Operating System Hardening

By William Easttom

Date: Dec 24, 2023

Return to the article

Chapter Objectives

After reading this chapter and completing the exercises, you will be able to do the following:

• Properly configure a Windows system for secure operations.

• Properly configure a Linux system for secure operations.

• Apply appropriate operating system patches to Windows.

• Apply application patches.

• Securely configure a web browser.

Introduction

Protecting the system’s perimeters and subnets via firewalls, proxy servers (or NAT-enabled machines), intrusion-detection systems, security information and event management (SIEM) systems, honeypots, and other devices is only one part of securing a network. Even installing antivirus software does not complete a network’s security. To achieve a more secure network, you must perform operating system hardening. This is the process of properly configuring each machine, and especially servers, for the optimum security settings. The word optimum rather than maximum is used for a reason. Maximum security is also the least usable. Optimum security strikes a balance between ease of use and security.

Operating system hardening is a part of defense-in-depth. Yes, you should secure your network perimeter, all servers, routers, and switches, but you must also ensure that the operating systems on all workstations, servers, laptops, tablets, and mobile devices are sufficiently secured.

In this chapter, you will learn how to properly configure Windows 10/11, Linux, and various web browsers. Securely configuring the operating system and its software is a critical step in system security that is frequently ignored. Even relatively naive security administrators often think of installing a firewall or antivirus software, but many fail to harden the individual machines against attacks. Discovering the presence of vulnerabilities allows you to close “open” ports and further restrict “input/output” operations. All of these techniques and procedures are in the overarching area of Risk Management Systems and Information Assurance.

It should be noted that application security is just as important as operating system security. However, there are so many different applications that it is impossible to address secure configuration here, other than to say that you should consult the application documentation and ensure it is securely configured and stays patched/updated. Secure programming is also an important topic, but a completely separate topic outside the scope of this book.

The National Institute of Standards has several standards that are relevant. NIST SP 800-123 is a Guide to General Server Security. One of the major recommendations of this standard is to keep patches updated. The standard also recommends removing all unnecessary services, applications, and network protocols. NIST SP 800-70 National Checklist Program for IT Products: Guidelines for Checklist Users and Developers also emphasizes ensuring the system is properly patched and removing any unnecessary functionality.

Configuring Windows Properly

Properly configuring Windows (with a focus on Windows 10/11 and Windows Server 2019) consists of many facets. You must disable unnecessary services, properly configure the registry, enable the firewall, properly configure the browser, and more. Chapter 4, “Firewall Practical Applications,” discussed the Internet connection firewall and the processes of both stateful packet inspection and stateless packet inspection, and a later section of this chapter discusses browser security. For now, let’s go over the other important factors in Windows security configuration.

Accounts, Users, Groups, and Passwords

Any Windows system comes with certain default user accounts and groups. These can frequently be a starting point for intruders who want to crack passwords for those accounts and thereby gain entrance onto a server or network. Simply renaming or disabling some of these default accounts can improve your security.

In Windows 10, go to Start and type Accounts. Figure 8-1 shows a screen similar to the one you will see.

You can also go to Control Panel > User Accounts. You will get a screen similar to the one shown in Figure 8-2.

By selecting Manage Accounts, you can then add, delete, or alter any user accounts, as shown in Figure 8-3.

Administrator Accounts

The default administrator account has administrative privileges, and hackers frequently seek to obtain the logon information for an administrator account. Guessing a logon is a twofold process of first identifying the username and then the password. Default accounts allow the hacker to bypass the first half of this process.

Administrators should disable this account. If you double-click on any account (recall the Users and Groups utility previously shown in Figure 8-3), you will have the ability to change the account type. The specific look and feel of this screen depends on how you arrived at it. Going through the Control Panel will get you to a different look than simply typing users at the start. You can see account type in Figure 8-4.

Obviously, having an account with administrative privileges is necessary for maintaining your server. The next step is adding a new account, one with an innocuous name (for example, temp_clerk, receptionist, etc.), and giving that account administrative privileges. Doing so makes a hacker’s task more difficult, as he must first ascertain what account actually has administrative privileges before he can even attempt to compromise that account.

Some experts suggest simply renaming the administrator account, or using an administrator account that has a username that indicates its purpose. That is not the recommendation of this book for the following reasons:

• The whole point is that a hacker should not be able to readily tell which username has administrative privileges.

• Simply renaming the administrator account to a different name, but one that still indicates its administrative rights, will not help this situation.

Other Accounts

We have concentrated on the administrator account because it is the one most often targeted by hackers, but Windows also includes other default user accounts. Applying an equally rigorous treatment to all default accounts is a good idea. Any default account can be a gateway for a hacker to compromise a system. A few accounts that you should pay particular attention to include:

• IUSR_Machine name: When you are running IIS, a default user account is created for IIS. Its name is IUSR_ and the name of your machine. This is a common account for a hacker to attempt to compromise. Altering this one in the manner suggested for the administrator account is advisable.

• ASP.NET: If your machine is running ASP.NET, a default account is created for web applications. A hacker that is familiar with .NET could target this account.

• Database accounts: Many relational database management systems, such as SQL Server, create default user accounts. An intruder, particularly one who wants to get at your data, could target these accounts.

