system hardening l.
Skip this Video
Loading SlideShow in 5 Seconds..
System Hardening PowerPoint Presentation
Download Presentation
System Hardening

Loading in 2 Seconds...

play fullscreen
1 / 55

System Hardening - PowerPoint PPT Presentation

  • Uploaded on

System Hardening. Defense in Depth—at home and on the road. System Hardening. Wi-Fi security At home Away from home Windows system hardening Mac OS X system hardening. Wi-Fi security. Question 1: Do I need wi-fi? Don’t own any wireless devices? Don’t buy a wireless router!

I am the owner, or an agent authorized to act on behalf of the owner, of the copyrighted work described.
Download Presentation

PowerPoint Slideshow about 'System Hardening' - KeelyKia

An Image/Link below is provided (as is) to download presentation

Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.

- - - - - - - - - - - - - - - - - - - - - - - - - - E N D - - - - - - - - - - - - - - - - - - - - - - - - - -
Presentation Transcript
system hardening

System Hardening

Defense in Depth—at home and on the road

system hardening2
System Hardening
  • Wi-Fi security
    • At home
    • Away from home
  • Windows system hardening
  • Mac OS X system hardening
wi fi security
Wi-Fi security
  • Question 1: Do I need wi-fi?
    • Don’t own any wireless devices? Don’t buy a wireless router!
    • A regular, wired-only router is cheaper and offers one less attack vector
wi fi security4
Wi-Fi security
  • Question 2: What kind of wireless router should I buy?
    • Good security
    • Blazing speeds
    • Bleeding-edge technology
what about 802 11n
What about 802.11n?
  • Pre-N, draft n, MIMO-based
  • Backward compatible
  • Finalized December 2009
wi fi security6
Wi-Fi security
  • Encryption: scramble your stuff
    • WEP = worthless
    • WPA has issues
    • WPA2 is best
everybody panic wpa tkip has been cracked
  • WPA-TKIP partially cracked
    • Attacker needs 12-15 minutes of access
    • Data encryption remains intact (for now)
    • Can be used to DoS, circumvent firewalls, poison ARP cache
everybody panic wpa tkip has been cracked8
  • What can you do?
    • Don’t panic.
    • Use WPA2!
    • Use a network range other than 192.168.0.x
wireless router hardening
Wireless Router Hardening
  • Choose a strong pre-shared key
  • Patch, patch, patch!
wireless router hardening10
Wireless Router Hardening
  • Change SSID (network name)
  • Enable MAC address filtering
wireless router hardening11
Wireless Router Hardening
  • Limit the number of connections allowed
  • Disable “respond to ICMP Ping”
wireless router hardening12
Wireless Router Hardening
  • Disable the DMZ (Demilitarized Zone)
  • Disable UPnP
wireless router hardening13
Wireless Router Hardening
  • Change the default IP address of the router
  • Change admin password
  • Enable the firewall
wireless router hardening14
Wireless Router Hardening
  • Consider switching to OpenDNS
    • Helps filter out malicious websites, can also filter other types of “blue” content
      • Content filtering is user configurable
securing your network
Securing your network…

Get rid of old wireless hardware!

