551 Symbols A
Total Page:16
File Type:pdf, Size:1020Kb
Johansson_Index.qxd 4/27/05 9:31 AM Page 551 INDEX Symbols access control lists. AdAware, 412 802.1X See ACLs Address Resolution applying, 272-282 accounts Protocol (ARP) enforcement, 298 administrative security, attacks, 270-271 218-222 addresses A IDS, 52 ranges, 34-36 acceptable use policy lockout, 385 spoofing, 190-191 (AUP), 122 logon events, 384 administration access passwords, 344 attachments, 408-410 anonymous restrictions, services, 421 Help, 151-152 369-372 ASR (attack surface passwords, 225-228, 307 controls (physical reduction), 418-420 applying, 317-325 security), 165-168 dependencies, 222 attacks, 326-332 GUIs, 60 mitigating, 223-228 configuring, 536-539 LUA (least user securing, 427-434 passgen tool, 529-539 access), 398 SRPs (software storage, 307-316 masks, 503 restriction policies), patches remote, 198-200 366-367 advanced techniques, restrictions, 253-257, 264 ACKnowledge packets, 38 97-100 rogue ACLs (access control lists), as risk management, applying 802.1X, 353, 493 83-84 272-282 best practices, 509-513 AU/WSUS, 94 enabling IPsec, layers, 507-509 automatic updates, 94 283-294 security descriptors, building test bed, layer 2/3 protection, 495-506 88-90 269-271 ACS (Audit Collection definition of, 81, 83 network quarantine Services), 458 EMS (enterprise systems, 296-300 active administrative management system), preventing, 267 dependency, 218 95-96 sniffing, 267-268 active attacks, 7 MBSA (Microsoft Web, 198-199 active-automated attacks, 8 Baseline Security active-manual attacks, 9 Analyzer), 93 551 Johansson_Index.qxd 4/27/05 9:31 AM Page 552 552 Index need for, 79-80 agent recovery, 176 applications security update tools, AH (Authentication analyzing, 415-416 91-93 Header), 286 ASR (attack surface selection of, 96 ALE (annualized loss reduction), 418 slipstreaming, 101-108 expectancy), 119 blocking unnecessary testing security Alerter service, 418 interfaces, 420 updates, 85-87 algorithms, troubleshoot- disabling unnecessary penetration testing, ing, 485 features, 419 28-31 analysis uninstalling rights systems, 513-517 environments, 415-416 unnecessary risk, 113, 118-119 Exchange Server Best components, 418-419 security, 135-136 Practices Analyzer data-protection administrator Tool, 454 mechanisms, 517-518 responsibilities, 18 existing systems, 512 exposed (on hosts), 39 dependencies, 218-222 hacking, 72-73 functionality mitigating services, MBSA (Microsoft restricting browser, 223-228 Baseline Security 402-407 receiving feedback, Analyzer), 93 turning off, 400-402 14-20 penetration testing, 24, hiding, 357 usability, 16-18 28-31 LUA (least user vendor design security needs, 118-128 access), 398 tradeoffs, 19-20 threats, 244, 246, 248 patches, 41, 395-398 system administration, annualized loss expectancy security 135-136 (ALE), 119 baselining systems, administrator password anonymous connections 469-470 policy (APP), 122 (null sessions), 50 evaluating, 467 administrators, 220 anonymous restrictions, reviewing, 471-474, passwords, 536-539 369-372, 384 477-487 responsibilities, 18 anti-malware, 379 servers, 417 ADS (Automated anti-spyware software, 450 services, 421-426 Deployment antivirus policy (AVP), 123 small businesses Services), 101 antivirus software, 450 applying anti-spyware/ Advanced Encryption API (application antivirus software, 450 Standard (AES), 176 programming configuring firewalls, adware, 450 interface), 55 451-453 AES (Advanced APP (administrator controlling automatic Encryption password policy), 122 updating, 449 Standard), 176 application-filtering updating, 448-449 agent-based enumeration, 92 firewalls, 194-195 spyware, 411 Johansson_Index.qxd 4/27/05 9:31 AM Page 553 Index 553 states, 41 hacking multifactor structure of, 42 analyzing, 72-73 authentication, updates, 96 cleaning attackers, 346-348 version information, 40 74-76 overview of, 305-307 Web, 441 detecting initial policies, 345 applying compromise of, physical security, 168 802.1X, 272-282 43-45 SQL Servers anti-spyware/antivirus elevating privileges, customizing, 435 software, 450 46-50 IIS (Internet firewalls, 192-198 footprinting networks, Information IPsec, 283-294 34-43 Services), 441 passwords, 317-325 null sessions, 50-57 troubleshooting, 482 security guides, 362 taking over, 59-71 Authentication Header ARP (Address Resolution passwords, 326-332 (AH), 286 Protocol) attacks, penetration testing, authenticity, 187 270-271 28-31 authorization, 283 ASR (attack surface reflection, 230 automated attacks, 7 reduction), 418-420 spoofing, 190-191 Automated Deployment assessment of penetration target networks, 32 Services (ADS), 101 tests, 24 types of, 7, 9-10 Automatic Update. See associations (security), 283 AU (Automatic Update), AU; updates attachment management, 94, 449 availability, 187-189, 