Application Security
sbadugula
winsec_ppt08_l031.pdf
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Strategies Windows
Platforms and Applications
Lesson 3
Protecting Microsoft Windows Systems
Page 2Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Learning Objectives
Set up encryption in a given organization to secure
Windows environment.
Install controls to protect a given Windows system
from malware.
Page 3Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Key Concepts
Setting BitLocker and file, folder, and volume
level encryption
Setting up secure communication protocols
Security certificate
Public key infrastructure (PKI)
Installing antivirus and anti-spyware software
Maintaining a malware free Windows system
Scanning and auditing Windows systems
Tools and techniques for malware cleanup
Page 4Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Chapter 4 Slides
Chapter 4: Microsoft Windows Encryption
Tools and Technologies
Page 5Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encryption Methods Microsoft
Windows Supports Microsoft Windows access controls depend on
subjects using Windows to access secured objects
Attacker can boot another operating system,
bypassing access controls
Need defense in depth
Encrypt files, folders, and volumes
Windows-encrypted files cannot be booted in to
another operating system
Windows stores decryption keys
Page 6Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Methods to Encrypt Stored Data
Encrypting File
System (EFS)
Bitlocker Drive Encryption
Bitlocker to Go
Page 7Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Object Properties Page
Page 8Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Server Manager—Features
Page 9Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Install New BitLocker Feature
Page 10Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Confirm BitLocker Installation
Page 11Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Completed BitLocker
Installation
Page 12Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Object Properties—Advanced
Attributes: Enabling EFS
Page 13Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Enabling BitLocker
Page 14Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
BitLocker Management Tool
Page 15Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
BitLocker Authentication Options
Page 16Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Enabling BitLocker To Go
Page 17Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encrypted Data Transmission
Page 18Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Secure Web Application
Connection
Page 19Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encryption Protocols in Windows
Secure Sockets Layer (SSL) or Transport
Layer Security (TLS)
Virtual private network
• Internet Protocol Security (IPSec) with
Layer 2 Tunneling Protocol (L2TP)
• Point-to-Point Tunneling Protocol (PPTP)
• Secure Socket Tunneling Protocol (SSTP)
Page 20Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encryption Protocols in Windows (Continued)
• Wireless Security
• Wired Equivalent Privacy (WEP)
• Wi-Fi Protected Access (WPA)
Page 21Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Virtual Private Network (VPN)
Page 22Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encryption Algorithms
• Same key to encrypt and decrypt
• Faster
• Difficult to distribute keys Symmetric encryption
• Private and Public keys for encryption and decryption
• Slower
• Easy to distribute keys
Asymmetric encryption
(Public key)
Page 23Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Security Certificates
Solutions to balance encryption algorithms
strengths
• Use asymmetric encryption to exchange a
symmetric key.
• Use symmetric encryption after key exchanges
further messages.
Security certificate
• Use identity information in addition to public key
for encryption.
Page 24Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Server Certificates
Purchase a certificate
• Use Internet information server (IIS) to
request a server certificate.
• Send request to issuer.
• Import purchased certificate into IIS.
Page 25Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Server Certificates (Continued)
Create your own using Active Directory
certificate services
• Use IIS to create a self-signed certificate.
• Export the certificate from IIS.
• Import the certificate to each client.
Page 26Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
PKI
General approach to handling keys
• Uses trusted entities and certificates
Trusted entity—Certificate Authority (CA)
Page 27Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
PKI (Continued)
To set up a connection:
• Get a certificate from a CA for the
connection target.
• Decrypt the certificate using the CA’s public
key.
• The decrypted certificate contains the public
key of the connection target.
Page 28Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Practices for Implementing Encryption in
Windows
Change passwords at least every six months
Do not write down passwords
Export recovery keys to removable media
Store EFS or BitLocker recovery information in a separate, safe location
Encrypt the My Documents folder for all users
Never encrypt individual files; always encrypt folders
Have two or more recovery agent accounts per organizational unit.
Page 29Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Practices for Implementing Encryption in
Windows (Cont.)
Designate two or more computers for recovery
Avoid using print spool files
Use multifactor authentication when using BitLocker on operating system volumes
Store recovery information for BitLocker in Active Directory Domain Services
Disable standby mode for portable computers that use BitLocker
Require strong passwords for all VPN connections
Page 30Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Practices for Implementing Encryption in
Windows (Cont.)
Use the strongest level of encryption that your situation allows for VPNs
Use SSTP for VPNs when possible
Disable SSID broadcasting for wireless network
Never use WEP for wireless networks—only use WPA/WPA2
Trust only certificates from CAs or trusted sites
Page 31Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Chapter 5 Slides
Chapter 5: Protecting Microsoft Windows
Against Malware
Page 32Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Purpose of Malware
Gain unauthorized
access
Gather sensitive
information
Disrupt computer operations
Page 33Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Types of Malware
• Virus: infects other programs
• Worm: self-contained program
Programs that spread
• Trojan horse: masquerades as a useful program
• Rootkit: modifies programs to hide its presence
• Spyware: covertly collects information
Programs that hide
• Ransomware: slows down the computer, encrypts files, or restricts acesss until a payment has been made
Programs that generate funds
Page 34Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
How Malware Spreads
Opening infected e-mail messages
Opening infected documents
Over the network and via e-mail address
books
Page 35Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
How Malware Spreads (Continued)
Following unknown links
• Images
• Embedded links in e-mail messages
• Social media abbreviated links
Page 36Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Antivirus and Anti-Spyware
Software
Antivirus software
Detects and mitigates many types of malware
Focuses on viruses, worms, and Trojan horses, but may also address rootkits and spyware
Anti- spyware software
Detects and mitigates malware
Uses multiple anti-spyware software products to ensure most spyware is detected
Page 37Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Procedure for Protecting
Computers
To be effective:
• Keep antivirus/anti-malware software
and definition files up to date
• Periodically scan computers for malware
Page 38Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Resources for Developing
Malware Eradication Plan
Your anti-malware software’s support
resources
Microsoft’s online resources—specifically, the Microsoft Malicious Software Removal Tool
Page 39Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Malware Prevention Strategies
Frequent media scans
Multiple anti-malware software shields
Frequent signature database updates
Restrictive software installation policy
Restrictive download policy
Restrictive removable policy
Limited Web browser functionality
Don’t run in Administrator mode unless necessary
Page 40Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Summary
Setting BitLocker and file, folder, and volume
level encryption
Setting up secure communication protocols
Security certificate
Public key infrastructure (PKI)
Installing antivirus and anti-spyware software
Maintaining a malware free Windows system
Scanning and auditing Windows systems
Tools and techniques for malware cleanup
Page 41Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Virtual Labs
Configuring BitLocker and Windows
Encryption
Identifying and Removing Malware from
Windows Systems
Page 42Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
OPTIONAL SLIDES
Page 43Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Self-Signed Certificate
Create Certificate
Export Certificate
Import Certificate on
Clients
Page 44Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Encryption for Compliance
Many regulations mandate encryption for
transmitting sensitive data:
• Health Insurance Portability and Accountability
Act (HIPAA)–Private medical information
• Gramm-Leach-Bliley Act (GLBA)–Financial
information
• Payment Card Industry Data Security Standards
(PCI DSS)–Payment card information
• Multiple state laws–Personal information
Page 45Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company
www.jblearning.com
All rights reserved.
Secure Communications
Normal communication
protocols don’t use encryption
Network traffic can be seen
Network traffic can be viewed and
changed
Secure communication protocols use
encryption
Only someone with decryption key can
see message’s content
Different encryption options
are available
