1. Module 7: Designing Security for Accounts and Services

2. Overview Creating a Security Plan for Accounts Creating a Security Plan for Services Creating a Design for Security of Accounts and Services

3. Lesson 1: Creating a Security Plan for Accounts MSF and Security of Accounts STRIDE Threat Model and Security of Accounts Activity: Identifying Threats to Accounts

4. MSF and Security of Accounts The MSF envisioning and planning phases help you to: Decide which locations your plan will help to protect Identify the level of trust for accounts: External users Internal users Administrators Decide which locations your plan will help to protect Identify the level of trust for accounts: External users Internal users Administrators 3 3 4 4 5 5 Plan Envision

5. STRIDE Threat Model and Security of Accounts Sharing or writing down of passwords by users Spoofing Weak passwords Tampering Passwords are stored on computers Repudiation Use of an administrator account for non-administrative tasks Information disclosure Services that do not run as the system account Denial of service Users who have local administrator privileges Elevation of privilege

6. Activity: Identifying Threats to Accounts In this practice you will: Read the scenario Answer the questions Discuss with the class Read the scenario Answer the questions Discuss with the class

7. Lesson 2: Creating a Security Plan for Services MSF and Security of Services Considerations When Securing Services STRIDE Threat Model and Security of Services Practice: Identifying Threats to Services

8. MSF and Security of Services The MSF envisioning and planning phases help you to: Decide which locations your plan will help to protect Ensure that you use: The Local Service account The Network Service account Decide which locations your plan will help to protect Ensure that you use: The Local Service account The Network Service account 3 3 4 4 5 5 Plan Envision

9. Follow the three core principles: Considerations When Securing Services Know your system Use the principle of least privilege Use the principle of least service Know your system Use the principle of least privilege Use the principle of least service

10. STRIDE Threat Model and Security of Services Security exposure occurs whenever you configure a service to log on as a user Spoofing The potential for exploitation increases with each poorly secured server Tampering If an attacker steals the user name and password used by a service, they can gain access to other servers Repudiation The larger the scope of privilege, the greater the number of resources at risk Information disclosure The scope of the vulnerability to the network is all the computers residing in the domain Denial of service Domain administrator credentials create transitive opportunities for escalation across the domain Elevation of privilege

11. Practice: Identifying Threats to Services Create a list of services currently running on Windows Server 2003 View a list of default services on Windows Server 2003

12. Lesson 3: Creating a Design for Security of Accounts and Services Securing Accounts Securing Services Considerations for Password Policies

13. Securing Accounts To secure accounts: Define levels of trust Develop processes for creating and deleting accounts Develop processes for rights/permissions for accounts Develop processes for enforcing and monitoring Develop processes for using administrative accounts Define levels of trust Develop processes for creating and deleting accounts Develop processes for rights/permissions for accounts Develop processes for enforcing and monitoring Develop processes for using administrative accounts 1 1 3 3 4 4 2 2 5 5

14. To secure services: Audit all servers to determine essential services Determine which services must run Eliminate all domain admin accounts for services Use a least privilege hierarchy for service deployment Manage service account password changes Enforce strong passwords Audit all servers to determine essential services Determine which services must run Eliminate all domain admin accounts for services Use a least privilege hierarchy for service deployment Manage service account password changes Enforce strong passwords 1 1 3 3 4 4 5 5 6 6 2 2 Securing Services

15. Configure the following password policy settings: Considerations for Password Policies Maximum password age Enforce password history Minimum password age Minimum password length Passwords must meet complexity requirements Account lockout Maximum password age Enforce password history Minimum password age Minimum password length Passwords must meet complexity requirements Account lockout

16. Lab: Designing Security for Accounts and Services Exercise 1 Identifying Potential Account Vulnerabilities Exercise 2 Implementing Countermeasures