The Deep Technical Audit: How to Identify and Mitigate Risks Presented in Other Sessions David J. Goldman Joseph Nocera.

Slides:



Advertisements
Similar presentations
Application Security Best Practices At Microsoft Ensuring the lowest possible exposure and vulnerability to attacks Published: January 2003.
Advertisements

Windows 2003 Server. Windows 2003 Server Contents Fitur Windows 2003 Server Installation And Configuration Windows Management Resource  User Management.
Module 6: Configuring Windows XP Professional to Operate in a Microsoft Network.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 13: Administering Web Resources.
70-293: MCSE Guide to Planning a Microsoft Windows Server 2003 Network, Enhanced Chapter 13: Planning Server and Network Security.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 13: Administering Web Resources.
Chapter 7 HARDENING SERVERS.
1 Configuring Web services (Week 15, Monday 4/17/2006) © Abdou Illia, Spring 2006.
12.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 1: Introduction to Windows Server 2003.
Introduction To Windows NT ® Server And Internet Information Server.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment Chapter 1: Introduction to Windows Server 2003.
© N. Ganesan, Ph.D., All rights reserved. Active Directory Nanda Ganesan, Ph.D.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 1: Introduction to Windows Server 2003.
Corso referenti S.I.R.A. – Modulo 2 Local Security 20/11 – 27/11 – 05/12 11/12 – 13/12 (gruppo 1) 12/12 – 15/12 (gruppo 2) Cristiano Gentili, Massimiliano.
Module 8: Implementing Administrative Templates and Audit Policy.
Presented by Manager, MIS.  GRIDCo’s intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to GRIDCo’s.
Security Risk Management Marcus Murray, CISSP, MVP (Security) Senior Security Advisor, Truesec
Module 9 Configuring Server Security Compliance. Module Overview Securing a Windows Infrastructure Overview of EFS Configuring an Audit Policy Overview.
Avanade: 10 tips for å sikring av dine SQL Server databaser Bernt Lervik Infrastructure Architect Avanade.
Monitoring and Troubleshooting Chapter 17. Review What role is required to share folders on Windows Server 2008 R2? What is the default permission listed.
1 Chapter Overview Planning an Audit Policy Implementing an Audit Policy Using Event Viewer.
Web Server Administration Chapter 5 Managing a Server.
Hands-On Microsoft Windows Server 2008 Chapter 1 Introduction to Windows Server 2008.
Module 9 Configuring Server Security Compliance. Module Overview Securing a Windows Infrastructure Overview of EFS Configuring an Audit Policy Overview.
Copyright © 2002 ProsoftTraining. All rights reserved. Operating System Security.
Using Group Policy to Manage User Environments. Overview Introduction to Managing User Environments Introduction to Administrative Templates Assigning.
Configuring a Web Server. Overview Overview of IIS Preparing for an IIS Installation Installing IIS Configuring a Web Site Administering IIS Troubleshooting.
September 18, 2002 Introduction to Windows 2000 Server Components Ryan Larson David Greer.
Overview: Identify the Internet protocols and standards Identify common vulnerabilities and countermeasures Identify specific IIS/WWW/FTP concerns Identify.
11 SECURITY TEMPLATES AND PLANNING Chapter 7. Chapter 7: SECURITY TEMPLATES AND PLANNING2 OVERVIEW  Understand the uses of security templates  Explain.
Security Baseline. Definition A preliminary assessment of a newly implemented system Serves as a starting point to measure changes in configurations and.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 13: Administering Web Resources.
CIM6400 CTNW (04/05) 1 CIM6400 CTNW Lesson 6 – More on Windows 2000.
