1 00:00:00,000 --> 00:00:00,990 In this lesson, 2 00:00:00,990 --> 00:00:03,090 we're going to discuss group policies. 3 00:00:03,090 --> 00:00:05,490 Now, a group policy is a set of rules or policies 4 00:00:05,490 --> 00:00:08,160 that can be applied to a set of users or computer accounts, 5 00:00:08,160 --> 00:00:09,810 within an operating system. 6 00:00:09,810 --> 00:00:12,510 Now, to access the Group Policy Editor inside of Windows, 7 00:00:12,510 --> 00:00:15,750 you can simply go to the Run prompt and enter "gpedit". 8 00:00:15,750 --> 00:00:17,130 The local Group Policy Editor, 9 00:00:17,130 --> 00:00:18,510 will then launch on your system, 10 00:00:18,510 --> 00:00:20,490 and this can be used to create and manage policies 11 00:00:20,490 --> 00:00:22,230 within a Windows environment. 12 00:00:22,230 --> 00:00:24,720 Now each policy is going to act as a security template 13 00:00:24,720 --> 00:00:27,210 that can apply a set of rules to different users. 14 00:00:27,210 --> 00:00:28,650 These rules can contain things like, 15 00:00:28,650 --> 00:00:30,270 password complexity requirements, 16 00:00:30,270 --> 00:00:32,729 account lockout policies, software restrictions 17 00:00:32,729 --> 00:00:34,590 and application restrictions. 18 00:00:34,590 --> 00:00:36,570 If you're using an active directory domain controller, 19 00:00:36,570 --> 00:00:37,620 within Windows, 20 00:00:37,620 --> 00:00:39,690 you'll actually have access to a more advanced version 21 00:00:39,690 --> 00:00:42,000 of the Group Policy Editor as well. 22 00:00:42,000 --> 00:00:43,260 Now, in a corporate environment, 23 00:00:43,260 --> 00:00:45,600 it is really common to create security templates 24 00:00:45,600 --> 00:00:46,680 with predefined rules, 25 00:00:46,680 --> 00:00:49,800 based upon your organization's administrative policies. 26 00:00:49,800 --> 00:00:52,020 This security template is a group of policies 27 00:00:52,020 --> 00:00:53,700 that can be loaded through a single procedure, 28 00:00:53,700 --> 00:00:55,590 within the Group Policy Editor. 29 00:00:55,590 --> 00:00:57,660 A large part of hardening your operating system 30 00:00:57,660 --> 00:00:58,560 is going to occur through 31 00:00:58,560 --> 00:01:00,660 loading different group policy objectives 32 00:01:00,660 --> 00:01:04,470 or GPOs against the workstation or a given server. 33 00:01:04,470 --> 00:01:06,570 These group policies are also going to be used 34 00:01:06,570 --> 00:01:07,740 to create a secure baseline 35 00:01:07,740 --> 00:01:10,590 as part of your larger configuration management program. 36 00:01:10,590 --> 00:01:13,290 Using these policies, new accounts and computers 37 00:01:13,290 --> 00:01:14,490 can quickly become configured 38 00:01:14,490 --> 00:01:16,440 with all of your organizational requirements 39 00:01:16,440 --> 00:01:18,420 in a single application. 40 00:01:18,420 --> 00:01:20,100 After you create your secure baseline, 41 00:01:20,100 --> 00:01:22,680 it's also important that you conduct baselining. 42 00:01:22,680 --> 00:01:25,200 Now, baselining is a process of measuring changes 43 00:01:25,200 --> 00:01:27,930 in your network, hardware or software environments. 44 00:01:27,930 --> 00:01:30,420 Effectively, baselining is going to help to establish 45 00:01:30,420 --> 00:01:32,670 what normal is for your organization. 46 00:01:32,670 --> 00:01:33,990 By knowing what normal is, 47 00:01:33,990 --> 00:01:35,640 you can then identify what abnormal 48 00:01:35,640 --> 00:01:37,650 or a deviation is going to look like. 49 00:01:37,650 --> 00:01:38,610 For example, 50 00:01:38,610 --> 00:01:40,380 if you're looking at your network utilization, 51 00:01:40,380 --> 00:01:41,580 over a period of time, 52 00:01:41,580 --> 00:01:44,220 you can identify high periods and low periods. 