PAW - 防护思路相关项目

项目说明

How do I use this repo?

I ha each security control in a recommended order that should be followed when starting out. Each directory is labeled ## - Title. Each directory contains its own README file that details what's going on and how to apply the control. Follow the order of the numbers. When done, work on the *xx - policy* controls in any order you desire.

To alleviate troubleshooting, fully test your en before continuing on to the next section. Literally spend several days living under the new policy to see how things work.

Where a script is concerned, specific instruction and requirements to run the script can be found within the script's comment header.

Pri Access Workstation (PAW)

What is a PAW?

In short, a PAW is one solution to the problem of credential theft, replay and pi attacks, and pri escalation. PAW is a method of administrating network devices in a more secure and more hardened en than what most admins are used to. A successful PAW deployment will contain many security controls aimed to enable a more Defense in Depth) security strategy.

Okay, but what is a PAW?

A PAW is the workstation the admin uses to access and administrate the network using pri credentials. It provides the admin a secure method to perform day-to-day administrati on network devices such as Domain Controllers, member servers, user workstations, networking equipment, and cloud admin portals (like Azure and AWS). Because the PAW adheres to the Clean Source Security Principal it prevents the logged on user from freely surfing the Internet, checking email, running applications outside of the AppLocker whitelist, or insecurely accessing network devices that could expose risk to credential theft. It provides the admin e they need to do their job and nothing more Least Pri Security.

How is a PAW physically different than a normal workstation where I administrate my servers with RDP and MMC?

The PAW is a physical workstation, preferably a laptop, that runs Windows 10 Enterprise Edition (1709+) as the primary host OS. This device is used to administrate the network and all the systems on it. It has the Hyper-V role installed that, in addition to security features like Credential Guard, hosts a VM that provides the admin day-to-day Internet access and email. PAWs ha hardware requirements to make for the most secure deployment:

Consider buying from a that has frequent firmware updates and a long support life-cycle. Specialized hardware like Sony Vaio and Alienware should also not be considered.

Additionally, you should be aware of DMA attacks and consider purchasing hardware that does not come with DMA ports (Thunderbolt, PCI-E, Firewire, ExpressCard). See Sami Laiho's Win-Fu Blog for more details about DMA attacks and mitigation.

If a single workstation that handles the load of two is not optimal for your en, you can split the roles onto separate laptops. One workstation for secure administration, and one for Internet and email.

Is it difficult to configure PAWs?

The main purpose of this repo is provide baseline configuration templates and walkthroughs to make the configuration simpler. Initially, it is quite complex. As I look at my GPOs that are designed to address only PAWs, I count 36 and growing. The biggest complexity, however, is changing your IT team's behavior around remote administration. You will be doing things very different than you are used to. I like the saying, *it is fundamentally impossible to impro wilst keeping it the same*.

项目信息

开发语言：PowerShell

Star 数：318

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕防护思路相关项目展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。