Presented by: CMS Consulting Inc. Visit us online at

The contents of this presentation are the property of CMS Consulting Inc. No portion, in whole or in part can be used without the express written consent of CMS. You may for permission to re-post or re-use any of this content.

Brian Bourne CMS Consulting Inc, President Toronto Area Security Klatch, Co-Founder Black Arts Illuminated Inc., Director Fancy Credentials CISSP, MCT, MCSE:Security

Microsoft Infrastructure and Security Experts Active Directory - Windows Server - Exchange - SMS - ISA MOM - Clustering - Office – Desktop Deployment - SQL – Terminal Services - Security Assessments - Lockdown – Wireless Training by Experts for Experts MS Infrastructure – Security - Vista and Office Deployment Visit us online: Downloads – Resources – White Papers For Security Solutions For Advanced Infrastructure For Network Solutions For Information Worker For Mobility Solutions

1. ~~~~~~~~~ 2. ~~~ ~~ ~~ 3. ~~~~ Top 10 Security Mistakes Based on the results of numerous health check and assessment service offerings Top 10 Areas for Security Improvement Based on feedback from the consulting team at CMS

This is painfully obvious and still a problem at every customer. Problems include: Poor policy or poor policy enforcement Password re-use (eg. FileMaker password = Domain Password = Banking Password) User training – hey, did you know a simple sentence is complex? “My first born is Grant.” Password storage

Typical Issues: No inventory of software and hardware (no idea what to patch) No reporting of patch status or deployment Legacy software that’s simply unpatchable Software that followed the “deploy and forget” methodology Remember: All software and hardware needs patching, not just Microsoft! Especially security products!

Everyone, Full Control, Everywhere Anonymous is part of everyone! Simple Rules: Permissions are cumulative, except Deny wins. Never grant permissions to users. Grant to groups. Avoid upgrading W2K. Install W2K3 fresh. Use security templates and group policy to set/maintain security

No one seems to follow the rule of least privilege. Enumerate the following groups: Enterprise, Domain and Schema Administrators Server, Print and Backup Operators Service Accounts need special treatment Separate OU with GPO’s limiting rights Should be “Administrators”, not DA or EA! Use OU’s and delegate required administrative functions

Please don’t use a DA account for day to day activity. Better yet, don’t use a DA from anything but a designated high security, administrative workstation (think about bad things like keyloggers when logging in from untrusted machines) Guard EA accounts! Don’t share the administrator password. At minimum, you want some level of non-repudiation.

The most common installed and unneeded service? Any guesses? (IIS) Reduce the attack surface! Define Role based Templates Test, test, test Enforce by GPO! Good guide to understanding services windows2000serv/deploy/prodspecs/win2ksvc.mspx

How will we ever know if something happens? How will we ever be able to piece together “the crime scene” without any evidence? Audit only what’s important. Think beyond Windows events. Applications, firewalls, switches, etc. Consider log shipping also.

System State on all FSMO role holders. Critical data everywhere else. Remember to test procedures with restores Consider encryption/password protection to prevent unauthorized restores Offsite storage, secured fireproof vault Part of a larger Disaster Recovery plan

For IT Staff: Security Architecture Secure Operating Procedures Understanding of attack methods Defence in Depth techniques For All Staff Awareness training and Internet Usage Social Engineering awareness

Have a plan and have training! DO NOT: Touch the computer. Delete files. Or frankly react in anyway without a carefully thought out and professional approved plan!

1. ~~~~~~~~~ 2. ~~~ ~~ ~~ 3. ~~~~ Things People Need to Think More About: 1. Funding for security 2. Application filtering and layer 7 firewalls 3. Intrusion detection and prevention 4. Incident Response Planning and Training 5. Security Policy, Usage Policy 6. Log collection, management and co-relation 7. Physical controls 8. Network controls (who can plug in) 9. Firewalls should not look like swiss cheese (Hint: Use IPSec instead) 10. VPN controls and other remote access methods

November 20 – 21, 2007, MTCC, Toronto, ON, Canada

INSPIRE Infrastructure Workshop 4 days of classroom training - demo intensive AD, Exchange, ISA, Windows Server, SMS, MOM, Virtual Server Business Desktop Deployment – Deploying Vista/Office 3 days of classroom training - hands on labs (computers provide) Business Desktop Deployment Concepts, Tools, Processes, etc. Vista and Office Securing Internet Information Services Securing ActiveDirectory Securing Exchange day classroom training per topic TRAINING BY EXPERTS FOR EXPERTS

@ Brian Bourne, President – Robert Buren, VP Business Development – CMS Consulting Inc. – CMS Training – Toronto Area Security Klatch –

Thank You! Visit: CMS Consulting at Join: Toronto Area Security Klatch at Register: Security Education in Toronto at CMS Consulting Inc.