1 / 33

10 Best Practices for Windows Security

HCWT. 10 Best Practices for Windows Security. How many of them are you doing? Roberta Bragg. 1. Keep Systems up to date. CERT, and others: 90 – 95% of successful attacks could be prevented with up-to-date systems

bharvey
Download Presentation

10 Best Practices for Windows Security

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. HCWT 10 Best Practices for Windows Security How many of them are you doing? Roberta Bragg

  2. 1. Keep Systems up to date • CERT, and others: 90 – 95% of successful attacks could be prevented with up-to-date systems • Every single attack in Hacking Exposed is balanced with a configuration or patch already in existence • Many world-wide security attacks would not have been successful if systems were updated

  3. How to Keep Systems UP-to-Date • Apply Service Packs • Apply Hotfixes • Use automated patch distribution • 0 – 50 users use Windows Update • Apply service pack three Windows 2000 and configure • Configure XP • 50- 500 users user Software Update Services • Download free from Microsoft, install and configure • Configure Clients • 500 + Use Software Update Services Feature pack and SMS • Download Feature Pack (free to licensed SMS users) • Configure for automated update and auditing

  4. 2. Follow Microsoft advice for hardening systems • Checklists, security templates, instructions abound! • Use them! • Many successful attacks could have been prevented by using these instructions.

  5. What Microsoft Advice? • Windows Security Checklists: • www.microsoft.com/security • Windows Server 2003 Security Guide http://go.microsoft.com/fwlink/?LinkId=14845 • Windows 2000 Security Operations Guide (and other prescriptive guidance documents. • http://msdn.microsoft.com/practices/

  6. 3. Use Native Security Tools • For deploying security settings • Security Templates • secedit • Security Configuration and Analysis • Group Policy • To secure systems • Software Restriction policies • Password reset disks • Authorization manager

  7. 4. Design a BaseLine Policy • Auditing • Services • Accounts • Security Options • User Rights • Then design incremental policies for computer and user roles in your network

  8. Strengthen passwords • Teach users how to make strong passwords • Write own passfilt.dll • KB article 151082 “Password Change Filtering & Notification in Windows NT.” • Enforce stronger restrictions • Audit password strength periodically • Use LC4

  9. Turn on Auditing – Review Logs • Monitor for attack indicators • 643 domain policy changed • 644 user account locked • 675 pre-authentication failed • 681 domain logon filature • 529, 530, 531, 532, 533, 535,534, 539, 548, 549 logon failure • Monitor for attack patterns • Large number of failed logons, then success

  10. Adjust User Rights • Restrict to Administrators, NETWORK SERVICE, LOCAL SERVICE • Adjust memory quotas

  11. Use deny rights to restrict access • Use deny rights to restrict access • Deny logon rights • Deny access from network • Deny local logon • Logon as a batch job • Logon using terminal services

  12. Do not grant to anyone: • Act as part of the operating system • Debug

  13. Restrict to Administrators • Right to Restore files and folders • Change System Time • Allow logon to Terminal Services (on non terminal services boxes)

  14. Deny access • To SUPPORT_388945a0 account • To computer from network • Logon as a batch • Logon through terminal services • To non-operating systems service accounts • Logons from terminal services • To compute from network

  15. Adjust Security Options • Rename administrator, guest account • Restrict CD-ROM, floppy to local user • Digitally sign network communications • Restrict anonymous connections • Tighten accessible named pipes/shares • Do not store LAN Manager password • Use NTLMv2 session security • Use NTLMv2 only, refuse LM and NTLM • Do not authorize subsystems (POSIX) • Shutdown clear memory page file

  16. Manage Event Logs • Enlarge all • Especially security log • Archive and clear frequently • Monitor for sudden increase in size • Examine contents looking for attack patterns

  17. Manage Services • Set permissions: who can start , stop, disable? • Don’t use domain accounts for services • Disable unnecessary services • Will vary for each computer role • Create a baseline which disables most; enable those needed only as necessary

  18. Baseline: Application Layer Gateway Service Application Management ASP .NET State Service Automatic Updates Background Intelligent Transfer Service. Certificate Services Client Service for Netware Clustering Service*- COM+_System Application DHCP Server Distributed Link Tracking Client. Distributed Link Tracking Server. Distributed Transaction Coordinator DNS Server Error Reporting Service Fax Service File Replication File Server for Macintosh FTP Publishing Service Unnecessary services?

  19. Help and Support HTTP SSL Human Interface Device Access IIS Admin Service IMAPI CD Infrared Internet Authentication Service Internet Connection Firewall Intersite Messaging IP Version 6 Helper Service Kerberos Key Distribution Center License Logging Service Message Queuing Message Queuing Down Level Clients Message Queuing Triggers Messenger Microsoft POP3 Service MSSQL$UDDI More services you don’t need

  20. MSSQLServerADHelper .NET Framework Support Service NetMeeting Remote Desktop Sharing Network DDE Network DDE DSDM NNTP Portable Media Serial Number Print Server for Macintosh Print Spooler Remote Access Auto Connection Manager Remote Access Connection Manager Remote Desktop Help Session Manager Remote Installation Remote Procedure Call Locator Remote Server Manager Remove Server monitor Remote Storage Notification Remote Storage Manger Removable Storage Resultant Set of Policy Provider Routing and Remote Access SAP Agent Secondary Logon And More…

  21. Shell Hardware Detection SMTP Simple TCP/IP Services Single Instance Storage Groveler Smart Card SNMP Service SNMP Trap Service Special Administration Console Helper SQLAgent$ Task Scheduler TCP/IP Print Server Telephony Telnet Terminal Services Licensing Terminal Services Session Directory Themes Trivial FTP Daemon UPS Upload manager Virtual Disk Service Web Client Web Element Manager Windows Audio Windows Image Acquisition (WIA) And More

  22. WINS Windows Media Services Windows System Resource Manger WinHTTP Web Proxy Auto –Discovery service Wireless Configuration World Wide Web Publishing Service And more…

  23. Set Restricted Groups • Add group • Enter authorized members • Users added in normal GUI will be removed if not also added here

  24. Set Object ACLs, SACLs • Use NTFS • Set common settings in templates, policies

  25. 5. Use IPSec Policies • File Server Example • Block access from all to any port • Allow access from Any source address to the file server for ports 445, 137, 138 and 139 • Restrict access to terminal services (port 3389) by allowing access from specific computers. (this helps to compensate for the blocking of RPC traffic used by many management services.) • Allow all traffic to and from the file server and domain controllers • Allow traffic between the file server and Microsoft Operations Manager (MOM)

  26. 6. Use Constrained Delegation • Only where delegation is required • No blanket rights • Only for specific services • Not for administrator accounts

  27. 7. Ensure Correct Time • NTLMv2 authentication requires client and server clocks to be within 30 minutes of each other. • Kerberos only allows a 5 minute difference. • Event correlations between computers will not be possible if there are time differences. • Evidence must be correctly identified or it is not valid evidence. w32tm /config /synchfromflags:manual /manualpeerlist:Peerlist w32tm /config /update

  28. 8. Set account restrictions • Logon hours • Logon to • Restrict delegation • others

  29. Accounts have unique SIDS; policy that might impact these accounts cannot be centrally set • Guest • the group Guests • Support 388045a0

  30. 9. Use Administrative Templates

  31. 10. Use Certificate Services • Key archival for EFS • Certificates for smart cards, authentication, IPSec, email etc. • SSL

  32. Bonus - Don’t use EFS • Unless properly managed • Archived keys • Recovery policy in place

More Related