랜섬웨어 vs 윈도우 10

레쥬메를 고쳐쓸 뻔 했습니다…

랜섬웨어 공격의 진행 과정
악성 첨부파일 활동 개시
브라우저/문서 공격 시작
크레덴셜 탈취
인터넷 서비스 장악
커널 모드 맬웨어
커널 착취
패스-더-해쉬 공격
악성 첨부파일 전달
브라우저/문서 전달
피싱 공격
감시, 재적재산권 탈취데이터 탈취 랜섬생산성 저하비즈니스 교란
ENTER
ESTABLISH
EXPAND
ENDGAME
NETWORK
DEVICE
USER

Place partner logo and/or Microsoft
Partner Program logo here

보안 1단계: 윈도우 디펜더
크레덴셜 탈취
커널 착취
피싱 공격
ENTER
ESTABLISH
EXPAND
ENDGAME
NETWORK
DEVICE
USER

0단계:
메일로 받아보려고 했더니
이메일 첨부파일을 위험하다고 판단,
Office 365에서 자동으로 삭제했습니다.

메일로는 안되겠어서,
직접 웹에서 다운받아 보겠습니다.

1단계(윈도우 디펜더):
다운 받자마자 윈도우 디펜더에서
위험 파일로 분류, 이미 삭제중입니다.

보안 2단계: 디바이스가드
크레덴셜 탈취
커널 착취
피싱 공격
ENTER
ESTABLISH
EXPAND
ENDGAME
NETWORK
DEVICE
USER

2단계 (디바이스가드):
디펜더를 끄고 다운 받아 실행시켜봤습니다.
Don’t run밖에 선택권이 없습니다.
IT팀에서 허가 받지 않은 어플리케이션이기 때문입니다.
굳이 More Info를 선택해서 run을 누릅니다.
바로 이 때, IT팀에게 보고가 갑니다.

보안 3단계: 크레덴셜 가드
크레덴셜 탈취
커널 착취
피싱 공격
ENTER
ESTABLISH
EXPAND
ENDGAME
NETWORK
DEVICE
USER

Demo:
Windows 7 vs. Windows 10

© 2016 DigitalGlobe, © 2016 HERE
두브로니크, 크로아티아
케이스 A: 한 번의 침투로 모든 것을 잃게 됩니다.

© 2016 HERE
카카소네, 프랑스
케이스 B: 중요한 자산은 분리되고 보호됩니다.

가상화를 기반으로 한 Windows 10만의 보안
Kernel
Windows Platform
Services
Apps
Kernel
SystemContainer
Trustlet#1
Trustlet#2
Trustlet#3
Hypervisor
Device Hardware
중요한 자산은 분리되고 보호됩니다.

윈도우 10의 3단 방어로 랜섬웨어 공격이 불가능했습니다.
크레덴셜 탈취
커널 착취
피싱 공격
ENTER
ESTABLISH
EXPAND
ENDGAME
NETWORK
DEVICE
USER

POST-BREACHPRE-BREACH
Breach detection
investigation &
response
Device
protection
Identity
protection
Information
protection
Threat
resistance
Windows 7 Security features

Breach detection
investigation &
response
Device
protection
Identity
protection
Information
protection
Threat
resistance
Windows 10 Security on Legacy or Modern Devices
(Upgraded from Windows 7 or 32-bit Windows 8)

Windows 10 Security on Modern Devices
(Fresh Install or upgraded from 64-bit Windows 8 )
Breach detection
investigation &
response
Device
protection
Identity
protection
Information
protection
Threat
resistance

1.
Single IT Pro’s machine is
compromised
IT Pro manages
kiosks/shared devices on
network
Attacker steals IT Pro’s
access token
2.
Using IT Pros access token
attacker looks for
kiosk/shared devices and
mines them for tokens
3.
Repeat
TODAY’S SECURITY CHALLENGE:
PASS THE HASH ATTACKS
Access to one
device can lead to
access to many

WINDOWS DEFENDER
ANTI-VIRUS PROTECTION
Built into Windows and Always Up-To-Date
No additional deployment & Infrastructure. Continuously up-to-
date, lower costs
Tamper Resistant
Windows Trusted Boot and platform isolation protect
Windows Defender from attacks and enable it to self-repair
Behavior and cloud-powered malware detection
Can detect fast changing malware varietals using behavior monitoring
and cloud-powered protection that expedites signature delivery
Protection that competes to win
Scored 98.1% detection rating from AV Comparatives testing against
top competitors (March 2016).
2014 2015 2016
Microsoft Protection Stars AVTest
0
1
2
3
4
5
6

Windows 10 Commercial Storybook | Anniversary Update
Section6: Hero BusinessInvestments
Device Guard
31
1. Eliminate malware.
Help secure your environment and prevent untrusted apps and code from running by
using the ultimate form of app control. Using virtualization-based security, the Device
Guard feature in Windows 10 offers a solution more powerful than traditional app control
products, providing rigorous protection from tampering and bypass.
2. Hardware rooted app control.
Device Guard uses virtualization-based security to isolate and help protect Device Guard
features, such as the Hyper-V Code Integrity Service (HVCI), from malware and attacks,
even if Windows itself has been compromised. HVCI enables Device Guard to help protect
kernel mode processes from in-memory attacks, giving you a strong defense against
zero-day exploits.
3. Only run trusted apps.
Device Guard helps enable your IT department to decide which software vendors and
apps can be trusted within your environment. IT can designate as trustworthy the right
combination of apps for your organization, from internal line-of-business apps to
everything from the Windows Store to apps from specific software vendors. Device Guard
works with Windows Classic apps and Universal Windows Platform apps, and it includes
tools that make it easy to sign your existing apps.
(Screens simulated, subject to change. Office 365
subscription required for some features )
Windows 10 Enterprise

Windows 10 Commercial Storybook | Anniversary Update
Section6: Hero BusinessInvestments
Credential Guard
32
1. Protect identities from the impact of a full system compromise.
One of several identity protection layers in Windows 10, Credential Guard*
helps protect the user access tokens (derived credentials) that are generated
once users have been authenticated. Protection of these tokens is critical to
prevent Pass the Hash attacks, which is the go-to tactic for nearly all major
network breaches. Credential Guard stores the tokens within a virtualization-
based security (VBS) environment running on top of Hyper-V technology.
This helps prevent attackers from extracting the tokens from devices, even
when the Windows kernel itself has been fully compromised. Credential
Guard is designed so that malware running in the operating system, even
with the highest privilege level, can‘t access user related access tokens.
2. Hardware-level security.
Credential Guard* uses hardware-based virtualization and Hyper-V to host
Windows 10 security credentials and isolate them from malware. Hardware
based isolation prevents attackers, even with the highest level of Windows
privilege, from accessing user related access tokens.
3. Easy Manageability.
Credential Guard* can be enabled using Group Policy making it easy and
familiar for your IT staff to administer using the existing management tools
they have in place.
Windows 10 Enterprise
(Screen simulated, subject to change)
*Requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such
as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)

랜섬웨어 vs 윈도우 10

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a 랜섬웨어 vs 윈도우 10

Semelhante a 랜섬웨어 vs 윈도우 10 (20)

Último

Último (6)

랜섬웨어 vs 윈도우 10

Notas do Editor