HARDENING WINDOWS

By Q. NAORO

CONTENTS ?CHAPTER SOME WORDS ABOUT HARDENING WHAT IS SECURITY? THE SECURITY DILEMMA ENEMIES OF SECURITY WHAT WINDOWS IS LACKING SOME GENERAL HARDENING SUGGESTIONS SOFTWARE CONSIDERATIONS HARDWARE AND NETWORK CONSIDERATIONS CHECKPOINTS ?CHAPTER WINDOWS NT SECURITY WINDOWS NT SYSTEM POLICY EDITOR CUSTOMIZING AND APPLYING POLICIES TO MULTIPLE COMPUTERS RESOLVING CONFLICTS BETWEEN MULTIPLE POLICIES RECOMMENDED USER POLICY SETTINGS EXTENDING POLICIES PASSWORDS PASSWORD POLICIES PASSWORD CRACKING PROTECTING USER ACCOUNTS REGISTRY PROCEDURES PROTECTING THE FILE SYSTEM LOCKING DOWN LOCAL DIRECTORIES SEARCH PATHS GUARDING AGAINST INTERNET THREATS WINDOWS NT PORT FILTERING PROTECTING AGAINST VIRUSES ASSIGNING RIGHTS TO USERS GRANTING AND REVOKING USER RIGHTS REMOTE ACCESS SERVER CONFIGURATION SELECTING APPROPRIATE COMMUNICATIONS PROTOCOLS AND METHODS SECURITY IMPLICATIONS OF DOMAINS WINDOWS 2000 SECURITY SYSTEM UPDATES THE “SLIPSTREAMING” PROCESS CRITICAL UPDATES AND SECURITY HOTFIXES MANAGING CRITICAL UPDATES ACROSS MULTIPLE COMPUTERS SECURITY TEMPLATES CREATING A CUSTOM SECURITY TEMPLATE RECOMMENDED SECURITY POLICY SETTINGS USER ACCOUNTS LOCAL OPTIONS OTHER SECURITY CONSIDERATIONS WINDOWS COMPONENT SELECTION AND INSTALLATION TIGHTENING RUNNING SERVICES WINDOWS XP SECURITY IMPLEMENTING THE BUILT-IN WINDOWS XP FIREWALL PROFILES CONFIGURING THROUGH GROUP POLICY THE INTERNET CONNECTION FIREWALL IN XP GOLD AND SERVICE PACK 1 DISABLING UNNECESSARY SERVICES PROVIDING A SECURE CONFIGURATION FOR SERVICES MICROSOFT BASELINE SECURITY ANALYZER PATCH CHECK AND SECURITY TESTS INSTALLING MICROSOFT BASELINE SECURITY ANALYZER PENETRATION TESTS FILE SYSTEM SECURITY DISABLE AUTOMATED LOGINS HARDENING DEFAULT ACCOUNTS USE RUNAS FOR ADMINISTRATIVE WORK DISABLE INFRARED TRANSFERS USING FORENSIC ANALYSIS TECHNIQUES WINDOWS SERVER 2003 SECURITY ENHANCEMENTS TO SECURITY IN SERVICE PACK 1 THE SECURITY CONFIGURATION WIZARD INSTALLING THE SCW CREATING A SECURITY POLICY WITH THE SCW THE ROLLBACK FEATURE SCW BEST PRACTICES USING SCW FROM THE COMMAND LINE DEPLOYING ENTERPRISE SECURITY POLICIES SYSTEM POLICIES, GROUP POLICIES, AND INTERACTION MIXING POLICIES AND OPERATING SYSTEMS SECURITY AND THE GROUP POLICY FRAMEWORK ORGANIZED LAYOUT OF POLICIES POLICY APPLICATION PRECEDENCE CREATING SECURITY CONFIGURATION FILES DEFAULT DOMAIN POLICY DEFAULT DOMAIN CONTROLLER SECURITY POLICIES TROUBLESHOOTING GROUP POLICY PATCH MANAGEMENT ABOUT WINDOWS SERVER UPDATE SERVICES COMPARING WINDOWS SERVER UPDATE SERVICES TO SYSTEMS MANAGEMENT SERVER USING WINDOWS SERVER UPDATE SERVICES: ON THE SERVER SIDE USING WSUS: ON THE CLIENT SIDE NETWORK ACCESS QUARANTINE CONTROL HOW NETWORK ACCESS QUARANTINE WORKS A STEP-BY-STEP OVERVIEW OF NETWORK ACCESS QUARANTINE CONTROL DEPLOYING NAQC CREATING QUARANTINED RESOURCES WRITING THE BASELINE SCRIPT INSTALLING THE LISTENING COMPONENTS CREATING A QUARANTINED CONNECTION PROFILE DISTRIBUTING THE PROFILE TO REMOTE USERS CONFIGURING THE QUARANTINE POLICY INTERNET INFORMATION SERVICES SECURITY COMPLETELY DISABLE IIS KEEPING IIS UPDATED USING WINDOWS UPDATE USING NETWORK-BASED HOTFIX INSTALLATION SECURING FILES, FOLDERS, AND SCRIPTS THE MICROSOFT INDEXING SERVICE TCP/IP PORT EVALUATION ADMINISTRATIVE AND DEFAULT PAGES THE INS AND OUTS OF INTERNET SERVICES APPLICATION PROGRAMMING INTERFACE LOOKING AT APACHE AS AN ALTERNATIVE EXCHANGE SERVER 2003 SECURITY INSTALLATION SECURITY SECURITY POLICY MODIFICATIONS FOR EXCHANGE SERVER MACHINES FOR DOMAIN CONTROLLER MACHINES SERVICE SECURITY PROTECTING AGAINST ADDRESS SPOOFING PROTECTING AGAINST DENIAL-OF-SERVICE ATTACKS RESTRICTING SMTP ACCESS CONTROLLING ACCESS SECURITY AUDITING AND EVENT LOGS FOR WINDOWS 2000, XP, AND SERVER 2003 RECOMMENDED ITEMS TO AUDIT EVENT LOGS THE EVENT VIEWER FOR WINDOWS NT 40 THE EVENT LOG FILTERING EVENTS WHAT MIGHT BE MISSING