53 00:01:44,220 --> 00:01:45,810 If you normally have a lot of low periods 54 00:01:45,810 --> 00:01:48,210 of activity during a Saturday afternoon for example, 55 00:01:48,210 --> 00:01:49,211 but this Saturday afternoon 56 00:01:49,211 --> 00:01:51,990 you saw an excessively high amount of activity, 57 00:01:51,990 --> 00:01:54,510 you should be looking into that and investigating it. 58 00:01:54,510 --> 00:01:56,370 For example, in this image, 59 00:01:56,370 --> 00:01:59,340 you can see one very high traffic spike of activity. 60 00:01:59,340 --> 00:02:01,500 We should compare this against our known baseline 61 00:02:01,500 --> 00:02:03,900 and then determine if this spike is expected 62 00:02:03,900 --> 00:02:06,450 or if it should be investigated further. 63 00:02:06,450 --> 00:02:09,270 Now, every deviation should be looked at and categorized 64 00:02:09,270 --> 00:02:11,220 as either acceptable and expected 65 00:02:11,220 --> 00:02:13,650 or an issue to investigate further. 66 00:02:13,650 --> 00:02:15,360 Many data breaches have been discovered 67 00:02:15,360 --> 00:02:18,060 by investigating higher than expected network utilization, 68 00:02:18,060 --> 00:02:20,520 during periods that should have been relatively low. 69 00:02:20,520 --> 00:02:22,620 By looking at these people have found things, 70 00:02:22,620 --> 00:02:24,270 like data exfiltration occurring 71 00:02:24,270 --> 00:02:27,300 or other problems that have happened on their network. 72 00:02:27,300 --> 00:02:28,440 So, now that we've covered a little bit, 73 00:02:28,440 --> 00:02:29,670 about group policies, 74 00:02:29,670 --> 00:02:32,010 let's go ahead and jump into the Group Policy Editor, 75 00:02:32,010 --> 00:02:34,230 inside of a Windows 10 machine so you can see 76 00:02:34,230 --> 00:02:35,910 what this looks like in the real world. 77 00:02:35,910 --> 00:02:38,640 Here we are inside of our Group Policy Editor, 78 00:02:38,640 --> 00:02:42,270 and we access this by going to "gpedit" from the Run Prompt. 79 00:02:42,270 --> 00:02:44,610 Now, from here I want to show you a couple of things 80 00:02:44,610 --> 00:02:47,490 of how we can create and allow or a block list rule, 81 00:02:47,490 --> 00:02:49,380 inside of our local Windows system. 82 00:02:49,380 --> 00:02:52,500 And this creates a basic group policy or GPO 83 00:02:52,500 --> 00:02:53,730 that we can then apply, 84 00:02:53,730 --> 00:02:55,860 across all of our other computers later on 85 00:02:55,860 --> 00:02:57,420 in a domain environment. 86 00:02:57,420 --> 00:02:58,290 Now, from here, 87 00:02:58,290 --> 00:03:00,150 I want to go into my computer configuration 88 00:03:00,150 --> 00:03:03,000 and you'll see there's one that's called Windows Settings. 89 00:03:03,000 --> 00:03:05,310 Now, when I go ahead and hit the Down arrow here, 90 00:03:05,310 --> 00:03:07,260 you'll be able to see all the different options we have, 91 00:03:07,260 --> 00:03:09,690 including name resolution policies, scripts, 92 00:03:09,690 --> 00:03:13,680 deployed printers, security settings and policy-based QOS. 93 00:03:13,680 --> 00:03:16,410 In our case, we want to look at our security settings. 94 00:03:16,410 --> 00:03:17,640 Under the security settings, 95 00:03:17,640 --> 00:03:19,410 you'll see things like our account policies, 96 00:03:19,410 --> 00:03:21,480 our local policies, and many others. 97 00:03:21,480 --> 00:03:23,790 For example, if I click on the Account Policies, 98 00:03:23,790 --> 00:03:25,590 you'll see things like our password policy 99 00:03:25,590 --> 00:03:27,480 and our account lockout policy. 100 00:03:27,480 --> 00:03:29,490 In our case, what I really want to focus on 101 00:03:29,490 --> 00:03:31,680 is our application control policies, 102 00:03:31,680 --> 00:03:34,590 and you'll see that here listed about halfway down. 103 00:03:34,590 --> 00:03:35,940 Once you click on that, 104 00:03:35,940 --> 00:03:37,140 you'll be able to expand it 105 00:03:37,140 --> 00:03:39,510 and see that we have AppLocker underneath it. 106 00:03:39,510 --> 00:03:41,040 When you click on AppLocker, 107 00:03:41,040 --> 00:03:42,810 this is a program that will allow you to see, 108 00:03:42,810 --> 00:03:45,330 all of your different rules on your system. 