1. Implementing Advanced Server and Client Security
Sandeep Modhvadia
Security Technical Specialist

2. Agenda Windows Server 2003 Service Pack 1 Windows XP Service Pack 2
2 years on!
Windows XP Service Pack 2

3. What are the Goals of SP1? Enhanced Security reduced attack surface
new security enhancements
Stronger Defaults and privilege reduction on services
RPC
DCOM
Support for no execute hardware
Intel
AMD
Windows Firewall
Enabled for new install scenarios
Provide a Security Configuration Wizard to assist IT Admins
Role-based configuration and lockdown
VPN Quarantine
Client inspection
Fix-up
Isolation
IIS 6.0 metabase auditing
Enhanced Reliability
Enhanced Performance
10%+ improvement in TPC, TPC-H, SAP, SSL, etc.

4. SP1 Security Features and Enhancements
Relevant XP SP2 enhancements
RPC, DCOM lockdown
Windows Firewall
Post-Setup Security Updates
Boot-time network protection for clean installs
Security Configuration Wizard
Base 64-bit extension system

5. Windows Firewall/RPC Group policy, command line, unattended setup
Goals and customer benefit
Provide by default better protection from network attacks
Focus on role-based server configuration
What we’re doing
Windows Firewall (formerly ICF) will be on by default in almost all configurations utilizing the Security Configuration Wizard
More configuration options
Group policy, command line, unattended setup
Better user interface
Boot time protection
Restrict anonymous connections to DCOM/RPC interfaces
Application impact
In-bound network connections will not be permitted by default
Listening ports only open as long as the application is running

6. Post-Setup Security Updates
A new feature designed to protect servers between first boot and application of most recent security updates
Opens on first admin login if Windows Firewall was not explicitly enabled using unattend script or GP
Blocks inbound connections until customer clicks “Finish” on PSSU dialog box

7. Security Configuration Wizard
Guided Attack Surface Reduction for Windows Servers
Security Coverage
Roles-Based Metaphor
Disables Unnecessary Services
Disables Unnecessary IIS Web Extensions
Blocks unused Ports, inlcuding multi-homed scenarios
Helps Secure Ports that are left open using IPSEC
Reduces protocol exposure (LDAP, NTLM, SMB)
Configures Audit Setting with high Signal to Noise
Security for mere mortals
Roles-based makes answering questions easy
Automated versus Paper-Based Guidance
Fully tested and supported by Microsoft

8. SCW
Demo

9. What is SP2? Post-SP1 hotfixes (more regression testing)
New security technologies
Network protection
Memory protection
Safer handling
More secure browsing
Improved computer maintenance
Some updated features

10. Windows Firewall enhancements
New and improved user interface
On by default for all network interfaces
Provides boot-time security
Global and per-interface configurations
Exceptions list (can be disallowed)
Local subnet restrictions
Command-line and better group policy management
Multiple profiles and RPC support
Unattended setup

11. Command Line Control C:\>netsh firewall show
The following commands are available:
Commands in this context:
show allowedprogram - Shows firewall allowed program configuration.
show config - Shows firewall configuration.
show currentprofile - Shows current firewall profile.
show icmpsetting - Shows firewall ICMP configuration.
show logging - Shows firewall logging configuration.
show multicastbroadcastresponse - Shows firewall multicast/broadcast response co
nfiguration.
show notifications - Shows firewall notification configuration.
show opmode - Shows firewall operational configuration.
show portopening - Shows firewall port configuration.
show service - Shows firewall service configuration.
show state Shows current firewall state.

12. Windows Firewall Demo Change of Scope Multiple Interface Rules
Application Exceptions
Group Policy

13. Internet Explorer Window restrictions
What is it?
Scripts can’t position or resize windows with title and status bars offscreen
Scripts can’t turn off status bar
Script windows:
Must fit between top and bottom of parent
Overlap parent horizontally
Move with parent
Appear above parent so that other windows (like dialog boxes) can’t be hidden
Why do it?
Eliminates windows that try to spoof desktop objects
Allows users to always see security zone
Prevents overlaying of address bar

14. Internet Explorer Managing pop-ups

15. Client Demo
Software Restriction Policies
Data Execution Prevention