Of course, you must have accounts for all of these and other services. The suggestion here is to ensure that the names of these accounts are not obvious and that default accounts are not used.

When adding any new account, always give the new account’s user or group the least number and type of privileges needed to perform their job, even accounts for IT staff members. Here are a few examples of places to restrict user access/privileges that you might not think of:

• A PC technician does not need administrative rights on the database server. Even though she is in the IT department, she does not need access to everything in that department.

• Managers may use applications that reside on a web server, but they certainly should not have rights on that server.

• Just because a programmer develops applications that run on a server does not mean that he should have full rights on that server.

• Perhaps this might be another position to reinforce the procedures of RBAC (Role-Based Access Control), DAC (Discretionary Access Control), and MAC (Mandatory Access Control).

These are just a few examples of things to consider when setting up user rights. Remember: Always give the least access necessary for that person to do her job. This concept is often termed least privileges and is a cornerstone of security.

Setting Security Policies

Setting appropriate security policies is the next step in hardening a Windows server. This does not refer to written policies an organization might have regarding security standards and procedures. In this case the term security policies refers to the individual machines’ policies. When you select Start, Settings, Control Panel, Administrative Tools, you will also note the Local Security Policy. Double-clicking this and selecting Account Policies takes you to the screen shown in Figure 8-5. The various subfolders in the dialog box shown in Figure 8-5 are expanded. Normally when you open this utility they will not be. Note that in Windows 10 you can access this same screen by going to the Run menu and typing gpedit (this is the Local Group Policy Editor utility). You will also get to this screen by typing local policy.

The first matter of concern is setting secure password policies. The default settings for Windows passwords are not secure. Table 8-1 shows the default password policies. Maximum password age refers to how long a password is effective before the user is forced to change that password. Enforce password history refers to how many previous passwords the system remembers, thus preventing the user from reusing passwords. Minimum password length defines the minimum number of characters allowed in a password. Password complexity means that the user must use a password that combines numbers, letters, and other characters. These are the default security settings for all Windows versions from Windows NT 4.0 forward. If your system is protected within a business environment, the settings at Local Security will be grayed out, indicating you do not have permission to make changes.

TABLE 8-1 Default Windows Password Policies

Policy	Recommendation
Enforce password history	1 password remembered
Maximum password age	42 days
Minimum password age	0 days
Minimum password length	0 characters
Passwords must meet complexity requirements	Disabled
Store password using reversible encryption for all users in the domain	Disabled

The default password policies are not secure enough, but what policies should you use instead? Different experts answer that question differently. Table 8-2 shows the recommendations of Microsoft, the National Security Agency, and the author’s personal recommendations (along with an explanation when they differ significantly from the Microsoft or NSA recommendations).

TABLE 8-2 Password Setting Recommendations

Policy	Microsoft	NSA	Author
Enforce password history	3 passwords	5 passwords	3 passwords
Maximum password age	42 days	42 days	60 days
Minimum password age	2 days	2 days	2 days
Minimum password length	14 characters	12 characters	A minimum of 14 characters. Longer passwords, or passphrases, are best.
Passwords must meet complexity requirements	No recommendation (left to user discretion)	Yes	Yes
Store password using reversible encryption for all users in the domain	No recommendation (left to user discretion)	No recommendation	No recommendation (left to user discretion)

Developing appropriate password policies depends largely on the requirements of your network environment. If your network stores and processes highly sensitive data and is an attractive target to hackers, you must always skew your policies and settings toward greater security. However, bear in mind that if security measures are too complex, your users will find complying difficult. For example, very long, complex passwords (such as $%Tbx38T@_FgR$$) make your network quite secure, but such passwords are virtually impossible for users to remember. Many users will simply write the password on a note and keep it in a handy but insecure location, such as the top drawer of their desks, a major security problem.

Account Lockout Policies

When you open the Local Security Settings dialog, your options are not limited to setting password policies. You can also set account lockout policies. These policies determine how many times a user can attempt to log in before being locked out, and for how long to lock them out. The default Windows settings are shown in Table 8-3.

These default policies are not secure. Essentially they allow for an infinite number of log-in attempts, making the use of password crackers very easy and virtually guaranteeing that someone will eventually crack one or more passwords and gain access to your system. Table 8-4 provides the recommendations from Microsoft, National Security Agency, and the author.

TABLE 8-3 Windows Default Account Lockout Policy Settings

Policy	Default Settings
Account lockout duration	Not defined
Account lockout threshold	0 invalid logon attempts
Reset account lockout counter after	Not defined

TABLE 8-4 Recommended Account Lockout Policies

Policy	Microsoft	NSA	Author
Account lockout duration	0, indefinite	15 hours	48 hours. If someone is attempting to crack passwords on weekends/holidays, you want the account locked until an administrator is aware of the attempt.
Account lockout threshold	5 attempts	3 attempts	3 attempts
Reset account after	15 minutes	30 minutes	30 minutes

Other Issues

Some account and password issues cannot be handled with computer settings. These involve setting organizational policies regarding user and administrator behavior. Chapter 11, “Security Policies,” discusses such organizational policies in greater depth. For now, simply consider this basic list of the most important organizational security policies:

• Users must never write down passwords.