109 00:03:45,330 --> 00:03:47,250 Right now you can see that AppLocker 110 00:03:47,250 --> 00:03:49,740 is going to provide access control for your applications 111 00:03:49,740 --> 00:03:51,210 and we can create allow rules, 112 00:03:51,210 --> 00:03:53,520 known as allow listing or deny rules, 113 00:03:53,520 --> 00:03:56,130 known as block listing inside of AppLocker. 114 00:03:56,130 --> 00:03:57,390 If I want to see additional information, 115 00:03:57,390 --> 00:03:58,860 I can hit the Down arrow here, 116 00:03:58,860 --> 00:04:00,390 and you'll see we have different categories, 117 00:04:00,390 --> 00:04:02,010 including executable rules, 118 00:04:02,010 --> 00:04:04,080 Windows installer rules, script rules 119 00:04:04,080 --> 00:04:06,060 and package application rules. 120 00:04:06,060 --> 00:04:08,790 In our case, we're going to work on the executable rules. 121 00:04:08,790 --> 00:04:10,680 So, I'm going to go ahead and hit the Down arrow there 122 00:04:10,680 --> 00:04:11,513 and you'll be able to see 123 00:04:11,513 --> 00:04:12,840 that there's nothing underneath it yet, 124 00:04:12,840 --> 00:04:14,730 but when I click on the executable rules, 125 00:04:14,730 --> 00:04:16,829 we also see there is nothing here. 126 00:04:16,829 --> 00:04:18,120 Now why is that? 127 00:04:18,120 --> 00:04:20,850 Well, the reason is we haven't created any rules yet. 128 00:04:20,850 --> 00:04:22,440 This is a brand new system. 129 00:04:22,440 --> 00:04:23,940 So, if I want to create a rule, 130 00:04:23,940 --> 00:04:26,190 I'll simply go into the white space, right click, 131 00:04:26,190 --> 00:04:28,560 and then click on Create New Rule. 132 00:04:28,560 --> 00:04:30,420 By doing this, it'll bring up a wizard 133 00:04:30,420 --> 00:04:32,100 that will walk us through how we can go 134 00:04:32,100 --> 00:04:33,330 and create these rules. 135 00:04:33,330 --> 00:04:35,520 So, the first thing we're going to do is click on Next, 136 00:04:35,520 --> 00:04:36,930 and then from here we're going to create, 137 00:04:36,930 --> 00:04:39,060 either an allow rule or a deny rule. 138 00:04:39,060 --> 00:04:40,200 If it's an allow rule, 139 00:04:40,200 --> 00:04:41,880 it's going to be part of our allow list. 140 00:04:41,880 --> 00:04:42,960 If it's a deny rule, 141 00:04:42,960 --> 00:04:45,930 it'll be part of our deny list or our block list. 142 00:04:45,930 --> 00:04:46,763 In this case, 143 00:04:46,763 --> 00:04:49,050 I want to block any executables from running 144 00:04:49,050 --> 00:04:50,610 from the temporary directory. 145 00:04:50,610 --> 00:04:52,740 So, I'm going to go ahead and click on Deny. 146 00:04:52,740 --> 00:04:55,110 Then we're going to select who this applies to. 147 00:04:55,110 --> 00:04:56,970 Is this going to apply to everyone in the system 148 00:04:56,970 --> 00:05:00,420 or just our regular users or just our administrative users? 149 00:05:00,420 --> 00:05:02,550 In this case, I want this to apply to everyone, 150 00:05:02,550 --> 00:05:04,680 so I'll leave it selected as everyone. 151 00:05:04,680 --> 00:05:05,880 Then we'll click on Next. 152 00:05:05,880 --> 00:05:08,040 And from here we're going to select what type of condition 153 00:05:08,040 --> 00:05:10,020 we want this rule to apply to. 154 00:05:10,020 --> 00:05:12,030 Do we want it to apply to a certain publisher? 155 00:05:12,030 --> 00:05:13,890 For example, maybe there's a publisher out there 156 00:05:13,890 --> 00:05:16,080 who just got hacked and it's a big news story 157 00:05:16,080 --> 00:05:17,520 and so you can no longer trust 158 00:05:17,520 --> 00:05:19,110 their digitally signed product, 159 00:05:19,110 --> 00:05:21,330 because some hacker may have put something in there. 