The launch of every new version of Windows, be it server or client, has come with the promise of enhanced security measures. Sometimes, those promises prove to be hollow.
But with Windows Server 2016, Microsoft has made a genuine attempt to answer security-related qualms and queries of chief information officers. Moreover, Windows Server 2016 does well to avoid and tackle dangers of over-privileged administrators, phished credentials, and unreliable binaries.
There is good reason for these additions. The growing scale and sophistication of hacks and attacks indicates that security concerns are no longer the sole domain of IT teams. Windows Server 2016 seeks to manage security via three major areas – protecting virtual machines, safeguarding user credentials and identities, and shielding the OS in the cloud and on servers. Read on to learn about the improved safety methods and how CIOs benefit from Windows Server 2016.
What’s new?
The security features available with Windows Server 2016 make a lot of sense, and it’s strange that Microsoft neglected to include them for so long. However, better late than never, as they say.
- Bare-bones Nano Server
As far as the Nano Server in Windows Server 2016 is concerned, minimalism is the name of the game. What you get is a highly simplified yet powerful version that removes the graphical interface, which provides the least possible attack surface.
The Nano Server takes up very little hard disk space and even less memory to run, which means that you enjoy blindingly fast bootup time. However, this does not in any way indicate that the Nano Server is devoid of any important server roles; on the contrary, application servers such as IIS web hosting and Hyper-V add value.
- JEA (Just Enough Administration)
The concept of least privilege finally comes into play with the PowerShell. The approach, dubbed JEA, happens to be a part of Management Framework 5.0. This means that more granular roles are now limited to specific situations, providing more opportunities to decrease administrator access than was earlier possible.
However, it is necessary to understand that JEA is breakable by hackers and cybercriminals who wish to exploit its vulnerabilities in terms of role capabilities. Thus, JEA must not be treated as a security barrier. Instead, it needs to be monitored and controlled in a manner similar to a traditional administrator access.
- Innovative identity management services
Windows Server 2016 introduces a slew of new identity management services that improve hardware extensions, leading to more secure Active Directory domains and certificates. This is based on the concept of a bastion forest. No, this has nothing to do with the Redwoods! Also termed as red forest, it is the place where admin accounts are found. It is possible to isolate bastion forests to secure accounts.
Updates and developments
Not all security features found in Windows Server 2016 are new. Some existed in older OS versions as well. The only difference is that they underwent further development to make them more relevant and compliant to the requirements of chief information officers.
- Headless version of Windows Defender
Windows Defender, Microsoft’s home-grown version of an antimalware program, sees a drastic increase in its security features with the newest Windows Server 2016. This has been made possible with the absence of a graphical interface, as already mentioned.
What prompted server systems to reconsider GUIs? The answer is two-fold: A GUI uses system resources that can be better applied by the server to other areas, and a GUI contains unnecessary OS bits with possible security risks that decrease the server’s total security level.
Instead of the GUI, most of the management is now carried out with the aid of PowerShell command line prompts.
- Necessary hardware extensions
UEFI firmware has long been a staple in all PCs along with hardware-based central processing unit (CPU) virtual extensions and trusted platform module (TPM) chips. They’re finally being leveraged in the Windows Server 2016, thanks to an innovative feature known as Device Guard.
What this does is lock down all your servers so that you can only run apps that have been signed digitally and have received permission from specific security policies. Such a step was taken with the intention of safeguarding the integrity of servers to better contain malware.
- Virtual machine encryption
Virtual machines often face threats from users with admin access to the hypervisor. They could run rampant on the virtual infrastructure. However, Windows Server 2016 permits virtual machines to run from hard drive files that have been encrypted, thereby making it harder to implement any changes. A virtual total productive maintenance (TPM) is now used by virtual machines for disk protection.
- Host guardian
The trend of server virtualization has now become commonplace in the industry, with many CIOs wanting to go digital. Even though this technique has been found to be moderately secure, it has always suffered from the problem of VM portability. There is nothing that prevents the virtual hard disk of the VM from being copied onto removable media.
The Host Guardian Server is one of the most critical tools available with Windows Server 2016. This is an advanced key and attestation security service that enables a hypervisor host to be configured in such a way that it acts in a manner similar to a guarded host. It is paramount to identify guarded hosts positively on the network, and attest to the TPM and/or Active Directory level.
In case the TPM attestation is currently in use, Windows Server 2016 can go as far as to verify the health of the host through a thorough comparison of its configuration with a reliable baseline config.
Windows Server 2016 assumes that the IT infrastructure of an organization is constantly under the threat of attack and offers CIOs improved methods and features to shield against dangers to critical servers. System security is a priority for the new server and the Microsoft development team is constantly coming up with new countermeasures based on the assumptions that system breaches will grow in number. A few of the new measures do take some time to get used to. However, this is definitely the direction of the future and this awareness is necessary for all CIOs.