C HAPTER 6 NTFS PERMISSIONS & SECURITY SETTING. INTRODUCTION NTFS provides performance, security, reliability & advanced features that are not found in.
Section 7: Implementing Security Using Group Policy Exploring the Windows Security Architecture Securing User Accounts Exploring Security Policies Hardening.
CIS 460 – Network Design Seminar Network Security Scanner Tool GFI LANguard.
User Manager Pro Suite Taking Control of Your Systems Joe Vachon Sales Engineer November 8, 2007.
Module 14: Configuring Server Security Compliance
Course ILT Internet/intranet support Unit objectives Use the Internet Information Services snap-in to manage IIS, Web sites, virtual directories, and WebDAV.
Computer Security and Penetration Testing Chapter 16 Windows Vulnerabilities.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 1: Introduction to Windows Server 2003.
Top Five Web Application Vulnerabilities Vebjørn Moen Selmersenteret/NoWires.org Norsk Kryptoseminar Trondheim
Module 1: Configuring Windows Server Module Overview Describe Windows Server 2008 roles Describe Windows Server 2008 features Describe Windows Server.
Planning a Microsoft Windows 2000 Administrative Structure Designing default administrative group membership Designing custom administrative groups local.
Hands-On Microsoft Windows Server Implementing Microsoft Internet Information Services Microsoft Internet Information Services (IIS) –Software included.
Safeguarding your Business Assets through Understanding of the Win32 API.
Guide to MCSE , Second Edition, Enhanced1 The Windows XP Security Model User must logon with: Valid user ID Password User receives access token Access.
Module 14: Securing Windows Server Overview Introduction to Securing Servers Implementing Core Server Security Hardening Servers Microsoft Baseline.
Network Resources BICS 565. Device Sharing Sharing CDROM and removable media Shortcuts to folders on other machines Sharing hardware devices across the.
70-290: MCSE Guide to Managing a Microsoft Windows Server 2003 Environment, Enhanced Chapter 14: Windows Server 2003 Security Features.
Module 9: Designing Security for Data. Overview Creating a Security Plan for Data Creating a Design for Security of Data.
Security and Firewalls Ref: Keeping Your Site Comfortably Secure: An Introduction to Firewalls John P. Wack and Lisa J. Carnahan NIST Special Publication.
Module 3: Planning Administrative Access. Overview Determining the Appropriate Administrative Model Designing Administrative Group Strategies Planning.
Implementing Server Security on Windows 2000 and Windows Server 2003 Fabrizio Grossi.
Configuring, Managing and Maintaining Windows Server® 2008 Servers Course 6419A.
Chapter 7: Managing and Troubleshooting Group Policy.
Role Of Network IDS in Network Perimeter Defense.
Mark Shtern.  Our life depends on computer systems  Traffic control  Banking  Medical equipment  Internet  Social networks  Growing number of.
Module 14: Advanced Topics and Troubleshooting. Microsoft ® Windows ® Small Business Server (SBS) 2008 Management Console (Advanced Mode) Managing Windows.
IS 4506 Windows NTFS and IIS Security Features.  Overview Windows NTFS Server security Internet Information Server security features Securing communication.
Enumeration.
Module Overview Installing and Configuring a Network Policy Server
Objectives Differentiate between the different editions of Windows Server 2003 Explain Windows Server 2003 network models and server roles Identify concepts.
Lesson 16-Windows NT Security Issues
Configuring Internet-related services
Operating System Security
PLANNING A SECURE BASELINE INSTALLATION
Designing IIS Security (IIS – Internet Information Service)
Presentation transcript:

