System Hardening, Auditing, and Logs Flashcards
What does a firewall do
Blocks network traffic based on rules
How to bring up the Windows Firewall GUI
wf.msc
Command in CMD to interact with Windows Firewall
netsh
Cmdlet in Powershell to pull information about Windows Firewall
Get-NetFirewallRule
Windows Firewall Service Registry Path
HKLM\SYSTEM\CurrentControlSet\services\MpsSvc
Executable hosting the Windows Firewall Service
svchost.exe
Windows Firewall Service hosted DLL
mpssvc.dll
3 Windows Firewall Profiles
Private, Public, Work/Domain
How many profiles can be active on an interface at one time?
Multiple
Windows Firewall Logging is configured where?
Within each profile
NTFS
New Technology File System
Each file in NTFS has a what?
Security Descriptor
The Security Descriptor can include?
SID, DACL. SACL
SID
Security Identifiers
DACL
Discretionary Access Control List
Describe what a SID is
A Security Identifier for the owner
Describe a DACL
A Discretionary Access Control List that specifies the access rights (read,write,execute,delete) allowed or denied to particular users or groups
SACL
System Access Control List
Describe a SACL
A system Access Control List that specifies the types of access attempts that generate audit records for the object
How to modify permissions within the GUI
Right Click -> Properties -> Security
Command to modify permissions in CMD
icacls
Command to modify permissions in Powershell
Get-Acl
Sysinternals tool to modify permissions
accesschk
WRP
Windows Resource Protection
WFP
Windows File Protection
Windows Resource Protection in XP
Windows File Protection (WFP)
Windows File Protection (WFP) features
Watched for system file overwrite attempts
Checked file signature against known good
If bad, replaced with a copy from system32/dllcache folder
Additional features of Windows Resource Protection (WRP)
Will keep protected files from being installed to begin with, rather than just overwriting them
Protected Resources can only be modified by Windows Module Installer service (TrustedInstaller.exe)
Can also protect system registry keys
Executable for Windows Module Installer service
TrustedInstaller.exe
Location where WRP Backups are stored
%Windir%\winsxs\Backup
WRP Security Implications
Unable to overwrite protected files while Windows is running
Still able to mount drive into another OS and overwrite them
Look for drivers installed by 3rd Party to compromise
With Administrator privilege, can alter the configuration to allow modification
UAC
User Account Control
What does UAC do?
UAC limits the privileges of user run applications, even when run as Administrator, to prevent the modification of system files, resources, or settings. Requesting elevated privileges requires explicit acknowledgement from the user.
Does UAC apply to all executables?
No, there are some Windows executables that can “auto elevate” without a prompt
Waht kinds of files does WRP not protect?
pdf, doc,
UIPI
User Interface Privilege Isolation
Describe UIPI
UIPI is part of UAC
Each process is given a privilege level
UIPI - Explain abilities of Higher integrity level
Higher integrity level can send messages to lower level integrity
UIPI - Explain abiliteis of Lower integrity level
Lower integrity can only read Higher
How can UIPI be bypassed?
Can be bypassed by signed and trusted applications with the UIaccess manifest setting
IA
Information Assurance
What is IA?
IS the practice of assuring information and managing risks related to the use, processing, storage, and transmission of information or data and the systems and processes used for those purposes.
IA protects what?
the Integrity, Availability, Authenticity, Non-Repudiation, and Confidentiality of user data
Information Security goal
Preservation of Confidentiality, Integrity, and Availability of information
CIA Triad
Confidentiality, Integrity, and Availability
Information Security primary focus
Technical Security mechanisms
Describe Host-based Security Products
Runs local on the machine, only concerned with that machine. OS dependent, version dependent. Some install as a service. Many new versions are cloud based.
Types of Host-based Security Products
System Firewalls Process Monitoring, kernel calls Directory Monitoring System Setting/Registry monitoring Log monitoring Authentication, Authorization, Accounting (AAA) Application Whitelisting
Describe Network Security Products
Monitors traffic across the wire
Can be inline or passive
Inline often modifies traffic between destination and source
Types Network Security Products
Network Firewalls Intrusion Detection System(IDS) Intrusion Prevention System (IPS) Web/Application Proxy VPN Concentrator