• Users must never share passwords.

• Administrators must use the least required access rule. That means most users should not have administrative privileges even on their own desktops.

Registry Settings

Secure registry settings are critical to securing a network. Unfortunately, my experience has been that this area is often overlooked by otherwise secure practices. One thing to keep in mind is that if you don’t know what you are doing in the registry, you can cause serious problems. So, if you are not very comfortable with the registry, don’t touch it. Even if you are comfortable making registry changes, always back up the registry before any change.

The Windows Registry is a database used to store settings and options for Microsoft Windows operating systems. This database contains critical information and settings for all the hardware, software, users, and preferences on a particular computer. Whenever users are added, software is installed, or any other change is made to the system (including security policies), that information is stored in the registry.

Registry Basics

The physical files that make up the registry are stored differently depending on which version of Windows you are using. Older versions of Windows (that is, Windows 95 and 98) kept the registry in two hidden files in your Windows directory, called USER.DAT and SYSTEM.DAT. In all versions of Windows since XP, the physical files that make up the registry are stored in %SystemRoot%\System32\Config. Since Windows 8, the file has been named ntuser.dat. Regardless of the version of Windows you are using, you cannot edit the registry directly by opening and editing these files. Instead you must use a tool, regedit.exe, to make any changes. There are newer tools like regedit32. However, many users find that the older regedit has a more user-friendly “find” option for searching the registry. Either one will work.

Although the registry is referred to as a “database,” it does not actually have a relational database structure (like a table in MS SQL Server or Oracle). The registry has a hierarchical structure similar to the directory structure on the hard disk. In fact, when you use regedit, you will note it is organized like Windows Explorer. To view the registry, go to Start, Run, and type regedit. You should see the Registry Editor dialog box, shown in Figure 8-6. Some of the folders in your dialog box might be expanded. If so, simply collapse them so that your registry looks like the one shown in Figure 8-6.

Your Registry Editor dialog box will likely have the same five main folders as the ones shown in Figure 8-6. Each of these main branches of the registry is briefly described in the following list. These five main folders are the core registry folders. A system might have additions, but these are the primary folders containing information necessary for your system to run.

• HKEY_CLASSES_ROOT: This branch contains all of your file association types, OLE information, and shortcut data.

• HKEY_CURRENT_USER: This branch links to the section of HKEY_USERS appropriate for the user currently logged on to the PC.

• HKEY_LOCAL_MACHINE: This branch contains computer-specific information about the type of hardware, software, and other preferences on a given PC.

• HKEY_USERS: This branch contains individual preferences for each user of the computer.

• HKEY_CURRENT_CONFIG: This branch links to the section of HKEY_LOCAL_ MACHINE appropriate for the current hardware configuration.

If you expand a branch, you will see its subfolders. Many of these have, in turn, more subfolders, possibly as many as four or more before you get to a specific entry. A specific entry in the Windows Registry is referred to as a key. A key is an entry that contains settings for some particular aspect of your system. If you alter the registry, you are actually changing the settings of particular keys.

This is just a brief overview of the registry. If you intend to do more extensive work with the registry than setting the proper security, you can use the following sources:

• 50 Best Windows Registry Hacks

• Windows Registry Tips: http://techtweek.com/windows/all-important-windows-registry-tips-and-tweaks

• Microsoft’s Windows Registry support page: https://support.microsoft.com/en-us/help/256986/windows-registry-information-for-advanced-users

Keep in mind that registry settings can change in different versions of Windows, so it is possible that you might not find one or more of the following settings, or they might be in a slightly different location. To find and check your registry settings for any of these keys, simply expand the appropriate node and work your way down to the specific key. For example, the first one on our list is HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer. You could first expand the LOCAL_MACHINE node, then the SYSTEM node, then the CurrentControlSet node, then the Services node. You should then be able to find the specific registry key you are looking for; in this example, we found LanmanServer. The same process can be applied to find any key; the LanmanServer key was randomly chosen for this example.

Restrict Null Session Access

Null sessions are a significant weakness that can be exploited through the various shares that are on the computer. A null session is Windows’ way of designating anonymous connections. Any time you allow anonymous connections to any server, you are inviting significant security risks. Modify null session access to shares on the computer by adding RestrictNullSessAccess, a registry value that toggles null session shares on or off to determine whether the Server service restricts access to clients logged on to the system account without username and password authentication. Setting the value to 1 restricts null session access for unauthenticated users to all server pipes and shares except those listed in the NullSessionPipes and NullSessionShares entries.

• Key Path: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer

• Action: Ensure that it is set to: Value = 1

Restrict Null Session Access Over Named Pipes

The null session access over named pipes registry setting should be changed for much the same reason as the preceding null session registry setting. Restricting such access helps prevent unauthorized access over the network. To restrict null session access over named pipes and shared directories, edit the registry and delete the values, as shown in Table 8-5.

