The Computer Security Tool V4
The Computer Security Tool scans a computer to find weaknesses in the following security settings:
Guest Account - Disable |
|
Description: |
The "Guest" account is a default Microsoft Windows user account that allows anonymous users access to a computer. With the guest account enabled a user on another computer can freely gain access to any shared folders. |
|
|
Recommendation: |
The "Guest" account should be disabled if not in use. Making remote users authenticate with a user name and password is the preferred method for sharing files or folders on a computer. Warning: If you use the Guest account to share information, making it secure will block access to other users. It is possible to roll-back this change using the Computer Security Tool, or you can re-enable the Guest account via the Windows Control Panel, Users Icon. |
|
|
Benefit: |
Securing the Guest user account will restrict unauthorized users from getting access to shared files or folders on this computer. |
|
|
Important: |
The Guest user account on this computer will be disabled. Users of other computers who access resources on this computer as Guest will no longer have access. You will need to provide any such user with a specific account on this computer. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c).
Manually return the setting to its original configuration. |
|
|
|
|
Last User Name Display - Disable |
|
Description: |
A default installation of Microsoft Windows will display at the login screen the user name of the last user to access the computer. This can pose a security threat, especially if a user's password can be guessed from the user name. |
|
|
Recommendation: |
Do not display the user name of the last person to log into this computer. |
|
|
Benefit: |
A blank logon screen gives no information to a hacker about the person who last used the computer. |
|
|
|
|
Minimum Password Length |
|
Description: |
Short user account passwords can be easily guessed or "cracked". Hacking tools are available which brute force a password by guessing many hundreds of passwords per second. The longer and more complex a password (such as one that includes numbers or special characters) the more difficult a password is to crack. |
|
|
Recommendation: |
This issue should be secured so that passwords that are not a minimum length or passwords that are common (such as 12345 or qwerty) are rejected. |
|
|
Benefit: |
The use of longer passwords will make it more difficult for a hacker to guess or crack a password. |
|
|
|
|
Password on Resume Prompt |
|
Description: |
A password protected screen saver can be set to activate when a computer has not been in use for a defined period. This is particularly important for computers that are used in public places. |
|
|
Recommendation: |
Always use a password protected screen saver. The screen saver should activate within 15 minutes of the computer being last used. |
|
|
Benefit: |
A password protected screen saver will reduce the risk that unauthorized persons will use the computer when the keyboard when it is left unattended. |
|
|
|
|
Password Attack Prevention |
|
Description: |
Password Hashing is a method of securely storing passwords. It means that passwords are not stored as text, but are converted into a string of other string of characters. LAN Manager (LM) is one of the oldest authentication protocols that Microsoft has used, being first introduced for Microsoft Windows 3.11. In current times it is not very secure, having limitations such as a 142 character set. In more modern Operating System LAN Manager is included to allow backward compatibility with older system. |
|
|
Recommendation: |
LAN Manager password hashing should be disabled. |
|
|
Benefit: |
The risk of a hacker locating and using a password to gain access to the computer is reduced. |
|
|
|
|
Denial of Service (DOS) Attack Prevention |
|
Description: |
A default Microsoft Windows installation may be vulnerable to network Denial Of Service (DOS) attacks. A DOS attack is when a hacker attempts to block the access of a computer to the Internet or even shut down a remote computer system. |
|
|
Recommendation: |
The Computer Security Tool changes should implemented to make this system less vulnerable to DOS attacks. |
|
|
Benefit: |
Implementing this change makes the Windows Operating System more resistant to DOD attacks. |
|
|
|
|
Disable TCP/IP Port 445 |
|
Description: |
Among the new ports introduced in Windows 2000, Windows XP and Windows Server 2003, is port 445. It is difficult to describe the usage of Port 445 in simple terms. Essentially it is used by the Server Message Block (SMB) protocol for file sharing. It is also used for NetBIOS Services over TCPIP, described as NBT. When file sharing is required and NBT is enabled, a connection to the remote computer is tried simultaneously on both port 139 and 445. If there is a response from port 445, it continues its SMB session on port 445 only. If there is no response from port 445, it will continue its SMB session on port 139 if that responded. If there is no response from either of the ports, the session will fail. |
|
|
Recommendation: |
