Microsoft Adds Enterprise Security Features To WSL
WSL, or Windows Subsystem for Linux, is a feature that allows users to run Linux applications natively on Windows 10 and Windows 11. WSL has been gaining popularity among developers, researchers, and enthusiasts who want to use Linux tools and environments on Windows machines1.
However, WSL also poses some security challenges, as it operates in a different context than the Windows host, and may not be fully compatible with the existing security solutions and policies that are applied to Windows. For example, WSL may not be protected by the Windows firewall, antivirus, or endpoint detection and response (EDR) systems, and may expose sensitive data or credentials to potential attackers23.
To address these challenges, Microsoft has been adding enterprise security features to WSL, such as:
- Microsoft Defender for Endpoint (MDE) integration: MDE is an enterprise endpoint security platform that helps prevent, detect, investigate, and respond to advanced threats. MDE now integrates with WSL as a WSL plugin, which allows security teams to see and continuously monitor for security events in all running WSL distributions with MDE, while minimally impacting performance on developer workloads4.
- Intune settings for WSL: Intune is a cloud-based endpoint management solution that manages user access to organizational resources and simplifies app and device management. Users can use Intune to manage devices inside of their organization, which now also includes managing access to WSL and its key security settings, such as enabling or disabling WSL, requiring a password for sudo commands, and restricting network access to WSL5.
- Advanced networking features and controls: Starting from Windows 11 22H2 and WSL 2.0.9 or later, Windows firewall rules will automatically apply to WSL. This ensures that the firewall rules set on the Windows host will automatically apply to all WSL distributions by default. Users can also customize the firewall rules for WSL using the Windows Defender Firewall with Advanced Security tool6.
These enterprise security features are designed to help IT administrators and security analysts set up and maintain a secure environment for using WSL in their organizations, and to provide more visibility and control over the WSL activities and configurations. Users can also benefit from these features, as they can enjoy the convenience and productivity of WSL without compromising the security and compliance of their Windows devices456.
- Set up Windows Subsystem for Linux for your company1: This is a Microsoft Learn article that provides guidance for IT administrators or security analysts on how to set up and maintain a secure environment for using WSL in their organizations, using Microsoft Defender for Endpoint, Intune, and advanced networking features and controls.
- Windows Subsystem for Linux September 2023 update2: This is a blog post by Craig Loewen, a program manager at Microsoft, that announces the new release for WSL with new features and bug fixes, including the support for new opt-in experimental features, such as autoMemoryReclaim, sparse VHD, mirrored mode networking, dnsTunneling, firewall, and autoProxy.
- WSL2 and security implementations3: This is a Microsoft Q&A thread that discusses the security implications of using WSL2, such as the firewall settings, the antivirus compatibility, and the encryption options. The thread also provides some links to the official documentation and the GitHub repository for WSL.
Source: Phoronix
