Sinergija09 :: Akcija!!! Besplatno testiranje bezbednosti web sajta za sve firme-učesnike Sinergije09 ! Kompanija Microsoft Software je u saradnji sa partnerskom firmom Network Security Solutions rešila da pokloni svim zainteresovanim firmama učesnicama Sinergije09, bez obzira na broj prijavljenih posetilaca konferencije, po jednu besplatnu osnovnu procenu bezbednosti web sajta. Prijave do 30. Novembra

Protecting Windows and Web applications Dejan Levaja, MVP [Enterprise Security] Network Security Solutions

Agenda Server 2008 Security mehnizmi - podsetnik IIS 7 security Patching Auditing Scanning and Assessment Hardening Security Testing

Security and protection Security improvements to the kernel – Kernel patch protection for 64-bit editions – Security improvements to the heap manager – Security improvements to the registry – Code integrity – Data Execution Prevention – Address Space Layout Randomization – Windows Resource Protection Security improvements to Windows services – Windows service hardening – Session 0 isolation – Named pipe hardening Windows Integrity Mechanism Windows Internet Explorer 7/8 – Protected mode – Extended Validation SSL certificates Extensible logon architecture Cryptography Next Generation Authentication protocol improvements – Windows implementation of the Kerberos protocol – TLS/SSL cryptographic enhancements

Threats and vulnerabilities mitigation Server role security configuration Server Core installation option User Account Control Web Server (IIS) role Backup and recovery Windows Firewall with Advanced Security Network Policy and Access Services role – Network Policy Server – Network Access Protection – Routing and Remote Access

Secure configuration assessment and management Security auditing Server security policy management Security Configuration Wizard Authorization Manager Group Policy Active Directory Domain Services – Fine-grained password policies – Auditing

Identity and access control Smart cards 802.1X authenticated wired and wireless access Backup and restore of stored user names and passwords Credential Security Service Provider and single sign-on for Terminal Services logon Previous logon information Access control user interface TrustedInstaller SID Restricted SIDs checks File system namespace modifications Default permissions changes Changes to tokens Integrity levels Icacls command-line tool OwnerRights SID BitLocker Drive Encryption Encrypting File System Active Directory Certificate Services – Cryptography Next Generation – Online Certificate Status Protocol – Network Device Enrollment Service – Web enrollment – Policy settings – Restricted enrollment agent – Enterprise PKI snap-in Active Directory Domain Services Active Directory Rights Management Service

IIS 7 Security Ranjivosti – IIS 7 (2006. – Sinergija09)=> 2 – Apache 2.2 (2006. – Sinergija09)=> 17 – IIS 6 (2003. – Sinergija09)=> 8 – Apache 2.0 (2003. – Sinergija09)=> 41 Authentication IP and Domain Restriction URL Authorization Request Filtering Certificates

IIS 7 Security - Authentication Izmene – IUSR_machine_name => IUSR – IUSR_machine_name postoji samo ako postoji i FTP – IUSR radi u bezbednosnom kontekstu worker procesa (network service) – IUSR nema lozinku – IUSR_WPG => IIS_IUSR – Najvažnije: IUSR i IIS_IUSR su Built-In nalozi –> svuda isti SID -> moguć XCOPY /O Authentication – Anonymous – Basic – Windows – Forms – Certificates* – Digest – ASP.NET Impersonation

IIS 7 Security - IP and Domain Restriction Ograničenje pristupa po IP adresi Ograničenje pristupa po imenu domena (zahteva reversni DNS lookup!) – Demo Dynamic IP Restrictions Extension (beta) –

IIS 7 Security - URL Authorization NTFS vs URL autorizacija – xcopy /o Demo – Scenario Isključimo Anon Auth, uključimo Basic kreiramo grupu kreiramo korisnike i dodamo ih u grupu obrišemo defaultni URL Authorization Rule i kreiramo novi – Sve ovo može i iz CMD-a (appcmd.exe)!

Request Filtering – simple WAF URLScan => Request Filtering – Filter Double-Encoded Requests ‘\’ => %5c – ‘% ‘=> %25 » %255c scripts/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:\ (IIS 5.0) – Filter High Bit Characters – Filter Based on File Extensions – Filter Based on Request Limits – Filter by Verbs – Filter Based on URL Sequences /../, – Filter Out Hidden Segments

Certificates SSL – one to many mapping – one to one mapping – AD mapping – CLR, delta CRL – Next, next, finish Demo

Patching Windows Update – <= Vista – OS + IE Microsoft Update – Windows Update + MS Office + Exchange + SQL +... – Automatic Update Patch Tuesday ( and Exploit Wednesday ) Microsoft Catalog –

Patching WSUS 3.0 – Sastavni deo Servera 2008 (KB ) – SUS == OS; WSUS == OS + ostalo – WSUS = IIS 7+ SQL (WID) + Microsoft Update – GPO ili Registry GPO => Computer Configuration\Administrative Templates\Windows Components\Windows Upddate\Specify Intranet Microsoft Update Service Location Registry => KLM\Software\Policies\Microsoft\Windows\WindowsUpdate\ – reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate » /v WUServer /t REG_SZ /d » /v WUStatusServer /t REG_SZ /d

Auditing Auditing in Server 2008 – 4GB vs >petabyte – n*1000 evt/sec vs n*10000 evt/sec – granular audit policy (GAP) – GPO (R2), AuditPol.exe EventViewer – XML eventquery.vbs wevtutil.exe Demo: Failed logons – wevtutil qe Security /q:"*[System[(EventID=4624)]]" /f:text > logon.txt wevtutil qe Security /q:"*[System[(EventID=4624)]]" /f:text > logon.txt

Scanning MBSA – Security Updates, Administrative Vulnerabilities, IIS, SQL, Desktop apps – WSUS i MBSA – GUI, cmd (mbsacli.exe) – Online, Offline – wsusscn2.cab - – Visio Connector (2003,2007) – %userprofile%\SecurityScans – Demo: mbsacli.exe /target /u administrator /p mbsacli.exe /n SQL+IIS /catalog c:\wsusscan2.cab /nd

Assessment MSAT – MSAT is designed to help you identify and address security risks in your IT environment. – Preko 200 pitanja baziranih na ISO Infrastructure, Applications, Operations, People Demo

Hardening Windows Firewall with Advanced Security IPSec => Server and Domain Isolation – R2 or not R2 ? – Demo Security Configuration Wizard – Demo

Security Testing Vulnerability Assessment – popisuje ranjivosti – MBSA,... Penetration Testing – dokazuje da je moguće iskoristiti prona đ ene ranjivosti – browser + proxy, metasploit,... Besplatno testiranje bezbednosti web sajta za sve firme-učesnike Sinergije09 ! Prijave do 30. Novembra

Molimo vas da popunite ankete! Please fill out the evaluations! Vaše mišljenje čini osnovu sledeće Sinergije i omogućava nam da oblikujemo sadržaj u skladu sa Vašim željama. Svi posetioci koji popune ankete ulaze u nagradnu igru Your opinion forms the next Sinergija conference, and it provides us with the means to shape its content to best suit you. All attendees that fill out the evaluations are taking part in drawing of special prizes

Hvala! Microsoft Community Serbia