160 00:05:21,330 --> 00:05:24,360 In that case, you can block everything from that publisher, 161 00:05:24,360 --> 00:05:26,310 or you can block it based on a path. 162 00:05:26,310 --> 00:05:28,800 And the path that's going to say anything from this folder 163 00:05:28,800 --> 00:05:31,050 or file is no longer going to be able to be run, 164 00:05:31,050 --> 00:05:32,640 because we are blocking that. 165 00:05:32,640 --> 00:05:34,260 Or if you know there's a malicious piece 166 00:05:34,260 --> 00:05:35,093 of malware out there, 167 00:05:35,093 --> 00:05:36,780 and you know what its hash digest is, 168 00:05:36,780 --> 00:05:37,620 because that's being shared, 169 00:05:37,620 --> 00:05:39,600 across the cybersecurity industry right now, 170 00:05:39,600 --> 00:05:42,330 we can add that hash digest in as a file hash, 171 00:05:42,330 --> 00:05:44,460 and anything that matches that hash digest, 172 00:05:44,460 --> 00:05:45,960 we'll be blocked from running. 173 00:05:45,960 --> 00:05:48,060 Now, in our case, I said what I wanted to create 174 00:05:48,060 --> 00:05:50,880 was a rule that blocked any applications from being run 175 00:05:50,880 --> 00:05:52,440 from the temporary directory. 176 00:05:52,440 --> 00:05:54,540 So, that is going to be a path type rule. 177 00:05:54,540 --> 00:05:57,060 So, we'll click on Path and then click on Next. 178 00:05:57,060 --> 00:05:59,820 From here, we need to browse the file or folder 179 00:05:59,820 --> 00:06:01,470 to select what we want to block. 180 00:06:01,470 --> 00:06:03,180 If there's only one file you want to block, 181 00:06:03,180 --> 00:06:05,640 you can click on Browse Files and select that. 182 00:06:05,640 --> 00:06:06,473 But in our case, 183 00:06:06,473 --> 00:06:08,940 I said I wanted to block everything in the temp folder. 184 00:06:08,940 --> 00:06:10,500 So, we're going to go to browse folders 185 00:06:10,500 --> 00:06:12,870 and then we're going to select Windows under our C drive 186 00:06:12,870 --> 00:06:15,630 and then scroll down until we find the temp directory, 187 00:06:15,630 --> 00:06:17,370 and then we'll select that one as well. 188 00:06:17,370 --> 00:06:18,360 So there we go, 189 00:06:18,360 --> 00:06:19,800 and then we'll hit OK. 190 00:06:19,800 --> 00:06:21,330 So now you can see that the path 191 00:06:21,330 --> 00:06:25,560 is %WINDIR%\Temp\* 192 00:06:25,560 --> 00:06:27,540 which means anything inside the temp directory, 193 00:06:27,540 --> 00:06:29,880 will be blocked by this rule for everyone, 194 00:06:29,880 --> 00:06:31,740 because that's how we've configured it. 195 00:06:31,740 --> 00:06:33,450 Next, we'll click on the Next button 196 00:06:33,450 --> 00:06:35,190 and this brings us to our next screen, 197 00:06:35,190 --> 00:06:36,930 which says we can add exceptions. 198 00:06:36,930 --> 00:06:37,830 For example, 199 00:06:37,830 --> 00:06:40,020 maybe this is going to apply to every program, 200 00:06:40,020 --> 00:06:41,790 except ones from Microsoft. 201 00:06:41,790 --> 00:06:42,623 So in that case, 202 00:06:42,623 --> 00:06:45,060 we can say Add the exception for a publisher, 203 00:06:45,060 --> 00:06:47,040 and then we'll click the Add rule. 204 00:06:47,040 --> 00:06:49,470 From here, I can then browse my reference file 205 00:06:49,470 --> 00:06:51,570 and then select any of the publishers that I need. 206 00:06:51,570 --> 00:06:53,280 In our case, I don't want that to happen. 207 00:06:53,280 --> 00:06:55,680 I want everything to be blocked from the temp directory, 208 00:06:55,680 --> 00:06:57,240 so I'm going to cancel out of that. 209 00:06:57,240 --> 00:06:58,073 In addition to that, 210 00:06:58,073 --> 00:07:00,180 you can also say anything in a certain path. 211 00:07:00,180 --> 00:07:01,013 For example, 212 00:07:01,013 --> 00:07:03,580 maybe I have something under /temp/knowngood 213 00:07:04,680 --> 00:07:06,330 and those would be allowed to be run 214 00:07:06,330 --> 00:07:08,430 or I know a certain file hash is good, 215 00:07:08,430 --> 00:07:11,280 and I can add that here to allow that as an exception. 