• Key Path: HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer

• Action: Delete all values

TABLE 8-5 TCP/IP Stack Registry Settings

Key Path	Recommended Value
DisableIPSourceRouting	2
EnableDeadGWDetect	0
EnableICMPRedirect	0
EnablePMTUDiscovery	0
EnableSecurityFilters	1
KeepAliveTime	300,000
NoNameReleaseOnDemand	1
PerformRouterDiscovery	0
SynAttackProtect	2
TcpMaxConnectResponseRetransmissions	2
TcpMaxConnectRetransmissions	3
TCPMaxPortsExhausted	5

Restrict Anonymous Access

The anonymous access registry setting allows anonymous users to list domain usernames and enumerate share names. It should be shut off. The possible settings for this key are:

• 0—Allow anonymous users

• 1—Restrict anonymous users

• 2—Allow users with explicit anonymous permissions

• Key Path: HKLM\SYSTEM\CurrentControlSet\Control\Lsa

• Action: Set Value = 2

TCP/IP Stack Settings

A number of registry settings affect how the TCP/IP stack handles incoming packets. Setting these properly can help reduce your vulnerability to DoS attacks. This process, stack tweaking, is described in Chapter 2, “Types of Attacks.” Because these settings are all related and are found in the same key path, they are shown together in Table 8-5.

As Table 8-5 shows, most of these settings prevent the redirection of packets, change the timeout on connections, and generally alter how Windows handles TCP/IP connections. You can find more details about Microsoft’s recommendations for setting the TCP/IP stack registry settings at its website: https://msdn.microsoft.com/en-us/library/ff648853.aspx.

Remote Access to the Registry

Remote access to the registry is another potential opening for hackers. Many experts advise that there should be no remote access to the registry for any person. This point is certainly debatable. If your administrators frequently need to remotely alter registry settings, then completely blocking remote access to them will cause a reduction in productivity of those administrators. However, completely blocking remote access to the registry is certainly more secure. To restrict network access to the registry:

1. Add the following key to the registry: HKEY_LOCAL_MACHINE\SYSTEM\ CurrentControlSet\Control\SecurePipeServers\winreg.

2. Select winreg, click the Security menu, and then click Permissions.

3. Set the Administrator’s permission to Full Control, make sure no other users or groups are listed, and then click OK.

   Recommended Value = 0

Other Registry Settings

Adjusting the previously discussed registry settings will help you avoid some of the most common security flaws in the default Windows Registry settings and will certainly increase the security of any server. However, for maximum security an administrator must take the time to carefully study the Windows Registry for any additional areas that can be made more secure. A few of the additional settings you might want to look into include:

• Restricting anonymous access to the registry

• NTLMv2 Security (affects security of passwords being sent to the server)

• KeepAlive (affects how long to keep a connection active)

• SynAttackProtect (protects against a very specific type of SYN attack)

Services

A service is a program that runs without direct intervention by the computer user. In Unix/Linux environments, these are referred to as daemons. Many items on your computer are run as services. Internet Information Services, FTP Service, and many system services are good examples. Any running service is a potential starting point for a hacker. Obviously, you must have some services running for your computer to perform its required functions. However, there are services your machine does not use. If you are not using a service, it should be shut down.

Shutting Down a Service in Windows

Shutting down a service in Windows is relatively easy. In our example we will shut down the FTP service on a machine that does not require FTP.

Go to Start, select Settings, and choose Control Panel. Double-click Administrative Tools, and then double-click Services. You should see the Services dialog box, which looks similar to the one shown in Figure 8-7.

The Services dialog box shows all services installed on your machine, whether they are running or not. Notice that the dialog box also displays information about whether a service is running, whether it starts up automatically, and so forth. In Windows 7 and beyond, more information can be seen by selecting an individual service. When you double-click on an individual service, you see a dialog box similar to Figure 8-8, which gives you detailed information about the service and enables you to change the service’s settings. In Figure 8-8, we are examining the FTP service on a machine that does not require it.

In this particular case there are no other dependencies, so you can go to the General tab and do two things: Change the Startup type option to Disabled, and then click the Stop button. When you’re done, the screen will show the status as disabled. The service is now shut down.

Shutting down unneeded services is an essential and very basic part of hardening an operating system. Every running service is a possible avenue for a hacker or a virus to get to your machine, so the rule for services is: If you don’t need it, shut it down. Chapter 12 discusses utilities that scan systems for vulnerabilities. Many of these utilities will point out running services and open ports.

Starting and stopping services from the command prompt is also possible. Many administrators prefer command prompts because it is often faster than going through several layers of the Windows graphical user interface. The syntax is quite simple:

net start servicename

or

net stop servicename

For example:

net stop messenger
net start messenger

Port Filtering and Firewalls in Windows

Chapters 4 and 5 discuss the Windows Firewall. Turning on the Windows port filters is a basic part of operating system hardening. The instructions for doing this have been previously given in Chapters 4 and 5 and will be explored again in exercises at the end of this chapter.

Encrypting File System

Beginning with Windows 2000, the Windows operating system has offered the Encrypting File System (EFS), which is based on public key encryption and takes advantage of the CryptoAPI architecture in Windows 2000. This still exists in Windows 10 and 11; however, with the later versions of Windows, EFS is only available in the upper-end editions of Windows such as Windows Professional. With this system, each file is encrypted using a randomly generated file encryption key, which is independent of a user’s public/private key pair; this method makes the encryption resistant to many forms of cryptoanalysis-based attacks. For our purposes the exact details of how EFS encryption works are not as important as the practical aspects of using it.