519 408-410 Audit Collection Services avoiding attack surface reduction (ACS), 458 hacking, 521 (ASR), 418-420 auditing, 377 viruses, 13 attackers, Warez, 47 CrashOnAuditFail, 386 AVP (antivirus policy), 123 attacks enabling, 384-385 awareness of security, ARP (Address full privilege, 386 128-129, 149-150 Resolution Protocol), AUP (acceptable use 270-271 policy), 122 B cached credentials, 331 authentication, 283 back-end servers, structure casual attackers, 5 challenge-response of, 42 cross-site scripting, 479 transactions, 229-234 baselining damage (types of), 10, 13 LAN Manager, 375, 383 MBSA (Microsoft DDoS (Distributed mutual, 279 Baseline Security DoS), 188 passwords, 303-305 Analyzer), 93 detecting, 150 applying, 317-325 performance, 90 DoS (denial-of-service), attacks, 326-332 systems, 469-470 188, 243 best practices, 334-344 batching patches, 100 elevation-of-privilege, 243 management, 307-316 Johansson_Index.qxd 4/27/05 9:31 AM Page 554 554 Index beds (patch test), building, caches, 244 clients (businesses) 88-90 California law SB 1386 information, storing on Bell-LaPadula model, 225 (public disclosure), 120 servers, 455-458 best practices call detail record protecting PCs, 169-172 ACLs (access control (CDR), 115 clients (networks) lists), 509-513 cardinal points, 102 password policies, 382 Exchange Server Best casual attackers, 5 quarantine, 297 Practices Analyzer CDR (call detail security tweaks Tool, 454 record), 115 anonymous passwords, 334 CERNIC (China Education restrictions, 384 account lockout, 344 and Research blank passwords, 383 disabling LM hashes, Network Information enabling auditing, 335-336 Center), 184 384-385 protecting cached certificates, 284 LAN Manager credentials, 334-335 Certified Information authentication, 383 selection, 337-344 Systems Security limiting malicious Bill Payer service, 216 Professional code, 377-378 black-box tests, 30 (CISSP), 225, 494 removable media, 385 blocking challenge-response SafeDllSearchMode, ICMP echoes, 38 transactions, 229-234 379-382 spyware, 527-528 Character Map tool, 476 SMB message unnecessary characters, passwords, signing, 383 interfaces, 420 307-308, 311-316 VPN, 208 borders, connecting China Education and Clustering Service, 317 routers, 190-191 Research Network clusters, 251 browser functionality, Information Center CMAK (Connection restricting, 402-407 (CERNIC), 184 Manager buffers, troubleshooting, 483 circuit proxies, 195 Administration building circumvention Kit), 300 patch test beds, 88-90 vulnerabilities, 137 code slipstreamed installation CISSP (Certified malicious, 377-378 points, 102-108 Information Systems worms, 13 built-in shares, 510 Security Professional), Cold Fusion Expression 225, 494 Evaluator, 417 C classification systems components CA Unicenters, 95 (security policies), 127 quarantine systems, cached credentials, cleaning attackers, 74, 76 297-300 315-316 clearing virtual RMS (Rights attacks, 331 memory, 387 Management disabling, 386 cleartext data, trou- Services), 516-517 protecting, 334-335 bleshooting, 484 Johansson_Index.qxd 4/27/05 9:31 AM Page 555 Index 555 uninstalling, 418-419 SQL Server network threat modeling unused (turning off customizing processes, 237-238 functionality), 400 authentication, 435 access restriction, compromising networks, dropping stored 253-257, 264 cleaning attackers, procedures, 436-438 documentation, 74-76 hardening, 426-427 238-248 computation, LM hash, 309 securing service segmentation, 248-251 computers accounts, 427-434 passwords (administrators), dealing with stolen, supportability, 416 536-539 173-179 Connection Manager replicating, 88 family (physical Administration Kit security, 114 security), 180 (CMAK), 300 analyzing security protecting (physical connections needs, 118-128 security), 169-172 anonymous (null creating awareness of, small businesses sessions), 50 128-129 applying anti-spyware/ border routers, 190-191 enforcing, 130 antivirus software, 450 outbound, 264 failure of, 116 configuring firewalls, controls false information about 451-453 access (physical guides, 354-363 controlling automatic security), 165-168 identifying threats, 117 updating, 449 remote, 201-202 modifying, 129 protecting, 447-448, cracking, 327-331 necessity of, 115 464-465 CrashOnAuditFail, 386 structure of, 114-115 updating software, credentials tools, 387-391 448-449 cached, 315-316 troubleshooting, 483 conclusions of penetration attacks, 331 SQL Server testing, 29 protecting, 334-335 customizing confidentiality, 178, 185 caches, 386 authentication, 435 configuration critical updates, 83 dropping stored audit settings, 377 cross-site scripting, 45, 479 procedures, 436-438 firewalls for small crypto algorithms, hardening, 426-427 business, 451-453 troubleshooting, 485 securing service passwords (administrators), customization accounts,