1. Security Architecture of Windows
Microsoft: Windows
Presented By:
Ambreesh Arya ( )
Siddharth Ubana ( )
Vikram Suthar ( )

2. System Security Computer(PC) Security
Earlier personal computers and their Operating Systems, were not designed with security in mind. They were developed as personal systems which would only be used by one user. 1
Security =
Easy Use

3. Security Architecture of Windows
Security Reference Monitor(SRM)
Local Security Authority(LSA)
Security Account Manager(SAM)

4. Security Reference Monitor
Kernel Mode Component that
Performs Access Checks
Generates Audit Log Entries
Manipulates User Privileges

5. Local Security Authority
Responsible for enforcing local security policy
Lsass.exe
User mode
Issues security tokens to accounts
Key component of the logon process

6. Security Account Manager (SAM)
A database that stores user accounts and local users and groups security information
SamSrv.exe

7. Windows Login
Administrator creates a user account (full name, username, password, group, privileges)
Windows creates an SID in the form of
S AAA-BBB-CCC-RRR

8. Windows Login User logs in with keyboard.
Information is sent to the LSA controller.
If successful token is generated and sent to user.
Token contains
User’s SID
Group membership
Privileges

9. Common Sense Rules of Security
Don’t put files on your system that are likely to be interesting to hackers or nosy employees.
Change your system password with in regular period of time.
Update your system at regular period of time.
Monitor the reports generated by the security tools.
Use Strong Password.
Install genuine software in your system.

10. Common Security Options
Checks Windows Firewall configuration and repairs as needed.
Checks Windows policies to determine bad settings in the Windows Registry.
Checks status of antivirus.
Checks Internet Explorer privacy setting to determine how cookies are handled.
Checks Windows Update to ensure computer is kept current and secure
Clears Internet Explorer history and cache.
Checks if Internet Explorer is up to date.

11. Program Threats
Virus
Worm
Trojan Horse

12. Program Threats
A virus is a piece of code which attaches itself to other code/files on the system. It relies on that piece of code in order to propagate/operate. When that code is executed so is the virus code. This gives the virus code the opportunity to propagate, and to perform other actions.
A worm is a piece of code that propagates itself to other systems, but the code does not attach itself to programs or files on the infected systems. Worms are stand-alone programs that do not rely on a “host” piece of code to propagate/operate.

13. Program Threats
A Trojan horse is a program that appears to do one thing, but in reality does something else. It does not attach itself to other code/files, and does not rely upon other code/files to propagate/operate. For instance a game program that removes all of your files (on purpose) would be a Trojan horse.

14. Types of Virus
Viruses
There are two general types of virus programs; malicious, and non-malicious.
A non-malicious virus does not intend to cause any lasting damage to the computer system.
It propagates.
It may print messages on the screen.
It may utter noises from the speaker.
It does not include any code to intentionally do damage to the computer system.

15. Malicious Virus Viruses
A malicious virus makes a concentrated attempt to do damage to the computer system.
It may format your disk drive.
It may scramble the FAT table.
It may remove random files.
It may encrypt the data on the disk.

16. PC Viruses
PC Viruses
PC viruses usually infect files with .exe, .com, and extensions. These files usually contain executable code.
The virus code sometimes infects the command.com file, the hard disk boot sector, the hard disk partition tables, or floppy disk boot sectors.
Some virus code is memory resident code. It goes memory resident then sits and waits for other programs to be pulled into memory. When these programs are in memory the virus infects them.
Some virus code goes to great lengths to hide itself...for instance the strings in the code are variably encrypted to keep virus scanners from finding the virus.

17. Tools There are many audit tools available for free download.
The Center for Internet Security offers tools to check Solaris, Windows, and Linux hosts, as well as routers for common security problems.
The System Administration, Networking, and Security Institute (SANS) has several tools for system auditing, and step-by-step guides to follow to secure your systems.
The CERT(Computer Emergency Response Team) organization publishes guidelines for system security.

18. Summary
Securing the individual systems is the first step toward providing a secure environment.
Account and password security are basics that should not be ignored.
Understand virus, trojans, and worms work.
Become familiar with the tools available to monitor/implement security on your systems.

19. References http://online.securityfocus.com/infocus/1527
Google.com
Wikipedia
Microsoft.com