Lesson 8A Configure Workstation Security Flashcards
Password Best Practices
Effective user security depends on strong credential management, effective account policies, and best practice end-user behavior.
Password Rules
Make passwords sufficiently long-12+ character length is suitable for an ordinary account user.
Administrative passwords should be longer.
Choose a memorable phrase, but do not use any personal information- Anything that a threat actor could discover or guess should not be used in a password.
Complexity Requirements
Expiration Requirements
Complexity requirements-Rules designed to enforce best-practice password selection, such as minimum length and use of multiple character types.
Expiration Requirements- Rules designed to enforce best-practice password use by forcing regular selection of new passwords.
BIOS/UEFI Passwords
Passwords set in system firmware to prevent unauthorized booting of a computer (user password) or changes to system setup (supervisor password).
End User Best Practices
Log off when not in use
A lunchtime attack is where a threat actor is able to access a computer has been unlocked.
Secure/protect critical hardware (such as laptops)
Users must also be alert to the risk of physical theft of devices. Portable computers can be secured to a desk using a cable lock.
Secure personally identifiable information (PII) and passwords
Paper copies of personal and confidential data must not be left where they could be read or stolen. A clean desk policy ensures that all such information is not left in plain sight.
Account Management
Policies are used to determine what rights and privileges each employee should be assigned. These policies should be guided by the principle of least privilege.
Restrict User Permission(2 types)
File permissions control whether a user can read or modify a data file or folder, either on the local PC or across the network.(Permissions are only modified by data owners or file server administrator.
Rights or privilege control what system configurations changes a user can make to a PC.
Change Default Administrator Account and Password
The new password must be treated with highest level of security available. Any use of the default administrator account must be logged and accounted for. Using this account for sign-in should be an unusual event that generates an alert.
Disable Guest Account
A guest account allows unauthenticated access to the computer and may provide some sort of network access too.
only enabled to facilitate passwordless file sharing in a Windows workgroup
Account Policies
Enforcing requirements as controls imposed by the OS. Which can be enforced via Security Policy snap-in(secpol.msc)
Restrict Log-in Time
Used to prevent an account from logging in at an unusual time of day or night, or during the weekend.
Failed Attempt Lockout
Allows a maximum amount of attempts prior to the computer locking out.