User Interaction

The default configuration of EFS enables users to start encrypting files with no administrator effort. EFS automatically generates a public key pair and file encryption certificate for file encryption the first time a user encrypts a file.

File encryption and decryption is supported per file or for an entire folder. Folder encryption is transparently enforced. All files and folders created in a folder marked for encryption are automatically encrypted. Each file has a unique file encryption key, making it safe to rename. If you move a file from an encrypted folder to an unencrypted folder on the same volume, the file remains encrypted. However, if you copy an unencrypted file into an encrypted folder, the file state will change. The file becomes encrypted. Command-line tools and administrative interfaces are provided for advanced users and recovery agents.

Security Templates

We have been discussing a number of ways for making a Windows system more secure, but exploring services, password settings, registry keys, and other tools can be a daunting task for the administrator who is new to security. Applying such settings to a host of machines can be a tedious task for even the most experienced administrator. The best way to simplify this aspect of operating system hardening is to use security templates. A security template contains hundreds of possible settings that can control a single or multiple computers. Security templates can control areas such as user rights, permissions, and password policies, and they enable administrators to deploy these settings centrally by means of Group Policy Objects (GPOs).

Security templates can be customized to include almost any security setting on a target computer. A number of security templates are built into Windows. These templates are categorized for domain controllers, servers, and workstations. These security templates have default settings designed by Microsoft. All of these templates are located in the C:\Windows\Security\Templates folder. The following is a partial list of the security templates that you will find in this folder:

• Hisecdc.inf: This template is designed to increase the security and communications with domain controllers.

• Hisecws.inf: This template is designed to increase security and communications for client computers and member servers.

• Securedc.inf: This template is designed to increase the security and communications with domain controllers, but not to the level of the High Security DC security template.

• Securews.inf: This template is designed to increase security and communications for client computers and member servers.

• Setup security.inf: This template is designed to reapply the default security settings of a freshly installed computer. It can also be used to return a system that has been misconfigured to the default configuration.

Installing security templates simplifies network security for the administrator. You will have the opportunity to walk through the process of installing a security template in one of the end-of-chapter exercises.

Configuring Windows Server 2019 Properly

Many of the recommendations for Windows 10/11 apply equally to Windows Server 2019. This includes restricting access to the registry and using good password policies; however, there are some differences. The first is that when you first launch Windows Server 2019, you will see the Server Manager Dashboard, as shown in Figure 8-11.

This dashboard is substantially similar in various versions of Windows Server, including Windows Server 2016. To manage the server you are on, simply select Local Server, as shown in Figure 8-12.

From this screen you can administer remote desktop/management settings as well as roles and features. There is even a best practices utility to determine if you are implementing best practices. Because servers typically have substantial amounts of data on them, security is even more important than for a workstation. There are several guides on the Internet for hardening Windows Server 2019. A few are listed here:

• https://cloudinfrastructureservices.co.uk/windows-server-hardening-security-checklist-windows-2016-2019-2022/

• https://www.upguard.com/blog/the-windows-server-hardening-checklist

• https://www.webservertalk.com/windows-server-2019-hardening-checklist-guide/

Configuring Linux Properly

An in-depth review of Linux security would be a lengthy task indeed. One reason is the diversity of Linux setups. Users could be using Debian, Red Hat, Ubuntu, or other Linux distributions. Some might be working from the shell, while others work from some graphical user interfaces such as KDE or GNOME (for Windows users not familiar with Linux you might want to consult my book Moving from Windows to Linux). Fortunately, many of the same security concepts that apply to Windows can be applied to Linux. The only differences lie in the implementation, as explained in the following list:

• User and account policies should be set up the same in Linux as they are in Windows, with only a few minor differences. These differences are more a matter of using different names in Linux than in Windows. For example, Linux does not have an administrator account; it has a root account.

• All services (called daemons in Linux) not in use should be shut down.

• The browser must be configured securely.

• You must routinely patch the operating system.

In addition to these tactics that are common to Windows and Linux, a few approaches are different for the two operating systems:

• No application should run as the root user unless absolutely necessary. Remember that the root user is equivalent to the administrator account in Windows. Also remember that all applications in Linux run as if started by a particular user, and therefore having an application run as root user would give it all administrative privileges.

• The root password must be complex and must be changed frequently. This is the same as with Windows administrator passwords.

• Disable all console-equivalent access for regular users. This means blocking access to programs such as shutdown, reboot, and halt for regular users on your server. To do this, run the following command: [root@kapil /]# rm -f /etc/security/console.apps/<servicename>, where <servicename> is the name of the program to which you want to disable console-equivalent access.

• Hide your system information. When you log in to a Linux box, it displays by default the Linux distribution name, version, kernel version, and the name of the server. This information can be a starting point for intruders. You should just prompt users with a “Login:” prompt.

