Your Definitive Lockdown Guide Hardening Windows XP: Your Definitive Lockdown Guide

What is a service patch? This presentation will examine the following items and how to lock them down step by step. This will enable your XP system to be lean, mean and ready to do battle with attackers of all types. Windows XP Professional Configuration Checklist Details Verify that all disk partitions are formatted with NTFS Change Logging Settings Disable Indexing Service Protect file shares Disable fast User Switching Use software restriction policies Disable unnecessary services Keep up-to-date on the latest security updates Use Security Baseline Analyzer 2

Best Practice #1: disk partitions are formatted with NTFS Many older XP workstations still use the older less secure FAT, FAT32, or FAT32x files systems. The enhanced NTFS file system offers greater access controls and protections that aren't available with the FAT, FAT32, or FAT32x file systems. Make sure that all partitions on your computer are formatted using NTFS. If necessary, use the “Convert Utility” to non-destructively convert your FAT partitions to NTFS. Before running this utility always make a backup of critical data, but that should go without saying!   3

Best Practice #2: Change system Logging settings By default the system logging does not provide for extensive logging activity. To change the system logging follow these steps: Open Event Viewer In the console tree, click the log you want to change. On the Action menu, click Properties. On the General tab, in Maximum log size, specify the new log size in kilobytes. Change log sizes Application: 81920, overwrite as needed Security: 81920, overwrite as needed System: 81920, overwrite as needed To put the new setting in effect, click Clear Log.   4

Best Practice #3: Disable Indexing Service Indexing Service is a base service for Microsoft Windows operating systems that extracts content from files and constructs an indexed catalog to facilitate efficient and rapid searching. Indexing Service can extract both text and property information from files on the local host and on remote, networked hosts. The files can be simply members of a selected file system or part of a virtual Web hosted by, for example, Internet Information Services (IIS). The index server has been a major vulnerability of the XP operating systems. It is recommended to turn off this service unless otherwise needed. To disable the indexing service performs the following steps: In the "Start" menu, choose "Run." Type "services.msc" and press Enter. Scroll-down to "Indexing Service" and double-click it. If the service status is "Running", then stop it by pressing the "Stop" button. To make sure this service doesn't run again, under "Startup Type:", choose "Disabled." Windows search will still work if you perform these steps, but it will work more slowly than if indexing was enabled. 5

Best Practice #3: Disable Indexing Service 6

Best Practice #4: Protect file shares By default, Windows XP Professional systems that are not connected to a domain use a network access model called "Simple File Sharing," where all attempts to log on to the computer from across the network will be forced to use the Guest account. This means that network access as well as Remote Procedure Calls (RPCS) will only be available to the Guest account. This can be a big vulnerability and has been exploited by some the most widely used attack tools targeting the Windows XP OS. To change it, go to: Start => Programs => Accessories => Windows Explorer and drop down the Tools menu and select ‘Folder Options’. 7

Best Practice #5: Disable Fast-User Switching When multiple users share a computer, logging off and logging on to the computer in order to switch users can become tiresome. Fast User Switching, a feature that makes it possible for you to quickly switch between users without actually logging off from the computer. Multiple users can share a computer and use it simultaneously, switching back and forth without closing the programs they are running. However, if you are not sharing computers this feature should be disable. To disable fast-user switching: Go to control panel > User Accounts Select “change the way users log in and out” Click “Off” the option for “Use Fast User Switching” Apply Changes 8

Best Practice #5: Disable Fast-User Switching 9

Best Practice #6: Use software restriction policies Software restriction policies provide administrators with a policy driven mechanism that identifies software running in their domain, and controls the ability of that software to run. Using a software restriction policy, an administrator can prevent unwanted programs from running; this includes viruses and Trojan horses, or other software that is known to cause conflicts when installed. Software restriction policies can be used on a standalone computer by configuring the local security policy. Software restriction policies also integrate with Group Policy and Active Directory. 10

Best Practice #7: Disable unnecessary services Hardening Windows XP included turning off any network services not required for normal operations. In particular, you should consider whether your computer needs any IIS Web services. By default, IIS is not installed as part of Windows XP and should only be installed if its services are specifically required. It is recommended that if you don’t need them, disable the following services ASAP: Telnet Universal Plug and Play Device Host IIS (not installed by default) Netmeeting Remote Desktop Sharing Remote Desktop Help Session Manager Remote Registry Routing & Remote Access SSDP Discovery Service It is also recommend that the server service and computer browser be eliminated if you are on a stand-alone machine connected to the Internet. There is no practical use for them and leave you exposed. 11

Best Practice #7: Disable unnecessary services 12

Best Practice #9: Keep up-to-date on the Latest Security Updates The Auto Update feature in Windows XP can automatically detect and download the latest security fixes from Microsoft. Auto Update can be configured to automatically download fixes in the background and then prompt the user to install them once the download is complete. To configure Auto Update, click System in Control Panel and select the Automatic Updates tab. Choose the first notification setting to download the updates automatically and receive notification when they are ready to be installed. 13

What is a product family? A product family is a collection of products that have a related purpose. For instance, the Microsoft Windows® product family includes all Windows operating systems, such as Windows 3.11, Windows 95, and Windows 2000. A product is one member of a product family. For instance, Microsoft Windows NT® is a product in the Windows family. A version is an instance of a product. For instance, Windows NT 3.5, Windows NT 4.0, and Windows 2000 are different versions of the Windows NT product. 14

Service pack versus patches A service pack is a periodic update that corrects problems in one version of a product. For instance, there have been six service packs for Windows NT 4.0. Some Microsoft products use the term service release rather than service pack, but the terms mean the same thing. A patch is an update that occurs between service packs. A patch is sometimes also referred to as a hotfix. Note: Most patches are built to correct security vulnerabilities, but we also build patches to correct critical stability or performance issues. In this article, though, we'll only discuss security patches. http://technet.microsoft.com/en-us/library/cc723502.aspx 15

Windows update utility Windows 7 Click Start > Control Panel > Windows Update 16

View update information Windows 7 From the Windows Update window, click on a link to view additional information on that update. The 1 important update was selected in this example,. 17

Review the Update History From the Windows Update Window, select View Update History 18

Frequently Asked Questions From the Windows Update window, select Updates: frequently asked questions to find out more information 19

Settings for Automatic Updates From the Windows Update window, select Change Settings 20

Running Microsoft Baseline Security Analyzer Sample Scan 21

Additional System Information Links provide more information for a particular issue Report can be printed for documentation Report can be copied to clipboard 22

Administrative Vulnerabilities Links are provided as to what was scanned, the result details, and instructions on how to correct an issue. 23