.05 RG Vocab system security - microsoft Flashcards
Windows
Microsoft’s proprietary operating systems, used by approximately 93% of the
world’s computers, with a closed kernel and utilizing a folder-based file system.
Kernel Mode
the mode the computer processor is running in when interacting with core
system components such as hardware drivers and the bootloader.
User Mode
the mode the computer processor is running in when interacting with
applications, services, sessions, and processes.
Enterprise
a term that encompasses all systems Microsoft provides to help businesses
function and serve customers
User
single account entity in Microsoft, can be applied to a person, device, or application
Groups
used in Windows to apply collective permission sets to users
Active Directory
Microsoft’s flagship enterprise user control software. It runs on Windows
Server. Oversees all users, groups, and devices in a Windows environment and allows System
Administrators to control permissions and access granularly
Objects
all users, applications, and devices are considered objects in Active Directory
Principals
a term used to describe user or group objects in Active Directory
Resources
a term used to describe printers, servers, and computers in Active Directory
Mobile Device Management (MDM)
integrated enterprise control over mobile devices
whether company-owned or in a BYOD (Bring Your Own Device) business environment
Mobile Application Management (MAM)
allows control over application use and
behavior in a business environment to enhance security and limit data leakage
Common Vulnerability and Exposure (CVE)
A publicly available database of known
computer security issues, each noted with a unique identifying number
PrintNightmare (CVE-2021-34527)
Initially reported as a minor local privilege escalation
vulnerability, this CVE was upgraded to a critical Remote Code Execution vulnerability a few
weeks later. Several patches were published before the mitigation was found acceptable,
though many systems are still presumed vulnerable.
EternalBlue (CVE-2017-0144)
A server Message Block vulnerability discovered by the NSA
and stolen by an APT known as the Shadow Brokers. The NSA reportedly knew about this
vulnerability for months before notifying Microsoft after discovering the breach.
Supply Chain Attack
An attack that generally leverages other supporting software, devices,
or components from less secure providers to exploit larger, more secure companies. An
example would be installing a rootkit in a driver that is part of a chat app used by a Fortune
500 company rather than directly attacking it
Powershell Empire
A suite of tools that helps penetration testers exploit local networks
using the built-in capabilities of Powershell on the victim system.
Zero Trust
A security framework and mindset that presumes all data and communication
within the organization’s security perimeter is malicious or compromised.
Identity & Access Management (IAM)
A framework of policies, procedures, and tools that
facilitate control over who accesses what. Physical tokens, Microsoft Authenticator, Active
Directory, Azure AD, and many other tools all fall under the offerings by Microsoft to help
facilitate Zero Trust.
Security Incident Event Management (SIEM)
A broad term that refers to software
deployed throughout an enterprise network to aggregate event logging and produce alerts
based on configuration performed by the Security Operations Center (SOC).
Extended Detection & Response (XDR)
Installing regular security updates and patches is
extremely important to ensuring data security
Data Loss Prevention (DLP)
Practices and programs deployed to prevent unauthorized
sharing of sensitive information in the business through various methods
Hardening
An all-encompassing term used to describe tools, controls, and processes used
to increase infrastructure security.
User Configuration
Ensuring proper password rules and user setup is critical to server
security (and, for the most part, required in modern server software). The System
Administrator (“Sysadmin”) will use Active Directory in a Windows Enterprise environment.
Role and Feature Configuration:
This is one of the first server configurations to set up
once installed. The important thing to do in this step is to enable those roles and features
that are needed and disable those that are not.
Update Management
Installing regular security updates and patches is critical to ensuring
data security.
Network Time Protocol (NTP)
Servers that don’t maintain strict time accuracy are in
danger of breaking configurations that rely on real-time alignment with other systems, such
as Kerberos. NTP is the protocol used to ensure this accuracy
Firewall Configuration
Ensuring only the necessary ports are open (such as 80 and 443
for a web server) helps reduce possible angles of attack for hackers
Event Logging
Your SIEM platform needs data to be effective. Configuring your event logs
to focus on the essential data (avoid the firehose as much as possible) will help the SOC
focus on those events that truly need investigation and mitigation
Secure Score
Rating of an initial (Windows) system configuration’s overall security provided
by Microsoft Defender Advanced Threat Protection (ATP) service.
