This chapter is from the book
This chapter is from the book
This chapter is from the book
Summary
Operating system hardening is a critical part of network security, and it has many facets. It involves securing the operating system, applying patches, using appropriate security settings, and securing your browser. All of these factors must be addressed in order to secure a machine.
Careful configuration of the operating system can make many hacking techniques more difficult. It can also make a system more resistant to DoS attacks. Setting up appropriate policies for users and accounts can make hacking into those accounts much more difficult. Policies should cover issues such as appropriate password length, password type, and password age/history.
With Windows you can also use the Encrypting File System to protect your data should it be moved off of your system. EFS was first introduced in Windows 2000 and has continued through to today. It is a valuable tool that can and should be used to protect any sensitive data.
With any version of Microsoft Windows, proper registry settings are key to security. The registry is the heart and soul of the Microsoft Windows operating system, and failure to address proper registry settings will leave gaping holes in security.
Proper configuration of the browser makes a system less susceptible to malware. Limiting cookies can help ensure that privacy is protected. Blocking browsers from executing scripts or any active code without your knowledge is a critical step for protecting a system from malware.
Test Your Skills
Multiple Choice Questions
What does disabling the default administrator account and setting up an alternative account accomplish?
Makes it more difficult for someone to guess the logon information
Keeps administrators conscious of security
Allows closer management of administrator access
Makes the password stronger
What level of privileges should all users have?
Administrator
Guest
Most privileges possible
Least possible
What minimum password length does the NSA recommend?
6
8
10
12
What maximum password age does Microsoft recommend?
20 days
3 months
1 year
42 days
What account lockout threshold does the NSA recommend?
5 tries
3 tries
4 tries
2 tries
Which of the following most accurately describes the registry?
A relational database containing system settings
A database containing system settings
A database where software is registered
A relational database where software is registered
What is changing the TCP/Settings in the registry called?
Stack tweaking
Stack altering
Stack compression
Stack building
What type of encryption does EFS utilize?
Single key
Multi-alphabet
Public key encryption
A secret algorithm proprietary to Microsoft
What happens if you copy an unencrypted file into an encrypted folder?
It remains unencrypted.
The folder becomes unencrypted.
Nothing happens.
The file becomes encrypted.
Which of the following templates is used to provide the most security for the domain controllers?
Hisecdc.inf
Securedc.inf
Hisecws.inf
Sectopdc.inf
Which of the following is a security recommendation for Linux not common to Windows?
Shut down all services that you are not using (called daemons in Linux).
Configure the browser securely.
Routinely patch the operating system.
Disable all console-equivalent access for regular users.
What is the rule for unused services on any computer?
Turn them off only if they are critical.
Turn them off.
Monitor them carefully.
Configure them for minimal privileges.
What operating systems require periodic patches?
Windows
Linux
All
Macintosh
What is the minimum secure setting in Internet Explorer for Run components not signed with Authenticode?
Disable
Enable
Forbid
Prompt
What is the recommended secure setting in Internet Explorer for Initialize and script ActiveX controls not marked as safe?
Disable
Enable
Forbid
Prompt
Exercises
EXERCISE 8.1: User Accounts and Password Policies
Note: This exercise is best done with a lab computer, not a machine actually in use. Following the guidelines given in this chapter, accomplish the following tasks:
Create a new account with administrative privileges.
Disable all default accounts, or if they cannot be disabled, change them to the lowest possible permissions.
Implement the NSA recommendations for password policies and account lockout policies.
EXERCISE 8.2: Secure Registry Settings
Note: This exercise should be done on a laboratory Windows machine, not on one in normal use. Using the guidelines given in the chapter, check your machine’s settings to see that the following recommendations are implemented:
Restrict null session access.
Restrict anonymous access.
Change default shares.
Restrict null session access over named pipes.
EXERCISE 8.3: Stack Tweaking
Note: This exercise should be done on a laboratory machine, not one in normal use.
Following the guidelines given in the chapter, change the registry settings to make DoS attacks more difficult.
EXERCISE 8.4: Installing Security Templates
This exercise should be done on a laboratory Windows machine, not on one in normal use. By following the steps given here, you should be able to apply a security template to a Windows 7 or XP machine. You may use one of the default templates mentioned in the chapter or one you download from a website of your choice.
From the command prompt, or from Start, Run, type MMC. A screen like the one shown in Figure 8-22 appears.
FIGURE 8-22 The MMC console
Go to the drop-down menu Console and choose Add/remove console.
When you click the Add/Remove snap-in you can select a number of consoles. Find and select Security Configuration and Analysis.
After you have added this to the console, you can right-click on it and choose Open Database. Then give the database any name you like. When you press Enter, your dialog will change to display a list of all templates. Select the one you want.
)
EXERCISE 8.5: Securing Linux
Using a laboratory Linux machine (any distribution will work) and the data presented in this chapter, accomplish the following:
Ensure that user accounts are set up securely.
Shut down unused and unneeded daemons.
Apply the Linux-specific settings given in this chapter.
EXERCISE 8.6: Securing Microsoft Internet Explorer
Using a laboratory computer, secure Microsoft Internet Explorer by following the steps given here:
Block all unsigned ActiveX components.
Limit cookies to only first-party and session cookies.
Block all scripting.
EXERCISE 8.7: Patching Windows
Using a laboratory computer, preferably one that has not been patched in quite some time:
Go to www.microsoft.com.
Scan for patches.
Update all patches, and document the patches you update.
Projects
PROJECT 8.1: Account and Password Settings
This chapter provides recommendations on accounts and passwords from the NSA, Microsoft, and the author. Using the web (including but not limited to resources identified in this chapter), find recommendations from some other reliable source (CERT, SANS, any of the security certification vendors, etc.). Write a brief paper discussing those recommendations, paying particular attention to areas in which they differ from the recommendations given in this chapter.
PROJECT 8.2: Registry Settings
Note: This project is appropriate either for students with a strong understanding of the registry or perhaps as a group project.
Write about at least three additional registry settings you think should be modified to create a more secure Windows operating system. Explain your reasons fully.
PROJECT 8.3: Encrypting File System
Using the web or other resources, find out specifics about the Encrypting File System that is part of Windows. Describe this file system, and any strengths and any weaknesses you find.