1. 5 Windows-Security Provisions 5 User memory –User programs and applications LSA Local Security Authority –Security validation Win32 Subsystem –Access to hardware Kernel mode memory –Windows kernel (OS) –Device drivers User mode memory Kernel mode memory Hardware LSA Win32 Subsystem Device drivers

2. Windows Security Features Internet Connection FirewallICF –Personal Firewall. Secures a single system. Loggs Session Initiation Protocol SIP –Provides a secure pathway for real time applications. Blank password restrictions Software restriction policies –Software can be isolated using GPO Users and Groups as in W2K Access Control List as in W2K ACL Auditing for all objects SACL User rights –Permission to perform an action. Group Policy Object GPO –Are used to control security features –There are templates –GPMC (Group Policy Management Console from MS) –Gpupdate /?

3. Security Features Cont. New technology File System as in W2K NTFS Encrypting File SystemEFS Kerberos authentication Virtual Private NetworkVPN –PPTP, L2TP, IPSec Public Key Infrastructure and Certificate servicePKI & CA Delegation per OU-basis External Authentication C2-security Active Directory AD CryptoAPI Microsoft Internet Security and Acceleration ServerISA-server –Firewall –Cache

4. Securing applications IIS ‘problem’ Web-server (‘Stand-alone’) –HTML –Server-side processing –Scripting Languages –Database connectivity –Other dynamic contents FTP-server (‘Stand-alone’) –Clear text password

5. Securing applications: Web Use Patches and fixes Remove the default site Remove all the extension mappings that you don’t need. Change the ODBC settings in registry HKEY_LOCAL_MACHINE\Software\Microsoft\Jet\4.0\engines\SandboxMode to a value of 3 (Default is 2) Move the wwwroot directory to another drive then OS

6. Securing applications: FTP Work as you do with the Web security Mail Use Cryptography if it’s possibly (SSL, VPN, IPSec, …) Use SPAM-filter DNS Use External & Internal DNS if possible. Lookout for Record poisoning. –Dynamic updates –Cache poisoning Lookout for Zone transfers. Limit Zone transfer and DNS updates.

7. Securing Web & E-mail Using SSL & TSL SSL (Secure Sockets Layer) –CPU-intensive (2-100 times slower) –Only TCP TSL (Transport Layer Security) –Makes a tunnel for communication HTTPS (port 443) –MS IIS (Web-server) with SSL Windows SMTP service with SSL

8. Certificate Service Windows Two types: 1.Enterprise (require AD) Computers in the AD will trust the root CA 2.Stand-alone (basic type) Does not support logon certificates. Certificate requests are set to pending and admin has to issue the certificate. For use in a Stand-alone server.

9. Certificate Service Windows 1.Install Certificate service. 2.Configurate CA (Certificate Authority). 3.Set up the policy (CRL and so on). 4.Create Certificate templates. 5.Enable Certificate templates. 6.Certificate enrollment.

10. IPSec IPSec ’works’ on layer 3. => under TCP, UDP, ICMP,… => Transparent for applications! => Will protect every application as: Remote login, Client/server, email, FTP, Web and so on. There is special hardware from Intel, 3com, Cisco, and other, just to unload the IPSec processing from the CPU.

11. IPSec Two protocols: –AH Authentication Header –ESPEncapsulated Security Payload Two modes: –Transport mode –Tunnel mode IKE – Protocol for connecting Creates SA Security Association (Key, Used protocol, Destination IP…) If you want duplex you need two SA’s SPI – Holds used SA (SPI=32bit value in every IP-header) Anti-replay service 0-(32bitar-1) window=64

12. Intrusion Detecting System IDS Tar vid där FW slutar på “insidan” och övervakar trafiken innanför. I samma dator som känsliga data Nätverksbaserat – Ett antal agenter som samlar data till en central som analyserar. Två Principer: 1.Anomali-detektion. 2.Missbruks-detektion. (IDS kan fungera enligt båda men vanligast bara som en av principerna) IPIP http://www.snort.org/

13. Intrusion Detecting System IDS 1.Noggrann statistik över “normalt” beteende. Larm om något ovanligt inträffar. Sällan använda anrop. Extremt mycket trafik. -Risk för falsklarm +Angreppsmetod behöver inte var känd. 2.Larmar på kända typer av attacker -Stor ‘databas’ krävs, måste uppdateras ofta. +Falsklarm ovanligt.

14. Time W2K*, W2K, XP uses Windows Time Service, the time comes from the AD- server and the KDC (Kerberos Key Distribution Center) there. (KDC also includes Authentication Server and Ticket Granting Server) Kerberos uses SNTP (Simple Network Time Protocol) for synchronization.

15. Stratum1 Stratum Stratum2 Vanlig server ~100 Justera den egna klockan Beräkna driften av den egna klockan net time /setsntp: serverlist ”ntp1.sp.se ntp1.sth.netnod.se” net time /querysntp http://www.sp.se/metrology/timefreq/eng/tandf.htm

16. The end !

17. *VPN Virtual Private Network L2TP, PPTP

18. *Microsoft ISA (Internet Security and Acceleration Server) Firewall/Cache

19. Mer Vulnerability (Sårbarheter,säkerhetshål/Svagheter)?