Many viruses have targeted port 445 and it is not commonly used. For this reason we recommend you secure it. On a small percentage of networks disabling port 445 may block access to some network devices. If this occurs it is possible to Rollback or Unsecure this setting. |
|
|
Benefit: |
Disabling port 445 gives greater protection against virus attack. |
|
|
Important: |
Disabling Port 445 may block access to other computers, printers or devices on a network. Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
NetBIOS Names Publishing Prevention |
|
Description: |
NetBIOS is a Microsoft network communication protocol used for such things a file and printer sharing. When NetBIOS is used the name of each computer on a network is published by default. |
|
|
Recommendation: |
NetBIOS names should not be unnecessarily communicated on a network. We recommend that this setting be made secure. |
|
|
Benefit: |
Securing this issue will reduce the risk that computer name information is available to a hacker. |
|
|
|
|
NULL Shares / Sessions - Disable |
|
Description: |
A "Null Session" connection is an unauthenticated connection to a Windows NT or 2000 computer. Gaining Null session access to a computer is the number one method for hackers to find out information about the computer they are planning to hack. |
|
|
Recommendation: |
Null sessions should be disabled. The Computer Security Tool will disable Null Sessions if you select the Secure action. |
|
|
Benefit: |
Securing Null Sessions will reduce the risk of unauthorized individuals obtaining information about system resources, accounts or sensitive information |
|
|
|
|
DCOM - Disable |
|
Description: |
Windows installs by default a rarely used component called Distributed Communication (DCOM). In recent times DCOM has been exploited by computer viruses. |
|
|
Recommendation: |
We recommend that DCOM be disabled (if you are not sure if DCOM is in use on your network contact your Network Administrator). The Computer Security Tool will disable DCOM if you select the Secure action. |
|
|
Benefit: |
Computer viruses exist that use DCOM vulnerabilities to propagate. By securing DCOM you will reduce susceptibility to virus attack. |
|
|
|
|
File Association: ".JS", ".JSE",
".KEY", ."PIF", ".REG", ".SCR",
".VBS", ".WSF" |
|
Description: |
File extensions are associated with specific programs so that files can be quickly and easily opened. For example, clicking on a .xls file will automatically open it in Microsoft Excel. A number of uncommon file extensions, including .js, .key, .pif, .reg, .scr, .vbs, .wsf and .jse are extensively used to propagate viruses and other malicious programs. These files are usually sent as email attachments. The text of the email is designed to trick the user into clicking the attachment which, because of file extension associations, automatically executes to distribute a malicious payload. |
|
|
Recommendation: |
The file extensions above should be associated with the Notepad.exe text editor to prevent accidental execution of malicious code. The Computer Security Tool will make this change. |
|
|
Benefit: |
Changing the file association of .js files will protect against the accidental or unintentional execution of a virus file or malicious program. |
|
|
|
|
Change "Everyone" to "Authenticated
Users" |
|
Description: |
Security in Microsoft Windows is assigned to users based on a group that a user belongs to. By default Microsoft Windows has a group called everyone. The "everyone" group refers to all users of the computer. |
|
|
Recommendation: |
The "everyone" user group should be disabled to prevent system resources being accessed by all users. The Computer Security Tool will remove the everyone group and ensure that only people with a valid user name and password are allowed to authenticate to the computer. This means that in order for a person to access this computer they will need a user name and password. This can be done in from the control panel Users icon. |
|
|
Benefit: |
Removing the "everyone" reduces the risk of unauthorized access to computer resources. |
|
|
Important: |
This task is for ADVANCED users only who are aware of the implications of removing the “everyone” group. This task will take approximately 1 hour to complete. If resources on this computer are shared with non authenticated users, removing the “everyone group” may block this access. |
|
|
|
|
SNMP - Disable |
|
Description: |
The SNMP Service supports remote device management on a network. |
|
|
Recommendation: |
The SNMP Service is rarely used and should be disabled on most systems. |
|
|
Benefit: |
The SNMP Service has no function on a stand alone system and if left running will use system resources and possibly allow unauthorized system access. |
|
|
|
|
Terminal Service - Disable |
|
Description: |
Terminal Services is a Windows program that allows a connection to a remote computer. Once connected you can use the computer remotely like you were sitting in front of it. Terminal Service is most often used by System Administrators to manage and make changes to remote computers across a network. |
|
|
Recommendation: |
If Terminal Services is not in use we recommend that it be disabled. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If Terminal Services is active, hackers may attempt to force access to it to gain control of your computer.