216 00:07:11,280 --> 00:07:13,080 In our case, I don't want any exceptions. 217 00:07:13,080 --> 00:07:15,390 I want everything inside the temp directory to be blocked. 218 00:07:15,390 --> 00:07:16,620 And so I'm going to leave it like this 219 00:07:16,620 --> 00:07:18,540 and then click on the next rule. 220 00:07:18,540 --> 00:07:20,910 Now from here, we can name this rule. 221 00:07:20,910 --> 00:07:21,743 By default, 222 00:07:21,743 --> 00:07:23,790 it's going to use the path that we just selected, 223 00:07:23,790 --> 00:07:25,980 but that's kind of a funny way of showing this 224 00:07:25,980 --> 00:07:27,720 if we're going to list a list of rules. 225 00:07:27,720 --> 00:07:29,700 So instead, I want to give this a new name 226 00:07:29,700 --> 00:07:33,450 and I'm going to call Block all files from running 227 00:07:33,450 --> 00:07:36,066 in temp directory, right? 228 00:07:36,066 --> 00:07:38,790 And then you can have anything you want in your description. 229 00:07:38,790 --> 00:07:39,623 For example, 230 00:07:39,623 --> 00:07:42,390 this rule was created by Jason 231 00:07:42,390 --> 00:07:47,130 to block malicious files trying to load 232 00:07:47,130 --> 00:07:49,980 from the temp directory, okay? 233 00:07:49,980 --> 00:07:51,510 And then we'll hit Create. 234 00:07:51,510 --> 00:07:52,350 And from here, 235 00:07:52,350 --> 00:07:53,670 we now have this thing saying, 236 00:07:53,670 --> 00:07:55,050 we're ready to create this rule. 237 00:07:55,050 --> 00:07:57,900 And you have no default rules already in the rule list. 238 00:07:57,900 --> 00:07:59,010 Do you want to create them now, 239 00:07:59,010 --> 00:07:59,910 yes or no? 240 00:07:59,910 --> 00:08:02,310 If I say no, we'll only create the one rule we have. 241 00:08:02,310 --> 00:08:03,330 If I say yes, 242 00:08:03,330 --> 00:08:06,150 it's going to create our rule plus a couple of allow rules. 243 00:08:06,150 --> 00:08:07,920 I'm going to allow those default rules to be created. 244 00:08:07,920 --> 00:08:09,030 So, I'm going to say yes, 245 00:08:09,030 --> 00:08:11,610 and now you'll see that we have four different rules. 246 00:08:11,610 --> 00:08:14,850 Here we have the first rule is an allow rule for everybody 247 00:08:14,850 --> 00:08:16,080 and it's a default rule 248 00:08:16,080 --> 00:08:19,410 that allows all files located in the program files directory 249 00:08:19,410 --> 00:08:21,300 or folder to be able to launch. 250 00:08:21,300 --> 00:08:22,860 We have another allow rule for everybody 251 00:08:22,860 --> 00:08:25,440 that allows all files inside the Windows folder to launch, 252 00:08:25,440 --> 00:08:26,730 and we have another allow rule 253 00:08:26,730 --> 00:08:27,960 that allows any administrators 254 00:08:27,960 --> 00:08:29,940 to launch any file on the system. 255 00:08:29,940 --> 00:08:31,920 Then we have our deny rule that we just created, 256 00:08:31,920 --> 00:08:34,620 which blocks all files from running in the temp directory. 257 00:08:34,620 --> 00:08:37,980 So by doing this, we've now created three allow rules 258 00:08:37,980 --> 00:08:40,980 and one deny rule, and from here we can modify any of those 259 00:08:40,980 --> 00:08:43,470 or add any other rules we need on our system. 260 00:08:43,470 --> 00:08:45,690 Once we've done that, we can save this as a policy 261 00:08:45,690 --> 00:08:47,640 and then deploy it across the entire environment, 262 00:08:47,640 --> 00:08:49,920 so this becomes our secure known baseline 263 00:08:49,920 --> 00:08:50,753 that we're going to use 264 00:08:50,753 --> 00:08:52,773 as we harden all of our Windows systems.