To do this, edit the /etc/rc.d/rc.local file and place # in front of the following lines, as shown:

# This will overwrite /etc/issue at every boot. So, make any changes you
# want to make to /etc/issue here or you will lose them when you reboot.
#echo "" > /etc/issue
#echo "$R" >> /etc/issue
#echo "Kernel $(uname -r) on $a $(uname -m)" >> /etc/issue
#
#cp -f /etc/issue /etc/issue.net
#echo >> /etc/issue
Remove the following files: "issue.net" and "issue" under "/etc" directory:
[root@kapil /]# rm -f /etc/issue
[root@kapil /]# rm -f /etc/issue.net

In general, security concepts apply regardless of operating system. However, truly hardening any operating system requires a certain level of expertise with that particular operating system.

The following websites provide information useful for helping you secure your Linux server:

• Linux Security Administrators Guide: www.linuxsecurity.com/docs/SecurityAdminGuide/SecurityAdminGuide.html

• Linux.com: www.linux.com/

Patching the Operating System

From time to time, security flaws are found in operating systems. As software vendors become aware of flaws, they usually write corrections to their code, known as patches or updates. Whatever operating system you use, you must apply these patches as a matter of routine. Windows patches are probably the most well-known, but patches can be released for any operating system. You should patch your system any time a critical patch is released. You might consider scheduling a specific time simply to update patches. Some organizations find that updating once per quarter or even once per month is necessary.

For Windows you can go to www.microsoft.com. On the left-hand side you should notice a link that says Update Windows. If you click on it, you can scan your machine for missing patches and download them from the website. Red Hat offers a similar service for Red Hat Linux users. On the website www.redhat.com/security/, users can scan for updates.

Configuring Browsers

Most computers, including corporate workstations, are used to access the Internet. This means that proper browser configuration is absolutely essential for hardening a system. The Internet is probably the single greatest threat to an individual system or a corporate network. Safe use of the Internet is critical. This section describes how to set Internet Explorer for safe Internet use.

Securing Browser Settings for Microsoft Edge

Because Microsoft Edge is the default browser in Windows 10 and 11, it is a commonly used browser. Therefore, it is important to adequately secure this browser. Here are the steps to follow:

1. Open Microsoft Edge.

2. Select the ellipsis (…) in the upper-right corner and then select Settings. This is shown in Figure 8-13.

Figure 8-14 shows the Settings screen.

Under Privacy, Search, and Services, you have several options, as shown in Figure 8-15.

The first thing you can do on this screen is to set general tracking to Basic, Balanced, or Strict; however, if you scroll down, you will also have options to clear data when you exit the browser. This can be an invaluable privacy tool. As you continue to scroll down, you will see other settings, including the security settings, as shown in Figure 8-16.

Using the Microsoft Edge settings properly can allow you to find the right balance between security and ease of use. This will always be a bit of a trade-off. The more strict security is, the less user friendly the system is.

Secure Settings for Firefox

Mozilla Firefox is a popular and free browser that is available for Windows, macOS, Linux, Android, and iOS (https://www.mozilla.org/en-US/firefox/new/). The first step is to click the upper-right corner and find Settings, as shown in Figure 8-17.

Under Settings, you will find Privacy & Security. Much like in Edge, you can choose general classifications. With Firefox, those classifications are Standard, Strict, and Custom, as shown in Figure 8-18.

As you scroll down the screen, you will find options for clearing history, automatically clearing history, whether to autofill data, and more. As with any browser, it will take a bit of thought to find exactly the correct balance. Firefox does offer one exciting option that Edge does not: add-ons. If you choose Add-ons and themes from the same menu where you found Settings, you will be taken to a screen that allows you to select all sorts of add-ons for the browser. As an example, there are numerous privacy add-ons that can help protect your browsing privacy, as shown in Figure 8-19.

You might be wondering how you can be certain these add-ons are safe. First, be aware that Mozilla will remove any add-ons it suspects of not being safe. Second, look for how many users an add-on has. The more users, the less likely the add-on could have some malicious purpose that hasn’t been detected.

Secure Settings for Chrome

Chrome is another free browser available for multiple operating systems (https://www.google.com/chrome/). The settings are found in the upper-right corner, as shown in Figure 8-20.

Under Settings, you will find Privacy and Security, as shown in Figure 8-21.

There are settings to determine how the browser handles cookies, how the browser shares data such as location, and the ability to clear browser data. You will also see a privacy guide, which will lead you through making your privacy settings. This is ideal for users who might not be technically proficient.

Other Browsers

In addition to Edge, Firefox, and Chrome, other available browsers include Opera, Safari (macOS), and IceCate (Linux only, default is Kali Linux). Each of these have different methods for setting up security, but the same principles that hold true for Edge, Firefox, and Chrome also apply to these browsers: Limit cookies, do not allow ActiveX components to run without your knowledge, and do not allow any scripts to execute without your knowledge. If you apply the same principles to other browsers, you should be able to achieve similar security to what you can have with Internet Explorer.

Summary

Operating system hardening is a critical part of network security, and it has many facets. It involves securing the operating system, applying patches, using appropriate security settings, and securing your browser. All of these factors must be addressed in order to secure a machine.

Careful configuration of the operating system can make many hacking techniques more difficult. It can also make a system more resistant to DoS attacks. Setting up appropriate policies for users and accounts can make hacking into those accounts much more difficult. Policies should cover issues such as appropriate password length, password type, and password age/history.

