Windows 10 has been around long enough to have some holes poked in its armor.
Microsoft worked to limit Windows 10 security problems by taking action to shut down zero-day attacks, for example, but there are areas that may not be up to corporate standards. This is especially true when it comes to data that users transfer, share and collect.
Organizations can now breathe a sigh of relief because there are places IT can take extra precautions to keep security locked down.
IT must enable full-disk encryption using BitLocker or a third-party tool. This protects users against hackers exploiting their information and identities. Failed or faulty backups are also a major area of concern. IT should perform workstation backups to ensure that all data, documents and code is secure.
It is important to check on software patches to third-party applications and tools, as well. Microsoft prioritizes patching, but that does not extend to third-party apps, which can be open windows into the OS. In addition to these golden rules of security, IT admins can take extra steps to keep OS defenses high.
It is a constant fear for IT and users alike that malware will infiltrate the network. One particularly nasty type of browser malware in Microsoft Edge creates pop-up messages claiming the browser has been compromised. Antimalware tools have not been successful in blocking this type of virus.
In a Microsoft Edge browser, the message won't disappear on its own, and it blocks the user from closing the browser. The user can close the window with Task Manager, but when he opens the browser again, the message will pop up.
To eliminate the message for good, IT professionals must use Task Manager to close the Microsoft Edge browser. Then, open the Control Panel and click Network and Internet, followed by Network and Sharing Center. Finally, choose Change Adapter Settings, and the network display will pop up. Right-click the adapter to bring up a short menu with a disable button, which enables IT to close the browser with the message. Don't forget to right-click on Network Connection and click the Enable button again to restore the browser back to its original state.
A hidden gem in Windows 10 security is the Security Compliance Manager (SCM), a SQL Server-driven management console IT can use to customize, store and export security configurations. Essentially, IT can use SCM to set the ground rules for Windows 10 security settings.
The SCM configurations create the security baseline settings in Windows Server, and they are the first line of defense for organizations. SCM is a free Microsoft Solution Accelerator that IT can use to secure Windows. Microsoft tests and automates these tools to provide a more secure platform.
Don't simply download security baselines and configure standard settings. The Security Compliance Manager enables IT to adjust security baselines through its interface. It provides specific steps for stricter security settings that may appeal to different types of organizations, such as adding sensitive privilege use and detailed tracking options.
Adding body guards, cameras and walls will make a building more secure, but nothing can replace the classic lock on the door. Similarly, one of the best ways to keep organizations safe is implementing strong Windows 10 passwords and lock screens.
Start by enforcing Windows 10 password standards that require complexity, such as a minimum length and the inclusion of numbers or symbols. IT should also mandate password changes every three to six months and enable multifactor authentication to better secure desktops and applications, especially if passwords are the primary form of security for accessing corporate data.
Organizations with the resources to enforce biometric authentication can add another level of security with Windows Hello. Windows Hello enables a user to scan his fingerprint, iris or face in place of a Windows 10 password. Even with Windows Hello, users create a backup PIN code as a password in case of biometric failure.
Lock screens are an underrated form of security that protect against the exploitation of employees when they step away from their devices throughout the day.
Dynamic Lock is a Windows 10 Creators Update feature that engages the lock screen whenever it detects the user's paired mobile device is out of Bluetooth range. Dynamic Lock is part of the Windows 10 sign-in options, so it is up to the user to decide whether or not to turn it on.
Even with the operating system's built-in security features, there is a time and place for IT to take a look at third-party Windows 10 security tools.
Microsoft does a solid job providing defenses for Windows 10. Third-party tools aren't meant to replace those security measures, but rather are meant to add extra support to areas that are more vulnerable to attacks. The top places IT should look into third-party Windows 10 security tools are data encryption, antimalware and software patching and firewalls. Most organizations could use extra protection in these spots because one poked hole could sink the entire ship.
Microsoft provides encryption in Windows 10 with BitLocker, but if IT wants to add more to ensure full-disk encryption, VeraCrypt protects against brute-force attacks.
VirusTotal is antimalware software that can supplement Windows Defender, the built-in antimalware in Windows 10. It provides IT with an additional malware check of files before users open them.
IT may implement GFI LanGuard to automate patch management for Windows, macOS and Linux, as well as smart network and software auditing. This helps IT stay on top of third-party applications, patches and software.
A third-party firewall, such as ZoneAlarm, is a good option for IT admins looking to gain more control over settings and additional features that Windows Firewall does not have. Third-party firewalls also have the advantage of hackers being less familiar with them, making these firewalls more difficult to crack.
The old saying sharing is caring is a great philosophy to teach young kids, but when it comes to Windows 10 privacy, it can be an open door to users' data.
Microsoft has come under fire for the amount of data the company collects through Windows 10. The OS sends telemetry, personalization and services, and advertising data back to Microsoft from each user. This data hoarding is necessary to produce the best user experience possible, according to Microsoft.
Still, many users want to establish some personal boundaries, and they don't want Microsoft tracking their every digital move. Plus, if hackers access the data streaming back to Microsoft, they could steal users' personal information. IT must know about the major privacy issues within Windows 10 to best protect private and corporate data.
Admins and users can take action against these Windows 10 privacy issues. A good place to start is by switching off the advertising ID connected to each individual instance of Windows 10. Turning off this unique identification prevents Microsoft from seeing what each user is looking at specifically. Windows 10 Enterprise and Education users can also stop telemetry data transfers in their settings.
Windows 10 also collects user social graphs -- a user's social network, including online connections and relationships -- and location data. Facebook owns the largest amount of this data, and shares it with Microsoft when enabled in Windows 10. Location data is tricky because it provides personal geographic information, such as a user's home and office location, as well as his daily movements. IT and users can turn off this data transfer in the Location settings.
There are additional places to turn data off, such as the Typing, Other Devices and Group Policy settings. Users and IT should be aware that more privacy limits other areas, such as personalization with Cortana.
