We're encrypting some of the machines in the office with Veracrypt
Are you going to fully encrypt the machines or create an encrypted container? The reason I ask this will be clear below.
Use Teamviewer but with MFA, strong password and strong password to log into Windows
I am unsure but this isn't what MFA stands for. There are 3 factors of authentication - something you know (passwords/passphrases), something you have (tokens), something you are (bio-metrics) -
Since this is password authentication on two different apps the security will depend on:
Teamviewer: Make sure you're using a version of teamviewer which does not have known vulnerabilities. Using the latest version is usually advised
The reason I asked you if you're going to do a FDE (Full disk encryption) or a container is because if you're going to fully encrypt the hard-disk is protects the data only if the HDD / computer is physically stolen - provided the computer is shutdown or at least rebooted and on the login screen of veracrypt.
If you create an encrypted container and dismount it - whoever logs in to the PC in whichever manner (locally or over Teamviewer) will have to mount the encrypted container.
Unless there is risk of physical theft, only way Veracrypt or any other encryption program can add value (to certain extent) is if you create an encrypted container. In case you fully encrypt the hard-disk, keep the computer running and the DEV will login from home - I don't see any addition of security. It will help more, if the DEV unmounts the encrypted partition / container and mounts it from home again. However this again is minimal since if the computer if infected / compromised the key can be captured while being entered / data can be extracted while the partition is mounted
What I would advise you to do is to harden the system and network devices.
Remove all services you don't need on the system (disable them). You may refer to www.blackviper.com/service-configurations/ to help you in this.
Patch - Patch and Patch: OS, software on the system, BIOS, drivers - everything should be at it's latest release (production release).
Create a reduced right user and run teamviewer on that account. Let the DEV run his software from there. Set the UAC on windows to FULL.
Install Microsoft's EMET and set it to high. In BIOS / UEFI enable DEP (in windows enable DEP for all programs except mentioned below - don't mention any).
Install a good AV (Norton / Kaspersky) and configure the firewall to block all network traffic unless explicitly allowed (and required), drop protocols that you don't need to use. If you can enable logging on the machine for network traffic, do that. it may help in case of a compromise. This can be set up without any cost with syslog.
Simple file sharing.
Dump file creation on BSOD.
Remote assistance (will be reactivated using AD).
Put basic security policies using local policy such as complex password - require alt+ctrl+del at logon.
Following are some suggested settings - please check them for your requirement. I would recommend to disconnect the system from a domain and make it stand alone. It would help if you isolate the traffic to this machine using VLAN. Settings mentioned below are not for a PC connected to a DC.
- Accounts: Block Microsoft accounts: Enabled
- Accounts: Guest account status: Disabled
- Account: Administrator account: Disabled.
- Accounts: Limit local account use of blank passwords to console logon only: enabled
- Audit: Audit access of global system objects: enabled
- Audit: Audit the use of Backup and Restore privilege: enabled
- Audit: Force audit policy subcategory settings (Windows Vista of later) to override audit policy category settings: enabled
- Audit: Shutdown system immediately if unable to log security audits: enabled
- DCOM: Machine access restrictions: no remote access for all accounts
DCOM; Machine launch restrictions: no remote launch and remote activation for all accounts
- Devices: Allow undock without having to log on: disabled
- Devices: Allowed to format and eject removable media: administrators and interactive users
- Interactive logon: Do not display last user name: enabled
- Interactive logon: Do not require CTRL+ALT+DEL: disabled
- Interactive logon; Machine account lockout threshold: 10 invalid logon attempts
- Interactive logon: Machine inactivity limit: 300 seconds
- Interactive logon: Prompt user to change password before expiration: 14 days
- Network access: Allow anonymous SID/Name translation: disabled
- Network access: Do not allow anonymous enumeration of SAM accounts: enabled
- Network access: Do not allow anonymous enumberation of SAM accounts and shares: enabled
- Network access: Do not allow storage of passwords and credentials for network authentication: enabled
- Network access: Let Everyone permissions apply to anonymous users: disabled
- Network access: Named Pipes that can be accessed anonymously: blank
- Network access: Remotely accessible registry paths: blank
- Network access; Remotely accessible registry paths and sub-paths: blank
- Network access: Restrict anonymous access to Named Pipes and Shares: enabled
- Network access: Shares that can be accessed anonymously: blank
- Network access: Sharing and security model for local accounts: Classic - local users authenticate as themselves
- Network security: Allow Local System to use computer identity for NTLM: : enabled
- Network security: Allow LocalSystem NULL session fallbasck: disabled
- Network security: Allow PKU2U authentication requests to this computer to use online identifies: disabled
- Network security: Configure encryption types allowed for Kerberos: AES128_HMAC_SHA1, AES256_HMAC_SHA1, Future encryption types
- Network security: Do not store LAN Manager hash value on next password change: enabled
- Network security: Force logoff when logon hours expire: disabled
Network security; LAN MAnager authentication level: Send NTLMv2 response only, Refuse LM & NTLM
- Network security: LDAP client signing requirements: Require signing
Network security: Minimum session security for NTLM SSP based (including secure RPC) clients: Require NTLMv2 session security, Require 128 bit encryption
- Network security: Minimum session security for NTLM SSP based (including secure RPC) server: Require NTLMv2 session security, Require 128 bit encryption
36.Network security: Restrict NTLM: Incoming NTLM traffic: Deny all accounts
- Network security: Restrict NTLM: NTLM authentication in this domain: Deny all
- Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers: Deny all
- Recovery console: Allow automatic administrative logon: disabled
Recovery console: Allow floppy copy and access to all drives and all folders: disabled
- Shutdown: Allow system to be shut down without having to logon: enabled
- Shutdown: Clear virtual memory pagefile: enabled (check veracrypt for any conflicts with this setting)
- System cryptography: Use FIPS compliant algorithms for encryption, hashing and signing: Enabled
- System objects: Require case insensitivity for non-Windows subsystems: enabled
- System objects: Strengthen default permissions of internal system objects :enabled
- System settings: Optional subsystems: blank
- System settings: Use Certificate Rules on Windows Executables for Software Restriction Policies: enalbled
- UAC: Admin Appoval Mode for Built-in Administrator account: enabled
- UAC: Allow UIAccess applications to prompt for elevation without using the secure desktop; disabled
49 UAC: Behavior of elevation prompt for administrators in Admin Approval Mode; 50. Prompt for consent on the secure desktop
- UAC: Behavior of the elevation prompt for standard users: Automatically deny elevation requests
- UAC: Detect application installations and prompt for elevation: enabled
- UAC: Only elevate executables that are signed and validated: disabled
UAC; Only elevate UIAccess applications that are installed in secure locations: enabled
- UAC: Run all administrators in Admin Approval Mode: enabled
- UAC: Switch to the secure desktop when prompting for elevation: enabled
- UAC: Virtualize file and registry write failures to per-user locations: nabled
Hope this helps, system can be further secured by controlling what websites are being surfed to, drop the rights of the browser (you don't need to do this if you're allowing the DEV to logon to a limited privilege account) and files being opened. If you can disable Adobe Flash, Reader and Java it will help immensely. You can also block above mentioned apps from internet activity (except flash) if they're absolutely needed.
In the long run please have some sort of remote login service (Microsoft RDP is great and I feel you should explore it if your version of windows 10 is professional) enabled that has ability to take secondary credential from a token device (since the user will not be present in person, bio-metrics cannot be used).
Hope this helps.