The Deep Technical Audit: How to Identify and Mitigate Risks Presented in Other Sessions David J. Goldman Joseph Nocera

David J. Goldman Joseph Nocera Overview Background Windows Security Vulnerabilities Dealing with Security The Role of the Audit Maintaining a Secure Environment

David J. Goldman Joseph Nocera Background Why this conference exists Windows Security Overview Internal Security Management

David J. Goldman Joseph Nocera Windows Security Vulnerabilities Loss of Confidentiality, Integrity, Accessibility Denial of Service Enticement Information Undesired Access Inability to recover from breach Inability to prosecute

David J. Goldman Joseph Nocera Windows Security Vulnerabilities Areas of Concern Unneeded Services Incorrect System Configuration Improper Access Control Lists Buffer Overflows Other Code Vulnerabilities Known vs. Unknown

David J. Goldman Joseph Nocera Unneeded Services Services Simple TCP/IP Services FTP, WWW, SMTP, NNTP Telnet Terminal Services, Other Remote Access (pcAnywhere, ControlIT, etc) “R” Services (rsh, rcmd, rexec, etc.) Devices Sniffers NFS Key Loggers

David J. Goldman Joseph Nocera Incorrect System Configuration Service Packs/Hotfixes Group Membership Registry Values Shares User Rights User Settings

David J. Goldman Joseph Nocera Improper Access Control Lists Shares Registry Keys Directories Other Securable Objects System Resources  Printers, Services, Tasks, etc. Active Directory Objects  OUs, GPOs, etc.

David J. Goldman Joseph Nocera Buffer Overflows Core Operating System Components Internet Information Server (IIS) SQL Server Third-Party Applications

David J. Goldman Joseph Nocera Other Code Vulnerabilities Core Operating System Components Third-Party Applications Custom Developed Applications Web Pages and Internet Applications

David J. Goldman Joseph Nocera Dealing With Security Overall Security Architecture Risk Assessment Data Classification Audit the Environment Security Design/Implementation Plan Monitor and Control

David J. Goldman Joseph Nocera The Role of the Audit Determine Vulnerable Areas Obtain Specific Security Information Allow for Remediation Check for Compliance Ensure Ongoing Security

David J. Goldman Joseph Nocera Security Audit Components The “Fab Five” User Resource System Network Auditing, Logging, and Monitoring

David J. Goldman Joseph Nocera User Security Components User Account Properties Account Policy User Rights Groups Configuration Issues Passwords – Complexity/Aging/Uniqueness Disabled/Locked Accts Wkstn Restrictions 4 Logon Types Sensitive User Rights Privileged Group Membership

David J. Goldman Joseph Nocera Resource Security Components File Systems File, Folder, and Object Security Shares Configuration Issues NTFS vs. FAT, EFS DACLs/SACLs – reg, files/folders, printers, services Shares – who needs read/change/full

David J. Goldman Joseph Nocera Resource Security Cont. Critical Resources %systemroot% (repair, config, LogFiles) %systemroot%\*.exe \Program Files Inetpub, Inetsrv, IIS data directories

David J. Goldman Joseph Nocera System Security Components Registry Services Configuration Issues Access Paths - Winreg/AllowedPaths Reg Permissions - Run, RunOnce, AeDebug Reg Values – Restrictanonymous Crashdump/Clearpagefile, lmcompatibility Installed Services Service Context – System vs. User

David J. Goldman Joseph Nocera Network Security Components Domains and Trusts Protocols Internet Information Server (IIS) Configuration Issues Relationships – appropriate access What is needed – TCP/IP, NetBIOS, NWLink IIS – WWW, FTP, SMTP, NNTP

David J. Goldman Joseph Nocera Auditing, Logging, and Monitoring Components Audit Policies Event Logs Network Alerts Performance Monitor Configuration Issues System Events Files and Directories Registry Log Settings

David J. Goldman Joseph Nocera Maintaining a Secure Environment Methodology Tools Implementation Scripts

David J. Goldman Joseph Nocera Security Methodologies Assess Design Implement Operate/Maintain

David J. Goldman Joseph Nocera Tools Assessment Security Configuration Manager DumpSec and DumpReg Custom scripts (Visual Basic Scripting) Implemenetation Security Configuration Manager Resource Kit Utilities Custom Scripts  VB Script, Command Shell, other scripting languages

David J. Goldman Joseph Nocera Scripts and Examples DEMO

David J. Goldman Joseph Nocera Conclusion Holistic Approach to Security Detailed plan Ongoing Process David Goldman: Joseph Nocera:

Feedback: Privacy Policy Feedback
Do Not Sell My Personal Information
About project: SlidePlayer Terms of Service

© 2024 SlidePlayer.com Inc. All rights reserved.