validation of the templates once that passed away and click on create and that
should begin the process of deploying the osteo and also the session lost how
we're done post a recording and Whitford dist complete so once this is completed
I'll show you the rest of the process so welcome back so the deployment of
Windows virtual desktop completed successfully so I can go to the Vsauce
and I can examine what's been deployed so I have a session host here so that's
good so the next thing that I will be doing let me go back to the presentation
to show you what's the next step that I'll be doing so that's what I've done
I've deployed the session host making the buildings are be deploying this
office intercept X agent onto that session Aust now what I'm going to be
doing is I'm gonna connect the decision oast with a user that has admin
privileges to the deployment for me to go through this pad I need a service
central account and you can sign up by going to central dot sofas come and just
click and sign up here so that will take you to a stop sign not for a free trial
for 30 days so to begin wait so what are these our
login to my service central account to show you what that looks like so one of
the other things that I have is I've linked my sofas central account with
Microsoft Azure that's a topic for another day if I go over to sever
protection here you can see that if I go under service and if I go and Rajavi
Em's is detected my session host is detect
that it doesn't have any service protection on it
so obviously what I want to do is I want to have this protected so that's the
next one that I'll do to connect to the host I will just open up a new browser
tab and what I'll do is I'll paste in this URL so that is out the web dot wvd
that microsoft.com for slash web client so I can also use a dexter plan but i'll
be using a web client for this demonstration so because i'm signed in
with the same credential that has access i will be taken to a web page where you
can connect to my virtual desktop and here you go you can see that's the pool
if i go ahead and click on the pole just reconnects in my clipboard now click on
allow and then it's going to begin the process of connection from ted to enter
my credentials i go ahead and put in my username dividend at super cloud at XYZ
and i'll put in my password also and i'll click on submit
so now logged in to the system so what I'll do is I'll bring of Microsoft edge
I'll go to central dot sofas come and authenticate with my credentials so put
in my central so for central details
and I'll put on my password
if I go ahead and click sign in and what I'll do is I'll go on the protects
devices hey and under protects devices I'll click on the option to download the
complete Windows installer so if I click on that so that's going to attempt to
download the installer I'll just go ahead and click on run and that's going
to begin the process of installing this agent now it's going to be installing
the agent Gaad surface intercept x4 server so it's going to be installing
and that's gonna protect my multi-session environment so they'll
require the server license form for of surface intercept X but that's going to
protect every user that's logged in all using the session host if I go ahead and
click continue here and I'll go ahead and click on install and I'll take a few
minutes to proceed so I wired and posture recording so once this installer
has completed the installation job average stats the machine and then I
will just show you where the policies can be configured and that will conclude
the first part of this video so welcome back so the deployment completed
successfully so I need to restart the machine so if I go ahead and click
finish in that so that's gonna wish that this session host and wild it restarting
I'm going to show you how to configure the policies in so for central so if I
go to so for central if I go on the if I go back to the main view and if I scroll
down under my products I have server protection here so if I click on the
server protection and if I click on the service I can see that it's detected the
agent been installed on the session host if I go on to a Java Hammes
I can see the virtual machines that I have run in in haja which one is
protected by so fast in the Select solution and which one isn't so the one
that is protected I can click on this link here to take me to the service I
can see the status of the agent and what's going and I can apply policies
like you can lock it down I can initiate scan remotely but the thing I
want to show you is about configuring the policy so if I go on the configure
on the policies here you can see that the solution itself has multiple layers
of Defense's and protection and visibility beaut into it so for example
you have trade protection paper paper or control application control web controls
sever lockdown and many other policies that we could configure if I wanted to
create a custom policy because those are the base policy that we apply for
another critic custom one can go ahead a new policy for let's say trade
protection and if I click on continue I can select my server or my instance or I
can put it into a group and apply the policy to the group and then if I go
under settings I can see the different layers even just in this component of
the solution so this is just one component of the same solution and you
can see the layers of the frames that exist in this you have cryptographic
protection against ransomware tags and you have protection against Master Boot
Record ransomware you have protection for processes you have anti exploit you
have deep learning solution there's multiple layers of Defense's beauty into
the solution is what I'm trying to show you so what you do is you configure your
thread protection policy you configure the different other policies like perfer
control up control web control and the others and you apply them to the server
and the server is going to grab all this policy apply it to itself and that's
going to put protect all the users that are logging into your session host so
that brings me to the hand of this particular video so what we have
suffered I'll go back to the slides so we can do a quick review of what we have
suffer
so this is what we've done so far we've installed intercept X and that's
register bits of a central and we can configure policies for that so what I'll
be showing you after what is how we can had another layer of the Finch two dead
by deploying the surface HD file on the network level and then creating the
peering relationship between this network and the security network and
then configure routine so everything can flow through the exif our so I'll see
you in the next video thanks for watching
you