With Windows you can also use the Encrypting File System to protect your data should it be moved off of your system. EFS was first introduced in Windows 2000 and has continued through to today. It is a valuable tool that can and should be used to protect any sensitive data.

With any version of Microsoft Windows, proper registry settings are key to security. The registry is the heart and soul of the Microsoft Windows operating system, and failure to address proper registry settings will leave gaping holes in security.

Proper configuration of the browser makes a system less susceptible to malware. Limiting cookies can help ensure that privacy is protected. Blocking browsers from executing scripts or any active code without your knowledge is a critical step for protecting a system from malware.

Test Your Skills

Multiple Choice Questions

1. What does disabling the default administrator account and setting up an alternative account accomplish?

   1. Makes it more difficult for someone to guess the logon information

   2. Keeps administrators conscious of security

   3. Allows closer management of administrator access

   4. Makes the password stronger

2. What level of privileges should all users have?

   1. Administrator

   2. Guest

   3. Most privileges possible

   4. Least possible

3. What minimum password length does the NSA recommend?

   1. 6

   2. 8

   3. 10

   4. 12

4. What maximum password age does Microsoft recommend?

   1. 20 days

   2. 3 months

   3. 1 year

   4. 42 days

5. What account lockout threshold does the NSA recommend?

   1. 5 tries

   2. 3 tries

   3. 4 tries

   4. 2 tries

6. Which of the following most accurately describes the registry?

   1. A relational database containing system settings

   2. A database containing system settings

   3. A database where software is registered

   4. A relational database where software is registered

7. What is changing the TCP/Settings in the registry called?

   1. Stack tweaking

   2. Stack altering

   3. Stack compression

   4. Stack building

8. What type of encryption does EFS utilize?

   1. Single key

   2. Multi-alphabet

   3. Public key encryption

   4. A secret algorithm proprietary to Microsoft

9. What happens if you copy an unencrypted file into an encrypted folder?

   1. It remains unencrypted.

   2. The folder becomes unencrypted.

   3. Nothing happens.

   4. The file becomes encrypted.

10. Which of the following templates is used to provide the most security for the domain controllers?

    1. Hisecdc.inf

    2. Securedc.inf

    3. Hisecws.inf

    4. Sectopdc.inf

11. Which of the following is a security recommendation for Linux not common to Windows?

    1. Shut down all services that you are not using (called daemons in Linux).

    2. Configure the browser securely.

    3. Routinely patch the operating system.

    4. Disable all console-equivalent access for regular users.

12. What is the rule for unused services on any computer?

    1. Turn them off only if they are critical.

    2. Turn them off.

    3. Monitor them carefully.

    4. Configure them for minimal privileges.

13. What operating systems require periodic patches?

    1. Windows

    2. Linux

    3. All

    4. Macintosh

14. What is the minimum secure setting in Internet Explorer for Run components not signed with Authenticode?

    1. Disable

    2. Enable

    3. Forbid

    4. Prompt

15. What is the recommended secure setting in Internet Explorer for Initialize and script ActiveX controls not marked as safe?

    1. Disable

    2. Enable

    3. Forbid

    4. Prompt

Exercises

EXERCISE 8.1: User Accounts and Password Policies

Note: This exercise is best done with a lab computer, not a machine actually in use. Following the guidelines given in this chapter, accomplish the following tasks:

1. Create a new account with administrative privileges.

2. Disable all default accounts, or if they cannot be disabled, change them to the lowest possible permissions.

3. Implement the NSA recommendations for password policies and account lockout policies.

EXERCISE 8.2: Secure Registry Settings

Note: This exercise should be done on a laboratory Windows machine, not on one in normal use. Using the guidelines given in the chapter, check your machine’s settings to see that the following recommendations are implemented:

• Restrict null session access.

• Restrict anonymous access.

• Change default shares.

• Restrict null session access over named pipes.

EXERCISE 8.3: Stack Tweaking

Note: This exercise should be done on a laboratory machine, not one in normal use.

Following the guidelines given in the chapter, change the registry settings to make DoS attacks more difficult.

EXERCISE 8.4: Installing Security Templates

This exercise should be done on a laboratory Windows machine, not on one in normal use. By following the steps given here, you should be able to apply a security template to a Windows 7 or XP machine. You may use one of the default templates mentioned in the chapter or one you download from a website of your choice.

1. From the command prompt, or from Start, Run, type MMC. A screen like the one shown in Figure 8-22 appears.

   FIGURE 8-22 The MMC console

2. Go to the drop-down menu Console and choose Add/remove console.

3. When you click the Add/Remove snap-in you can select a number of consoles. Find and select Security Configuration and Analysis.

4. After you have added this to the console, you can right-click on it and choose Open Database. Then give the database any name you like. When you press Enter, your dialog will change to display a list of all templates. Select the one you want.