|
|
|
|
|
Wireless Configuration - Disable |
|
Description: |
Wireless configuration enables the wireless networking of computers (i.e. cables are not required to connect computers). |
|
|
Recommendation: |
Wireless configuration should be disabled if not in use. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If wireless communication is not used, making it secure will reduce the possibility of unauthorized connection to the computer. |
|
|
Important: |
Do not secure this item if the computer is part of a wireless network. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
Alerter Service - Disable |
|
Description: |
The Alerter Service is used by System Administrators. It allows a pop up window to display information messages to selected users. It is normally used to display messages such as a scheduled system shutdown. |
|
|
Recommendation: |
If administrative alerts are not required this Service should be disabled. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If the Service is enabled, alerts can be captured by unauthorized users to gain information about the state of the network. |
|
|
|
|
ClipBook Viewer Service - Disable |
|
Description: |
The ClipBook Viewer shows you the information you have copied to the Clipboard. You can store information permanently in your Local ClipBook and share it with other users. The Local ClipBook opens when you start ClipBook Viewer, C:WINDOWS\system32\clipbrd.exe. |
|
|
Recommendation: |
If the ClipBook Viewer is not used to share information then it should be disabled. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If a computer has a service which shares data, but that service is not used, disabling the service will increase the security of the computer. |
|
|
|
|
Fax Service - Disable |
|
Description: |
The fax Service provides a facsimile facility on the computer. |
|
|
Recommendation: |
If you are not running any fax software on your computer we recommend you disabled this Service. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
This Service consumes unnecessary resources on the computer if it is enabled but not in use. |
|
|
|
|
Messenger Service - Disable |
|
Description: |
This Service allows an individual on the network to send pop-up messages to another user on the network. |
|
|
Recommendation: |
Many spammers are currently using this Service to popup advertising on your computer. Windows NT Messenger Service should be disabled if not required. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
This feature allows a network user to display a pop up Window on another computer. It may be used by an attacker as a means to request and collect confidential information from other users. |
|
|
|
|
Net Logon Service - Disable |
|
Description: |
The Net Logon Service processes Domain logon requests. A Domain is a network of computers controlled by a server (usually known as the Primary Domain Controller). |
|
|
Recommendation: |
Net Logon is not required if a Domain is not used on your network. Most home users or small networks do not use a domain. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Disabling the Net Logon Service reduces the risk that unauthorized logins can be made to the computer through the use of illegitimate credentials. |
|
|
Important: |
Do not turn off this Service if settings on this computer are administered by a server known a Domain controller. If you are unsure if this computer is part of a Domain, contact your Network Administrator. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
NetMeeting Service - Disable |
|
Description: |
NetMeeting is a Microsoft program that allows to participation in real time interactive conferences. |
|
|
Recommendation: |
If Net Meeting is not in use we recommend that it be disabled. |
|
|
Benefit: |
Disabling Services that are not required gives a computer more resistance to attack. |
|
|
|
|
Network DDE Service - Disable |
|
Description: |
DDE (Dynamic Data Exchange) enables two running programs to share the same data. For example, DDE makes it possible to insert spreadsheet data into a Word document. When the data in the spreadsheet changes, the data in the document also changes. The Network DDE Service provides network transport and security if DDE is performed between remote computers. |
|
|
Recommendation: |
This Service should be disabled if DDE is not used between remote computers. If this Service is disabled, any Services that explicitly depend on it will fail to start. If you use the ClipBook Viewer to share data with remote computers then do not disable this Service. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If this Service is not disabled, DDE transport and security will be available.
