(clanging)
(soft music)
- Welcome to Desktop Deployment Essentials,
our new series to help you prepare for your shift
to Windows 10 and Office 365 ProPlus.
In the next few minutes I'll walk you through step five
in our recommended deployment process wheel,
what you need to know about planning for your current
desktop security and compliance controls
when moving to Windows 10 with Office 365 ProPlus.
Along the way, I'm gonna point out a few common
security related components that might delay
your deployment to Windows 10,
and the things that you can do to lay the foundation
for adding security capabilities over time,
even if they're not part of your initial shift to
Windows 10, Office 365 ProPlus,
and Enterprise Mobility and Security.
Many of the security related capabilities
in Windows 10 alone are driving for
the shift to the newer platform.
Also integration with Cloud services and identity,
brings a new and continually updated protection set
to your data devices and users.
Now before we go on to new capabilities that you can add
as part of your move to Windows 10 and Office 365 ProPlus
and connect those experiences to the Cloud,
we'll start with a few trends that we're seein'
that often interrupt deployment progress.
First, one of the initial challenges you
might encounter is hard disk encryption.
Now many solutions for hard disk encryption
cannot be easily upgraded from a previous
version of Windows to a newer version of Windows.
Some vendors allow you to perform the upgrades
when using the reflect drivers option with Windows set up
on certain versions of their platforms.
Other may require you to unencrypt
the drive prior to deployment,
the re-encrypt after Windows is installed.
And some also do not allow you to move from
master boot record using Legacy BIOS
to GUID Partition Tables required for UEFI.
Now remember UEFI is required for many of the new
virtualization based security capabilities in Windows 10,
which we'll get to in a moment.
Now one option to resolve these issues is using BitLocker,
which is included in Pro and higher editions of Windows 10.
This allows you to suspend protection for OS upgrades
and feature updates as part of the process.
Second, while we've seen that more than 99%
of Windows apps are compatible between
Windows 7 and Windows 10, the exceptions are often
anti-virus apps or VPN clients.
Now these apps often work around standard development
practices and APIs using often undocumented ways
to protect your system or connect to network resources.
As a result, these apps by nature can be fragile
to changes when shifting to a newer version of Windows.
Now if your AV or VPN software doesn't work in Windows 10
or after upgrading, the fix is typically to replace
the app you're using with something supported
and tested in Windows 10.
So now let's look at security policies.
One important tip here, your group policy settings
used for older versions of Windows and Office,
might not translate directly to Windows 10
and Office 365 ProPlus.
And there are different considerations with newer
security compliance capabilities.
So it's a good idea to use the Microsoft Security
and Compliance toolkit to get a baseline
of the security policies for
current versions of Windows and Office.
Now those are considerations for
moving your current protections forward
and things to be aware of before your shift.
But let's take a look at new capabilities
that you can take advantage of when moving to
Windows 10 and Office 365 ProPlus,
along with Cloud based options from EMS and beyond.
Starting with Cloud based identity,
Azure Active Directory is the identity control plan
for apps, devices, and Cloud services,
and is the modern way to connect to Office 365
and other Cloud services.
And conditional access allows you to define
different authentication requirements
based on where you're loggin' in from,
which device you're using,
as well as things like anomalous behaviors.
Then at the device level, we think about biometrics
as a unique identifier for simpler,
and more secure access to your devices and apps
as we move towards the goal of eliminating passwords.
Windows Hello offers device based,
multi-factor authentication.
It relies on the device itself, your PIN,
or unique biometric identifier
such as your face or fingerprint,
which you can enforce via policy.
Now beyond identity, you can also enable continuous
protection against known and unknown threats.
Windows 10 uses virtualization based security
at the core to ensure boot integrity,
and code integrity using secure boot.
We can also stop credential theft with a credential guard
by maintaining user secrets in isolation from Windows.
And application guard can isolate, mitigate,
browser based threats by running the browser
in an isolated container.
All of these technologies uses virtualization based
security in Windows 10 and are foundational changes
that cannot be replicated in a Windows 7 system.
Note that they also require UEFI,
64-bit Windows, and virtualization extension support
with SLAT at the hardware level.
So now let's look at another layer of optional protection
to improve Windows and Office Security using Cloud services.
Now these can give you a new level of often real time
control that can instantly detect,
resist, and respond to new attacks and attack types,
especially compared to traditional software updating
and AV signature files, where response
and update deployment times are inherently slower.
Along with the Microsoft Intelligent Security Graph,
you have faster access to both
information and protections from emerging threats.
Now here are a few examples that you can
take advantage of starting with Office.
Data loss prevention built in to Office 365 ProPlus
helps inform users of security policies
when high-risk content like credit cards
or identification numbers are detected.
Policies can inform or block
sending and sharing after notifying users.
Also Azure Information Production is a complimentary service
that can be used with Office allowing users to
easily classify and label their Office files.
It can trigger automatic action on labeled files
such as encryption or locking down sharing.
We've also introduced Safe Links protection
across Office apps to protect you against dynamic lists
of known malicious websites.
Additionally, with a feature called Safe Attachments
in Outlook, which goes beyond email filtering
to inspect attachments, we inform the user of known
malicious attachments and remove them from email.
Then Office 365 Message Encryption, or OME,
can also be used to safeguard email and attachments sent,
ensuring only that intended
recipients can view email content.
OME works seamlessly with Google, Yahoo,
and Microsoft consumer account authentication.
And one-time passcodes allow users of other email services
to securely receive email as well.
Additional protections are also available for Windows.
For example, Windows Defender Application Control
in Windows 10, operates off an approved allow and deny list
of applications that Microsoft has checked for safety.
And all that is managed by
endpoint protection policies using Microsoft Intune.
Next, Windows Defender Advanced Threat Protection
is a unified platform for preventative protection,
post-breach detection,
automated investigation, and response.
It protects endpoints from cyber threats,
detects advanced attacks and data breaches,
it automates security incidents
and improves security posture.
And additionally, the new Exploit Guard helps reduce
the attack surface for running applications
by preventing malware from getting into Windows
and blocking untrusted processes
from accessing protected folders.
Finally, Microsoft Intune which serves as a Cloud based
management service for mobile scenarios
including IOS, Android, and Windows devices,
can now be configured for co-management to compliment
and extend controls for specific workloads
in System Center Configuration Manager.
One advantage here is that devices accessing protected
resources can be required to enroll into device management.
Even non-managed, non-domain joined,
and non-Azure AD joined devices.
You can also take advantage of granular configuration
and compliance policy enforcement at the OS level,
and app settings, they can be configured centrally
and enforced for Office 365 ProPlus
and store apps in Windows 10.
So that was a run through of core considerations
and capabilities for security compliance
when planning your shift to
Windows 10 and Office 365 ProPlus.
Next, we'll continue to your next step
in the deployment process wheel
and explain your options for imaging and upgrading
your PCs to current versions of Windows and Office
using your preferred tools.
To learn more, visit our modern desktop
deployment center and keep following our
Desktop Deployment Essentials series
here on Microsoft Mechanics, thanks for watching.
(soft music)
(clanging)