Lesson 8A Configure Workstation Security Flashcards
Password Best Practices
Effective user security depends on strong credential management, effective account policies, and best practice end-user behavior.
Password Rules
Make passwords sufficiently long-12+ character length is suitable for an ordinary account user.
Administrative passwords should be longer.
Choose a memorable phrase, but do not use any personal information- Anything that a threat actor could discover or guess should not be used in a password.
Complexity Requirements
Expiration Requirements
Complexity requirements-Rules designed to enforce best-practice password selection, such as minimum length and use of multiple character types.
Expiration Requirements- Rules designed to enforce best-practice password use by forcing regular selection of new passwords.
BIOS/UEFI Passwords
Passwords set in system firmware to prevent unauthorized booting of a computer (user password) or changes to system setup (supervisor password).
End User Best Practices
Log off when not in use
A lunchtime attack is where a threat actor is able to access a computer has been unlocked.
Secure/protect critical hardware (such as laptops)
Users must also be alert to the risk of physical theft of devices. Portable computers can be secured to a desk using a cable lock.
Secure personally identifiable information (PII) and passwords
Paper copies of personal and confidential data must not be left where they could be read or stolen. A clean desk policy ensures that all such information is not left in plain sight.
Account Management
Policies are used to determine what rights and privileges each employee should be assigned. These policies should be guided by the principle of least privilege.
Restrict User Permission(2 types)
File permissions control whether a user can read or modify a data file or folder, either on the local PC or across the network.(Permissions are only modified by data owners or file server administrator.
Rights or privilege control what system configurations changes a user can make to a PC.
Change Default Administrator Account and Password
The new password must be treated with highest level of security available. Any use of the default administrator account must be logged and accounted for. Using this account for sign-in should be an unusual event that generates an alert.
Disable Guest Account
A guest account allows unauthenticated access to the computer and may provide some sort of network access too.
only enabled to facilitate passwordless file sharing in a Windows workgroup
Account Policies
Enforcing requirements as controls imposed by the OS. Which can be enforced via Security Policy snap-in(secpol.msc)
Restrict Log-in Time
Used to prevent an account from logging in at an unusual time of day or night, or during the weekend.
Failed Attempt Lockout
Allows a maximum amount of attempts prior to the computer locking out.
Concurrent Logins
Determines how many computers an individual should be allowed to log in at a time.
Use timeout/screenlock
Locks the Desktop whenever the system detects no user-activity.
Execution Control
Process of determining what additional software may be installed on a client or server beyond its baseline to prevent the use of unauthorized software.
Trusted/Untrusted Software Sources
restrict the ability of users to run unapproved program code, especially code that can modify the OS, such as an application installer.
Administrator and Standard user accounts, along with User Account Control (UAC) and system policies, to enforce these restrictions.
AutoRun and AutoPlay
-when an optical disc is inserted or a USB drive is attached, Windows would automatically run commands defined in an autorun.inf
-Windows mechanisms for automatic actions to occur when a peripheral storage device is attached.
Windows Defender Antivirus
Security scanner installed and enabled by default in Windows that provides protection against general malware types.
Windows Defender Firewall
Implements a personal/host firewall to filter inbound and outbound network traffic.
Port Security
Application Security
Address
Port Security
triggers are based on the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) port number used by the application protocol.
Application security
triggers are based on the process that listens for connections.
Address triggers
Are based on the IP or FQDN of the server or client hosts
Firewall can be accessed via:
wf.msc the firewall can be turned on or turned off, and you can switch the default policyfor inbound and outbound traffic.
Allow or Block
Encrypting File Systems
Microsoft’s file-level encryption feature available for use on NTFS.
To apply encryption: Open the file’s/folder’s properties sheet and select advanced. Check the encrypt content box.
Windows Bitlocker
BitLocker can be used with any volumes on fixed (internal) drives. It can also be used with removable drives in its BitLocker To Go form.
Windows Bit Locker cont.
When the data is encrypted, the user must have access to the encryption key to access it. BitLocker can make use of a trusted platform module (TPM) chip in the computer to tie use of a fixed disk to a particular motherboard.