|
|
|
|
|
Network DDE DSDM Service - Disable |
|
Description: |
This Service manages the Dynamic Data Exchange (DDE) network shares. If this Service is stopped, DDE network shares will be unavailable. |
|
|
Recommendation: |
This Service should be disabled if DDE network shares are not used. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If this Service is not disabled, DDE network shares will be visible to unauthorized users. |
|
|
|
|
NT LM Security Support Provider Service -
Disable |
|
Description: |
NT LM Security Support Provider is a service that helps with backward compatibility and authentication with older Microsoft operating systems such as windows 3.1, 95 and 98. |
|
|
Recommendation: |
As this Service is not often used we recommend you disable it. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If this Service is left active there is an increased risk that it can be used for unauthorized purposes. |
|
|
|
|
Remote Desktop Help Session - Disable |
|
Description: |
Remote Desktop Help is a Windows feature which allows a remote person on another computer to have access to your computer to help you with tasks. Once connected the remote user can see and use your Windows desktop as if he/she was sitting at the keyboard. |
|
|
Recommendation: |
If Remote Desktop help is not required we recommend that it be disabled. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
If Remote Desktop is left active there is an increased risk that it can be used for unauthorized purposes. |
|
|
|
|
SSDP Discovery Service - Disable |
|
Description: |
The SSDP Discovery Service is used to find Universal Plug & Play devices on a network. |
|
|
Recommendation: |
If you do not use Plug & Play devices on your network then this service is nor required. |
|
|
Benefit: |
Unless you are using Universal Plug and Play Services the SSDP Discovery Service would unnecessarily use system resources and possibly allow unauthorized system access. |
|
|
|
|
Telephony Service - Disable |
|
Description: |
The Telephony Service provides support for programs that use telephony devices, such as PABXs, IP voice connections, dialup modems and in some cases DSL modems. |
|
|
Recommendation: |
Disable this Service if any of the above Dialup connections not in use. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Unused network Services provide an attacker a potential avenue of access and should be kept to a minimum. |
|
|
Important: |
The Telephony Service provides support for programs that use telephony devices, such as PABX’s, IP voice connections, dialup modems and in some cases DSL modems. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
Telnet Service - Disable |
|
Description: |
Telnet is a means of connecting to a remote computer. It is a "terminal emulation" program that is usually used by system administrators to connect to device such as a router or mainframe across a network. |
|
|
Recommendation: |
If you do not use Telnet you should disable the Service. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Telnet traffic is transmitted in clear text, including user ID and passwords. It also carries the risk that an attacker monitoring network traffic may be able to view, modify and/or delete files and cause harm to the system. If a Telnet type Service is required we recommend the use of Secure Shell (SSH) instead as it encrypts all data before sending. |
|
|
|
|
Workstation Service - Disable |
|
Description: |
The Workstation Service is required for all network connections.
|
|
|
Recommendation: |
IMPORTANT: Only disable the Workstation Service if it is a stand-alone computer not connected to a network or the Internet. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Security vulnerabilities exist for the Workstation Service. It can allow unauthorized code to be run at the system privileges. However, disabling this Service may block network and Internet access. |
|
|
Important: |
Do not disable the Workstation Service unless this is a stand alone computer that is not connected to the Internet or to a network. Disabling this Service will block Internet and Network access. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
Computer Browser Service - Disable |
|
Description: |
This Service maintains an updated list of computers on the network and supplies this list to computers designated as browsers. If this Service is stopped, this list will not be updated or maintained. |
|
|
Recommendation: |
This Service is not required by a home computer. You will still be able to browse your Network workgroup and mapped network shares if disabled. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Disabling Services that are not required gives a computer more resistance to attack. |
|
|
Important: |
If you disable the Computer Browser Service access to the Internet or to other computers in a network may no longer be available. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
Remote Registry Service - Disable |
|
Description: |
Remote registry enables anonymous access to a Windows computer's registry. The registry is a very sensitive part of the Windows Operating System. Many parts of the registry hold information on the configuration of your computer. A Sample of information stored in the registry are all the Security Settings for your computer. |
