In this lesson,
we're going to discuss group policies.
Now, a group policy is a set of rules or policies
that can be applied to a set of users or computer accounts,
within an operating system.
Now, to access the Group Policy Editor inside of Windows,
you can simply go to the Run prompt and enter "gpedit".
The local Group Policy Editor,
will then launch on your system,
and this can be used to create and manage policies
within a Windows environment.
Now each policy is going to act as a security template
that can apply a set of rules to different users.
These rules can contain things like,
password complexity requirements,
account lockout policies, software restrictions
and application restrictions.
If you're using an active directory domain controller,
within Windows,
you'll actually have access to a more advanced version
of the Group Policy Editor as well.
Now, in a corporate environment,
it is really common to create security templates
with predefined rules,
based upon your organization's administrative policies.
This security template is a group of policies
that can be loaded through a single procedure,
within the Group Policy Editor.
A large part of hardening your operating system
is going to occur through
loading different group policy objectives
or GPOs against the workstation or a given server.
These group policies are also going to be used
to create a secure baseline
as part of your larger configuration management program.
Using these policies, new accounts and computers
can quickly become configured
with all of your organizational requirements
in a single application.
After you create your secure baseline,
it's also important that you conduct baselining.
Now, baselining is a process of measuring changes
in your network, hardware or software environments.
Effectively, baselining is going to help to establish
what normal is for your organization.
By knowing what normal is,
you can then identify what abnormal
or a deviation is going to look like.
For example,
if you're looking at your network utilization,
over a period of time,
you can identify high periods and low periods.
If you normally have a lot of low periods
of activity during a Saturday afternoon for example,
but this Saturday afternoon
you saw an excessively high amount of activity,
you should be looking into that and investigating it.
For example, in this image,
you can see one very high traffic spike of activity.
We should compare this against our known baseline
and then determine if this spike is expected
or if it should be investigated further.
Now, every deviation should be looked at and categorized
as either acceptable and expected
or an issue to investigate further.
Many data breaches have been discovered
by investigating higher than expected network utilization,
during periods that should have been relatively low.
By looking at these people have found things,
like data exfiltration occurring
or other problems that have happened on their network.
So, now that we've covered a little bit,
about group policies,
let's go ahead and jump into the Group Policy Editor,
inside of a Windows 10 machine so you can see
what this looks like in the real world.
Here we are inside of our Group Policy Editor,
and we access this by going to "gpedit" from the Run Prompt.
Now, from here I want to show you a couple of things
of how we can create and allow or a block list rule,
inside of our local Windows system.
And this creates a basic group policy or GPO
that we can then apply,
across all of our other computers later on
in a domain environment.
Now, from here,
I want to go into my computer configuration
and you'll see there's one that's called Windows Settings.
Now, when I go ahead and hit the Down arrow here,
you'll be able to see all the different options we have,
including name resolution policies, scripts,
deployed printers, security settings and policy-based QOS.
In our case, we want to look at our security settings.
Under the security settings,
you'll see things like our account policies,
our local policies, and many others.
For example, if I click on the Account Policies,
you'll see things like our password policy
and our account lockout policy.
In our case, what I really want to focus on
is our application control policies,
and you'll see that here listed about halfway down.
Once you click on that,
you'll be able to expand it
and see that we have AppLocker underneath it.
When you click on AppLocker,
this is a program that will allow you to see,
all of your different rules on your system.
Right now you can see that AppLocker
is going to provide access control for your applications
and we can create allow rules,
known as allow listing or deny rules,
known as block listing inside of AppLocker.
If I want to see additional information,
I can hit the Down arrow here,
and you'll see we have different categories,
including executable rules,
Windows installer rules, script rules
and package application rules.
In our case, we're going to work on the executable rules.
So, I'm going to go ahead and hit the Down arrow there
and you'll be able to see
that there's nothing underneath it yet,
but when I click on the executable rules,
we also see there is nothing here.
Now why is that?
Well, the reason is we haven't created any rules yet.
This is a brand new system.
So, if I want to create a rule,
I'll simply go into the white space, right click,
and then click on Create New Rule.