EXERCISE 8.5: Securing Linux

Using a laboratory Linux machine (any distribution will work) and the data presented in this chapter, accomplish the following:

1. Ensure that user accounts are set up securely.

2. Shut down unused and unneeded daemons.

3. Apply the Linux-specific settings given in this chapter.

EXERCISE 8.6: Securing Microsoft Internet Explorer

Using a laboratory computer, secure Microsoft Internet Explorer by following the steps given here:

1. Block all unsigned ActiveX components.

2. Limit cookies to only first-party and session cookies.

3. Block all scripting.

EXERCISE 8.7: Patching Windows

Using a laboratory computer, preferably one that has not been patched in quite some time:

1. Go to www.microsoft.com.

2. Scan for patches.

3. Update all patches, and document the patches you update.

Projects

PROJECT 8.1: Account and Password Settings

This chapter provides recommendations on accounts and passwords from the NSA, Microsoft, and the author. Using the web (including but not limited to resources identified in this chapter), find recommendations from some other reliable source (CERT, SANS, any of the security certification vendors, etc.). Write a brief paper discussing those recommendations, paying particular attention to areas in which they differ from the recommendations given in this chapter.

PROJECT 8.2: Registry Settings

Note: This project is appropriate either for students with a strong understanding of the registry or perhaps as a group project.

Write about at least three additional registry settings you think should be modified to create a more secure Windows operating system. Explain your reasons fully.

PROJECT 8.3: Encrypting File System

Using the web or other resources, find out specifics about the Encrypting File System that is part of Windows. Describe this file system, and any strengths and any weaknesses you find.

© 2024 Pearson Education, Pearson IT Certification. All rights reserved.

800 East 96th Street, Indianapolis, Indiana 46240

vceplus-200-125    | boson-200-125    | training-cissp    | actualtests-cissp    | techexams-cissp    | gratisexams-300-075    | pearsonitcertification-210-260    | examsboost-210-260    | examsforall-210-260    | dumps4free-210-260    | reddit-210-260    | cisexams-352-001    | itexamfox-352-001    | passguaranteed-352-001    | passeasily-352-001    | freeccnastudyguide-200-120    | gocertify-200-120    | passcerty-200-120    | certifyguide-70-980    | dumpscollection-70-980    | examcollection-70-534    | cbtnuggets-210-065    | examfiles-400-051    | passitdump-400-051    | pearsonitcertification-70-462    | anderseide-70-347    | thomas-70-533    | research-1V0-605    | topix-102-400    | certdepot-EX200    | pearsonit-640-916    | itproguru-70-533    | reddit-100-105    | channel9-70-346    | anderseide-70-346    | theiia-IIA-CIA-PART3    | certificationHP-hp0-s41    | pearsonitcertification-640-916    | anderMicrosoft-70-534    | cathMicrosoft-70-462    | examcollection-cca-500    | techexams-gcih    | mslearn-70-346    | measureup-70-486    | pass4sure-hp0-s41    | iiba-640-916    | itsecurity-sscp    | cbtnuggets-300-320    | blogged-70-486    | pass4sure-IIA-CIA-PART1    | cbtnuggets-100-101    | developerhandbook-70-486    | lpicisco-101    | mylearn-1V0-605    | tomsitpro-cism    | gnosis-101    | channel9Mic-70-534    | ipass-IIA-CIA-PART1    | forcerts-70-417    | tests-sy0-401    | ipasstheciaexam-IIA-CIA-PART3    | mostcisco-300-135    | buildazure-70-533    | cloudera-cca-500    | pdf4cert-2v0-621    | f5cisco-101    | gocertify-1z0-062    | quora-640-916    | micrcosoft-70-480    | brain2pass-70-417    | examcompass-sy0-401    | global-EX200    | iassc-ICGB    | vceplus-300-115    | quizlet-810-403    | cbtnuggets-70-697    | educationOracle-1Z0-434    | channel9-70-534    | officialcerts-400-051    | examsboost-IIA-CIA-PART1    | networktut-300-135    | teststarter-300-206    | pluralsight-70-486    | coding-70-486    | freeccna-100-101    | digitaltut-300-101    | iiba-CBAP    | virtuallymikebrown-640-916    | isaca-cism    | whizlabs-pmp    | techexams-70-980    | ciscopress-300-115    | techtarget-cism    | pearsonitcertification-300-070    | testking-2v0-621    | isacaNew-cism    | simplilearn-pmi-rmp    | simplilearn-pmp    | educationOracle-1z0-809    | education-1z0-809    | teachertube-1Z0-434    | villanovau-CBAP    | quora-300-206    | certifyguide-300-208    | cbtnuggets-100-105    | flydumps-70-417    | gratisexams-1V0-605    | ituonline-1z0-062    | techexams-cas-002    | simplilearn-70-534    | pluralsight-70-697    | theiia-IIA-CIA-PART1    | itexamtips-400-051    | pearsonitcertification-EX200    | pluralsight-70-480    | learn-hp0-s42    | giac-gpen    | mindhub-102-400    | coursesmsu-CBAP    | examsforall-2v0-621    | developerhandbook-70-487    | root-EX200    | coderanch-1z0-809    | getfreedumps-1z0-062    | comptia-cas-002    | quora-1z0-809    | boson-300-135    | killtest-2v0-621    | learncia-IIA-CIA-PART3    | computer-gcih    | universitycloudera-cca-500    | itexamrun-70-410    | certificationHPv2-hp0-s41    | certskills-100-105    | skipitnow-70-417    | gocertify-sy0-401    | prep4sure-70-417    | simplilearn-cisa    |