{"id":1611,"date":"2014-07-21T12:09:00","date_gmt":"2014-07-21T12:09:00","guid":{"rendered":"https:\/\/blogs.msdn.microsoft.com\/powershell\/2014\/07\/21\/creating-a-secure-environment-using-powershell-desired-state-configuration\/"},"modified":"2024-02-22T11:01:34","modified_gmt":"2024-02-22T19:01:34","slug":"creating-a-secure-environment-using-powershell-desired-state-configuration","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/creating-a-secure-environment-using-powershell-desired-state-configuration\/","title":{"rendered":"Creating a Secure Environment using PowerShell Desired State Configuration"},"content":{"rendered":"

Introduction:<\/strong><\/span><\/p>\n

Traditionally, IT environments have secured their business critical information against external threats by adding additional layers of security to the org\u2019s network (e.g. firewalls, DMZs, etc.).\u00a0 <\/span>\nHowever many of today\u2019s attacks are coming from inside the network so a new \u201cassume breach\u201d approach must be adopted.<\/span><\/p>\n

In this blog, we show how to create a secure environment to run a particular application or service inside of an assume-breached network.\u00a0 This substantially reduces the attack surface of the application or service by <\/span>configuring a highly customized, application specific environment, by limiting user access and by having \u201cJust Enough\u201d administrative control with full auditing.<\/span><\/p>\n

Below is a sample environment called Safeharbor.\u00a0 Safeharbor is an isolated environment for critical information that limits access to the resources. This is accomplished by:<\/span><\/p>\n

\u2022\u00a0Policies to clearly define User access and actions on the resources<\/span>\n\u2022\u00a0Separate isolated domain constraining access to the resources<\/span>\n\u2022\u00a0Limited & relevant access to users<\/span>\n\u2022\u00a0Auditing access to protected data, changes to user permissions and setting up alerts on access.<\/span><\/p>\n

We will walk you through an implementation of the Safeharbor environment using PowerShell Desired State Configuration (DSC) and PowerShell Constrained Endpoints.<\/span><\/p>\n

The key elements of creating a secure environment are:<\/strong><\/span><\/p>\n