personal computer security
Personal Computer Security
  • Develop some new good habits
  • Remember, cybersecurity breaks can and will happen to you
  • An ounce of prevention is worth a pound of cure!
personal computer security17
Personal Computer Security
  • No matter your platform, you should…
    • Have separate accounts for each user
    • Protect ALL accounts with a password
    • Run as a “non-privileged” user
    • Use an inactivity time-out that locks the screen
    • Use a firewall
    • Perform regular backups
    • Use antivirus software (yes, Mac users, you too!)
computer accounts
Computer Accounts
  • For our purposes, there are two types of accounts on a system:
    • Administrator (or root)
    • User (or non-privileged user)
  • Administrator accounts have unlimited power
    • With great power comes great responsibility (nerd alert! )
    • Administrator accounts are needed to install new software, configure network settings, install printers, etc.
    • Malicious websites and programs take advantage of that power to compromise your system
computer accounts19
Computer Accounts
  • “User” or “non-privileged” accounts
    • Generally can’t install software (any programs installed will run at that user’s privilege level)
    • Can’t make configuration changes to firewall, AV, and other critical system components
running as a non privileged user
Running as a non-privileged user
  • Good news:
    • Less vulnerable to “drive by downloads” and other malware
    • Less likely to accidentally modify settings to critical system components
    • Malware runs at non-privileged level, does less damage
running as a non privileged user21
Running as a non-privileged user
  • The “bad” news:
    • Config changes, installing software needs admin rights
    • Some programs misbehave when asked to run at a non-privileged user level
computer security the basics
Computer Security: The Basics
  • Many security problems can be alleviated just by keeping your software up to date!
    • Enable Automatic Updates (Win) or System Update (Mac) to download and install automatically
    • Allow add-on programs like Adobe Reader and QuickTime to check for updates automatically
computer security the basics23
Computer Security: The Basics
  • Uninstall software you no longer use
    • Forgotten, unpatched software may make your machine more vulnerable
  • Look gift horses in the mouth
    • Just because that blinking ad banner says to download that free software doesn’t make it a good idea!
computer security firewalls
Computer Security: Firewalls
  • Both Windows and Macintosh computers come with firewalls
    • Windows XP Service Pack 3 & Vista enable firewall by default
    • Mac OS X may not enable its firewall by default
computer security firewalls25
Computer Security: Firewalls
  • To enable the Windows XP Internet Connection Firewall (ICF):
    • Click StartControl Panel and select Security Center
    • Under "Manage security settings for:" click Windows Firewall. Make sure that the radio button next to "On" is selected.
    • If you open this panel and find that your firewall options are “greyed out,” there is a good chance your computer is infected with malware.
computer security firewalls26
Computer Security: Firewalls
  • The Windows XP firewall does not do any outbound filtering by default.
    • Consider a 3rd party firewall
    • Many good free options, even more good paid options
    • Free: Comodo Firewall Pro, ZoneAlarm
    • Paid: Kerio, ZoneAlarm, simple home router/firewalls (network-based)
computer security firewalls27
Computer Security: Firewalls
  • Windows Vista firewall
  • Looks and feels just like XP firewall
    • Unlike XP, does inbound and outbound filtering
  • Access via Control PanelSecurity CenterWindows Firewall
  • Network based firewall is still a good addition!
computer security autorun
Computer Security: Autorun
  • a.k.a. “Autoplay”
  • Disable it!
    • Used by Conficker, other malware
computer security antivirus
Computer Security: Antivirus
  • Antivirus ≠ panacea!
  • Antivirus software is a piece of the puzzle
  • Corrective at best
  • No computer should be without it
computer security antivirus30
Computer Security: Antivirus
  • Have you paid your subscription fee?
  • Check for updates every 30 mins
  • Never try to run more than one AV package at once!
computer security anti spyware
Computer Security: Anti-spyware
  • There are several excellent free anti-spyware tools available
  • “Active protection” may conflict with your antivirus software
  • “Passive protection” shouldn’t cause a problem
computer security anti spyware33
Computer Security: Anti-spyware
  • Malwarebytes
  • Spybot Search & Destroy
  • Microsoft Windows Defender
  • Ad-Aware
  • Spyware Blaster
computer security other utilities
Computer Security: Other utilities
  • HijackThis
  • CCleaner
  • TrendMicro Housecall
computer security surf safer
Computer Security: Surf Safer
  • Get away from Internet Explorer
  • Switch to Firefox for day-to-day browsing (you too, Mac users)
    • Use add-ons
    • Keep your helper apps updated
computer security surf safer36
Computer Security: Surf Safer
  • Hardening Firefox
    • ToolsOptions (FirefoxPreferences on Mac OS X)
    • Warn about add-ons, warn about forgeries should both be checked
    • Uncheck “remember passwords for sites”
more firefox hardening
More Firefox hardening…
  • has lots of add-ons for Firefox:
    • NoScript (blocks scripted content from running)
    • Adblock Plus (blocks ads and possible malicious page elements)
    • Filterset.G updater (downloads preconfigured filterset for Adblock Plus)
    • Plugins work in Firefox for the Mac too!
  • McAfee SiteAdvisor
    • can help prevent you from clicking on malicious websites by warning you about their content
internet explorer hardening
Internet Explorer Hardening
  • IE 7 & 8 have built-in anti-phishing features, IE 6 does not
    • McAfee Siteadvisor is also available for IE!
    • Google Toolbar has some nice anti-phishing features as well
    • Only use Internet Explorer when a site doesn’t function properly in Firefox
computer security mac os x
Computer Security: Mac OS X
  • Despite what you hear in the ads, Macs can:
    • Get hacked
    • Get malware
    • Get viruses
computer security mac os x40
Computer Security: Mac OS X
  • Mac OS X is a pretty GUI shell on a powerful UNIX OS
    • The power of Mac OS X makes it a very flexible platform for hackers, too!
computer security mac os x41
Computer Security: Mac OS X
  • Remember all that stuff we said about Windows?
  • Mac OS X isn’t vulnerable to Windows malware
    • It can pass it on!
computer security mac os x42
Computer Security: Mac OS X
  • Many of the “best practices” we’ve already discussed apply to Mac OS X
    • “user” vs. “admin” accounts
    • use antivirus
    • use a firewall
    • beware of malware
computer security mac os x43
Computer Security: Mac OS X
  • Enable the firewall!
    • System PreferencesSharing (10.4)
    • System PreferencesSecurity (10.5)
computer security mac os x44
Computer Security: Mac OS X
  • Filevault
    • Encrypts your Home directory (not the entire hard drive)
    • Make sure you store the master password in a safe place—if it is lost, data cannot be recovered
computer security mac os x45
Computer Security: Mac OS X
  • Other security settings:
    • Require password to wake from screen saver
    • Disable automatic logins
    • Use secure virtual memory
    • Disable remote control infrared receiver
computer security mac os x46
Computer Security: Mac OS X
  • Don’t enable services!
    • Sharing preference pane
    • Uncheck everything
on the road wifi security
On the Road: WiFi security
  • Attackers may set up fake WiFi access points
    • “Free WiFi” isn’t realy free
    • Malicious hotspots may be used for Man In The Middle attacks
on the road wifi security48
On the Road: WiFi security
  • Only connect to trusted WiFi providers
    • How much do you really trust them?
  • Use a VPN connection if you need to handle sensitive data
on the road wifi security49
On the Road: WiFi security
  • Using your laptop but not connecting to a network? Disable the wireless radio!
on the road laptop security
On the Road: Laptop Security
  • Taking a computer with you introduces additional security issues!
    • Higher risk of theft
    • Connecting to untrusted networks
    • Protecting data in case of theft
on the road laptop security51
On the Road: Laptop Security
  • Every account on your laptop should have a strong password!
  • Use encryption, especially if you carry sensitive data with you
  • Never leave your laptop unattended
security testing @ home
Security Testing @ Home
  • ShieldsUP!
    • Scans your computer for open ports, can help you identify problems (Windows and Mac OS X)
  • LeakTest
    • Tests your computer’s firewall (Windows only)
  • Microsoft Baseline Security Analyzer
    • Windows only
security resources
Security Resources
  • Be SeKUre blog
  • US-CERT Mailing Lists
  • Microsoft Security At Home blog
  • MacInTouch

Julie C. Fugett, CISSP, CCE

Information Security Analyst

IT Security Office