Re: What server hardening are you doing these days?

From: Justin F. Knox (jknox_at_indexzero.org)
Date: 11/12/05

  • Next message: Ansgar -59cobalt- Wiechers: "Re: On the topic of Windows Hardening" 
    Date: Fri, 11 Nov 2005 20:12:05 -0500
To: focus-ms@securityfocus.com

    First off, I have to say that this is one of the more attention getting
    threads I've seen in a while here. This got my attention because I'm in
    the process of fleshing out the Windows server configuration standard
    for my employer. I've been reading most of the guides that have flown
    through this thread, and they're valuable resources, so I figure I'll
    add one I've found:

    http://www.microsoft.com/technet/security/topics/serversecurity/serviceaccount/default.mspx
    ^^ that's "The Services and Service Accounts Security Planning Guide,"
    and it has a place in my hardening toolkit.
    it completely reinforces the concept of least privilege, and gives
    excellent guidance in deriving what kind of account is needed for
    specific occasions.

    As far as people being concerned with hotfixes causing their hardened
    servers to implode: I've found that VMware's product line is ideal for
    building out a lab on a budget. I'm using VMware workstation combined
    with the P2V Assistant to create a complete virtual lab of my production
    network. I can test patches in a sandbox without having to worry about
    having an impact on production. Other tools -- sysinternals.com,
    filemonNT, regmonNT, process explorer and their ilk are fabulous for
    tracking what is happening and what apps need what privileges.

    hope that somone finds my post helpful -- I've found quite a bit of nice
    info in this thread already :)

    --Justin

    Laura A. Robinson wrote:

    >Very well put, Mike. I think that when people haven't looked at the guides,
    >they may not realize that the bulk of what is in them is informative rathter
    >than a simple "do this...do that" set of instructions. I personally believe
    >that anybody who is touching Win2K3, claims interest in security, yet hasn't
    >read the Microsoft Security Guidance documents should spend a few days with
    >those guides before making any proclamations. One can't speak to that which
    >one does not yet know. :-)
    >
    >Laura
    >

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Ansgar -59cobalt- Wiechers: "Re: On the topic of Windows Hardening"

    Relevant Pages

    • Re: The end is in sight
      ... pays for itself--as opposed to being subsidized by, say, a North Sea ... a country can be socialist without "public ownership of the means of production". ... You think that any POTUS uses an HMO, or collects Social Security in their old age? ... You need to pay more attention to indentations. ...
      (sci.electronics.design)
    • Re: The end is in sight
      ... a country can be socialist without "public ownership of the means of production". ... You need to pay more attention to indentations. ... Do you think that any POTUS uses an HMO, or collects Social Security in their old age? ...
      (sci.electronics.design)
    • Re: Shame on Microsoft
      ... "it's something that has been missed for a decade in security ... inspections of the OS done by both Microsoft and hackers trying to exploit ... > Just in case the point Jonathan was making slipped past your attention... ... >>> Microsoft to have such serious holes in their software. ...
      (microsoft.public.security)
    • Re: Internet Security
      ... Security /is/ an end in itself and you do have to bother with it, ... apps in the world, has been deceiving all of its millions of users for years ... I indeed DO pay attention to security -- ... the extent of my interaction with it will be to monitor my PC ...
      (microsoft.public.windowsxp.general)
    • Re: MAC policies and shared hosting
      ... as much attention as I'd like. ... that the TrustedBSD project seemed very 'closed' in that the ... I think also the MAC framework is perceived as being too difficult ... But I'm trying to come up with a reasonable balance between security and convenience. ...
      (FreeBSD-Security)
    • Quantcast