Microsoft Windows Defender Device Guard
What is Windows Defender Device Guard?
Windows Defender Device Guard is a security feature for Windows 10 and Windows Server designed to use application whitelisting and code integrity policies to protect users' devices from malicious code that could compromise the operating system.
With a code integrity policy, which IT creates to determine what software can run on Windows 10, IT can prevent unknown or untrusted applications, as well as specific plug-ins, add-ons or other application modules, from accessing end-user devices.
Device Guard goes hand in hand with Microsoft's AppLocker and Windows Defender Credential Guard to provide a preventative security system. IT can use Device Guard alongside Virtual Secure Mode (VSM), a Windows hypervisor-protected kernel, to provide virtualization-based security, which helps keep bad drivers and files off the system.
According to Microsoft's website, "Device Guard is no longer used except to locate memory integrity and VBS settings in Group Policy or the Windows registry."
How does Windows Defender Device Guard work?
Windows Defender Device Guard uses code integrity policies, which are known as Windows Defender Application Control as of Windows 10 version 1709, for IT to allowlist applications and extensions within those applications that can run on the OS. This allows IT to block unwanted software before it ever enters the system. IT can also create a set of trusted users with trusted signatures who are the only people who can alter the code integrity policies. Device Guard runs the code integrity policies through a kernel in a container.
Device Guard provides security for both physical and virtual desktop deployments. Device Guard code integrity policies work on CPU virtualization extensions, second level address translations and input/output memory management units (IOMMUs).
Key Windows Defender Device Guard features
An additional tool in Windows Defender Application Control called Package Inspector creates a catalog of the binary files for all trusted applications. Even if malware does seep into the VSM kernel, Device Guard prevents it from executing code with code integrity checks in secure systems. If there is a direct memory access attack, the IOMMUs deny access to unusual memory requests. Windows Defender Device Guard also has a Universal Extensible Firmware Interface that performs a secure boot to protect against boot kits and brute-force attackers.
Tools for managing Windows Defender Device Guard
IT professionals can use similar management methods with Device Guard as they do with other Windows programs. IT can set up and manage the catalog files and code integrity policies with Group Policy Objects in the administrative template. IT can deploy and manage code integrity policies, catalog files and hardware security features with System Center Configuration Manager. Windows PowerShell works well for IT professionals that want to focus on creating and sending out code integrity policies. Microsoft Intune may eventually support deployment and management of catalog files and code integrity policies as well, according to Microsoft.