|
|
Recommendation: |
We recommend that the Remote registry should be disabled if it is not used. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Securing the Remote Registry Service decreases the possibility that an attacker can read or modify registry contents from a remote computer. |
|
|
|
|
Uni Plug and Play Service - Disable |
|
Description: |
The UPnP Service is a default Service on the Windows Operating System. UPnP traffic is introduced on Windows 2000 and Windows 9x systems when you install MSN Messenger. Unless a custom MSN Messenger install is performed, each system will start transmitting UPnP packets as soon as it boots. The packets are an indication to a hacker that the system is ready, willing, and able to accept incoming traffic on TCP port 5000 and UDP ports. |
|
|
Recommendation: |
UPnP should be disabled. The Computer Security Tool will disable this Service if you select the Secure action. Services can be restarted by re-scanning the computer and selecting the Rollback action, or re-start a Service manually using the Control Panel Administrative Tools icon. |
|
|
Benefit: |
Disabling UpnP will stop sending unnecessary information about your computer over the network. |
|
|
|
|
Spyware Ad Blocking |
|
Description: |
The Hosts file contains the mappings of IP addresses to host names. This file is loaded into memory at startup, then Windows checks the Hosts file before it queries any DNS servers, which enables it to override addresses in the DNS. This prevents access to the listed sites by redirecting any connection attempts back to the local machine. Another feature of the HOSTS file is it's ability to block other applications from connecting to the Internet, as long the entry exists. |
|
|
Recommendation: |
You can use a HOSTS file to block ads, banners, cookies, web bugs, and even most hijackers. This is accomplished by blocking the Server that supplies them. Example - the following entry 127.0.0.1 ad.doubleclick.net blocks all files supplied by the Double-Click Server to the web page you are viewing. This also prevents the server from tracking your movements. If you are experiencing problems accessing some web sites check to make sure they haven't been blocked in your HOST file. |
|
|
Benefit: |
Using a Host file will limit Ads and Spyware from known Internet Advertisers being received on your computer. |
|
|
|
|
OS/2 Subsystem Remove |
|
Description: |
Legacy OS/2 subsystems are installed by default. These subsystems are no longer required for normal operation of a Windows computer and should be removed. |
|
|
Recommendation: |
As it is very rarely used the Legacy OS/2 subsystems should be secured using the Computer Security Tool. |
|
|
Benefit: |
Legacy OS/2 subsystems are unnecessary and use valuable system resources. |
|
|
|
|
POSIX Subsystem Remove |
|
Description: |
Legacy POSIX subsystems are installed by default. These subsystems are no longer required for normal operation of a Windows computer and should be removed. |
|
|
Recommendation: |
As it is very rarely used the Legacy POSIX subsystems should be disabled using the Computer Security Tool. |
|
|
Benefit: |
Legacy POSIX subsystems are unnecessary and use valuable system resources. |
|
|
|
|
Windows Admin File Share - Disable |
|
Description: |
Windows 2000 and XP have hidden Administrative shares enabled by default. They are prime targets for attack, especially as most users leave the 'Administrator' account active with a weak password. As these shares are not readily visible, it leads many users to believe that they have no shares active, giving them a false sense of security. Further, password lockouts do not apply to these shares making it possible for a hacker to "brute force" the password. |
|
|
Recommendation: |
You should disable default Windows shares. The Computer Security Tool will remove all hidden shares from your computer. To re-enable, re-scan the computer and select the Rollback action. |
|
|
Benefit: |
Disabling Administrative shares blocks a common method used by hackers to access a system. |
|
|
|
|
Windows CD Autorun - Disable |
|
Description: |
When a CD/DVD or removable disk is inserted into the drive the Autorun feature automatically begins playing the CD/DVD. On Windows Operating system the CD/DVD Autorun is enabled by default. This could enable an unauthorized person who is otherwise locked out of a computer to execute a program directly from a CD/DVD. |
|
|
Recommendation: |
The Autorun feature for the DVD/CD should be turned off if it is not required. The Autorun feature can be re-enabled by re-scanning the computer and selecting the Unsecure action. |
|
|
Benefit: |
If the Autorun feature is left on, it is possible that a hacker could create a malicious program that would run when a CD/DVD was inserted. |
|
|
|
|
Windows Simple File Sharing - Disable |
|
Description: |
The default security mode in Windows XP does not give a user complete control over who has access to shared files and resources on their system. Simple File Sharing allows anonymous accessed to shared files and folders. |
|
|
Recommendation: |
Disable simple file sharing. This will mean that other computers must authenticate before they are given access to a shared file or folder.
