1. Cyber Patriot Training
4 December 2010

2. Results Vulnerability Number Percent Vulns Fixed in Category
Local Security Policy
83%
User & Group Security
81%
Vulnerable Services
80%
79%
Backdoor/Virus/Malware
78%
67%
65%
File and Folder Configuration
63%
62%
61%
53%
Patches and Updates 0%

3. Local Security Policy
More of the same, look at the policies

4. Users and Group Security
Check group membership, disable unknown users

5. Vulnerable Services Control Panel/Administrative Tools/Services
Turn off everything that is not needed. If not sure what the service is, look it up
Use Process Explorer

6. Backdoor/Virus/Malware
Check registry with regedit
HKLM\Software\Micrsoft\Windows\CurrentVersion\Run
HKCU\Software\Micrsoft\Windows\CurrentVersion\Run
Look in C:\Program Files
Dump Temporary Internet Files
Clear History
Download and run
Dump temp folders under windows and user

7. Backdoor/Virus/Malware

8. File and Folder Configuration
Not sure what they want here
Check security settings
Turn off all shares not needed (probably what they are looking for)

9. Patches and Updates
Do windows updates immediately, they take time, do them while you are doing other things
Don’t dLo anything that will require a reboot!!!
Security updates shouldn’t require update or select reboot later
Download from Technet ahead of time
Not sure if you need to do updates as in IE7 to IE8
Would say you SHOULD update but up to you

10. Ubuntu Show running processes Stop running processes
top or ps
Stop running processes
kill by pid
Check scheduled tasks
Crontab -l or –e
su to root and check crontab
chmod to change file permissions
chown to change file owner

11. Ubuntu Continued Check ftp configuration file Turn off telnet as well
/etc
Probably something like: vsftpd.conf
No anonymous login
No root login
Turn off telnet as well
Same thing for ssh
/etc/ssh then ssh_config or sshd_config
To restart a service
service servicename(d) restart (vsftpd, sshd)

12. Ubuntu chkconfig – shows current configuration of services, etc
Shows file sharing
sudo is the same as running as root
Antivirus for Ubuntu