By doing this, it'll bring up a wizard
that will walk us through how we can go
and create these rules.
So, the first thing we're going to do is click on Next,
and then from here we're going to create,
either an allow rule or a deny rule.
If it's an allow rule,
it's going to be part of our allow list.
If it's a deny rule,
it'll be part of our deny list or our block list.
In this case,
I want to block any executables from running
from the temporary directory.
So, I'm going to go ahead and click on Deny.
Then we're going to select who this applies to.
Is this going to apply to everyone in the system
or just our regular users or just our administrative users?
In this case, I want this to apply to everyone,
so I'll leave it selected as everyone.
Then we'll click on Next.
And from here we're going to select what type of condition
we want this rule to apply to.
Do we want it to apply to a certain publisher?
For example, maybe there's a publisher out there
who just got hacked and it's a big news story
and so you can no longer trust
their digitally signed product,
because some hacker may have put something in there.
In that case, you can block everything from that publisher,
or you can block it based on a path.
And the path that's going to say anything from this folder
or file is no longer going to be able to be run,
because we are blocking that.
Or if you know there's a malicious piece
of malware out there,
and you know what its hash digest is,
because that's being shared,
across the cybersecurity industry right now,
we can add that hash digest in as a file hash,
and anything that matches that hash digest,
we'll be blocked from running.
Now, in our case, I said what I wanted to create
was a rule that blocked any applications from being run
from the temporary directory.
So, that is going to be a path type rule.
So, we'll click on Path and then click on Next.
From here, we need to browse the file or folder
to select what we want to block.
If there's only one file you want to block,
you can click on Browse Files and select that.
But in our case,
I said I wanted to block everything in the temp folder.
So, we're going to go to browse folders
and then we're going to select Windows under our C drive
and then scroll down until we find the temp directory,
and then we'll select that one as well.
So there we go,
and then we'll hit OK.
So now you can see that the path
is %WINDIR%\Temp\*
which means anything inside the temp directory,
will be blocked by this rule for everyone,
because that's how we've configured it.
Next, we'll click on the Next button
and this brings us to our next screen,
which says we can add exceptions.
For example,
maybe this is going to apply to every program,
except ones from Microsoft.
So in that case,
we can say Add the exception for a publisher,
and then we'll click the Add rule.
From here, I can then browse my reference file
and then select any of the publishers that I need.
In our case, I don't want that to happen.
I want everything to be blocked from the temp directory,
so I'm going to cancel out of that.
In addition to that,
you can also say anything in a certain path.
For example,
maybe I have something under /temp/knowngood
and those would be allowed to be run
or I know a certain file hash is good,
and I can add that here to allow that as an exception.
In our case, I don't want any exceptions.
I want everything inside the temp directory to be blocked.
And so I'm going to leave it like this
and then click on the next rule.
Now from here, we can name this rule.
By default,
it's going to use the path that we just selected,
but that's kind of a funny way of showing this
if we're going to list a list of rules.
So instead, I want to give this a new name
and I'm going to call Block all files from running
in temp directory, right?
And then you can have anything you want in your description.
For example,
this rule was created by Jason
to block malicious files trying to load
from the temp directory, okay?
And then we'll hit Create.
And from here,
we now have this thing saying,
we're ready to create this rule.
And you have no default rules already in the rule list.
Do you want to create them now,
yes or no?
If I say no, we'll only create the one rule we have.
If I say yes,
it's going to create our rule plus a couple of allow rules.
I'm going to allow those default rules to be created.
So, I'm going to say yes,
and now you'll see that we have four different rules.
Here we have the first rule is an allow rule for everybody
and it's a default rule
that allows all files located in the program files directory
or folder to be able to launch.
We have another allow rule for everybody
that allows all files inside the Windows folder to launch,
and we have another allow rule
that allows any administrators
to launch any file on the system.
Then we have our deny rule that we just created,
which blocks all files from running in the temp directory.
So by doing this, we've now created three allow rules
and one deny rule, and from here we can modify any of those
or add any other rules we need on our system.
Once we've done that, we can save this as a policy
and then deploy it across the entire environment,
so this becomes our secure known baseline
that we're going to use
as we harden all of our Windows systems.