Microsoft releases new security framework for Windows 10

New Windows 10 security framework mimics the DEFCON levels used by US armed forces

Microsoft has unveiled a new "security configuration framework" to help system administrators better protect Windows 10 devices.

The SECCON framework outlines the steps users should take to secure the Windows 10 operating system, based on five security access levels.

"In the past, we left defining the security configuration for Windows 10 as a task for every customer to sort out," explained principal program manager Chris Jackson. "As a result, we saw as many different configurations as we saw customers."

He said the framework simplifies security configuration "while still allowing enough flexibility to allow you to balance security, productivity and user experience".

Jackson and his team developed the framework with a select group of pilot customers, experts from Microsoft's engineering department and the Microsoft sales field.

"We sat down and asked ourselves this question: if we didn't know anything at all about your environment, what security policies and security controls would we suggest you implement first?," continued Jackson

Security recommendations are organised in "coherent and discrete" groups, which Microsoft said makes it easier for you to see where you stand in terms of your defensive posture.

For the initial draft, Microsoft has defined five levels of security configuration and wanted to mimic the DEFCON levels used by the US Army. It explained: "Lower numbers indicate a higher degree of security hardening."

The recommendations by Microsoft are:

1. Enterprise security - We recommend this configuration as the minimum-security configuration for an enterprise device. Recommendations for this security configuration level are generally straightforward and are designed to be deployable within 30 days.
2. Enterprise high security - We recommend this configuration for devices where users access sensitive or confidential information. Some of the controls may have an impact to app compatibility, and therefore will often go through an audit-configure-enforce workflow. Recommendations for this level are generally accessible to most organizations and are designed to be deployable within 90 days.
3. Enterprise VIP security - We recommend this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (for example, one organization identified users who handle data whose theft would directly and seriously impact their stock price). An organization likely to be targeted by well-funded and sophisticated adversaries should aspire to this configuration. Recommendations for this security configuration level can be complex (for example, removing local admin rights for some organizations can be a long project in and of itself) and can often go beyond 90 days.
4. DevOps workstation - We recommend this configuration for developers and testers, who are an attractive target both for supply chain attacks and credential theft attacks that attempt to gain access to servers and systems containing high-value data or where critical business functions could be disrupted. We are still developing this guidance, and will make another announcement as soon as it is ready.
5. Administrator workstation - Administrators (particularly of identity or security systems) face the highest risk, through data theft, data alteration, or service disruption. We are still developing this guidance, and will make another announcement as soon as it is ready.

The tech giant explained that this is the first draft and that it will gather feedback from organisations looking to implement a device security hardening program.

Microsoft concluded: "We are eager to gather feedback on how we could make this guidance more useful, and if there are security controls and configurations you feel may be misplaced (or missing)."

Delta is a new market intelligence service from Computing to help CIOs and other IT decision makers make smarter purchasing decisions - decisions informed by the knowledge and experience of other CIOs and IT decision makers.

Delta is free from vendor sponsorship or influence of any kind, and is guided by a steering committee of well-known CIOs, such as Charles Ewen, Christina Scott, Steve Capper and Laura Meyer.

Ten crucial technology areas are already covered at launch, with more data appearing and more areas being covered every week. Sign-up here for your free trial of the Computing Delta website.