|
|
|
Benefit: |
Disabling Simple File Sharing increases the security of shared files and folders. If Simple File Sharing is not disabled, shared folders will not be password-protected and may allow anonymous users and/or viruses access into the computer. |
|
|
Important: |
If you use Microsoft's Simple File Sharing to share files and folders, disabling this setting will stop this access. NB: Once you have made a security change you can: a). Use the 'Rollback' action to return a setting to its prior status; b). Use the 'Unsecure' action (if available) to return a setting to the default Windows installation status; or, c). Manually return the setting to its original configuration. |
|
|
|
|
Initiate Windows Update |
|
Description: |
System updates and patches are released by software vendors to patch security weaknesses in their software. |
|
|
Recommendation: |
System updates and patches should be verified as authentic (check the software vendor website) and installed. The Computer Security Tool will open the Windows Update website. At this website you should select scan and load all relevant patches. This should be done regularly. |
|
|
Benefit: |
If software updates and patches are not installed your computer may be open to known vulnerabilities. |
|
|
|
|
Page File Clearing at Shutdown |
|
Description: |
A Page File is used by Windows as additional temporary memory. When the computer runs out of RAM (Random Access Memory) it uses the page file on the hard disk as an additional storage area. This is sometimes referred to as "Virtual Memory". The Page File can contain sensitive information (eg. user names and passwords). The file is not cleared by default on Windows Shutdown |
|
|
Recommendation: |
The Windows Page File should be cleared upon shutdown of the computer (particularly for computers that are not physically secure). The Computer Security Tool will set the page file to clear at shutdown. |
|
|
Benefit: |
By clearing the Windows Page File at system shutdown it reduces the risk that confidential information will be left unsecured on the hard drive. |
|
|
|
|
Password Protect Screen Saver |
|
Description: |
When the computer switches to screen saver mode it is possible to enable a password to return to windows. This can protect your computer from unauthorized access while you are away from the area. |
|
|
Recommendation: |
A password protected screen saver should be automatically activated when a computer is not in use for a defined period of time. |
|
|
Benefit: |
A computer with a password protected screen saver will stop unauthorized people from using the computer when it is left unattended. |
|
|
|
|
Windows Update - Enable |
|
Description: |
System updates and patches are released by software vendors to patch security weaknesses in their software. |
|
|
Recommendation: |
System updates and patches should be verified as authentic (check the software vendor website) and installed. CSR will set the windows update to automatic. This will automatically check for new patches. This should be done regularly. |
|
|
Benefit: |
If software updates and patches are not installed your computer may be open to known vulnerabilities. |
|
|
|
|
Dump File Auto Creation - Disable |
|
Description: |
A dump file is created when the Windows Operating System or a software application crashes. Dump file creation is enabled by default. |
|
|
Recommendation: |
Dump file creation should only be enabled when required for troubleshooting purposes. |
|
|
Benefit: |
By disabling dump file creation it reduces the risk that confidential information will be left unsecured on the hard drive. |
|
|
|
|
MSN Messenger - Remove |
|
Description: |
MSN Messenger is a Microsoft program that allows a user to chat with other users on the Internet. |
|
|
Recommendation: |
If you do not use MSN Messenger, remove it from your computer. |
|
|
Benefit: |
MSN Messenger can make the computer susceptible to popups or unsolicited advertisements. |
|
|
Important: |
This will remove MSN Messenger from your computer. To re-enable MSN Messenger you will have to reinstall the application. |
|
|
|
|
Run Key Permission Change |
|
Description: |
The 'Run' registry key enables programs to run upon successful login. The permissions (who has access to make changes) on the Run registry key allows write access by all users. |
|
|
Recommendation: |
The 'Run' registry key should be updated so that it can be used only by those users with Administrative access. The Computer Security Tool will set the permission on this key as per the above. |
|
|
Benefit: |
Unauthorized change to a registry key could create system instability and/or create problems during the system start-up process. A hacker or virus could take advantage of the run key to load a dangerous program every time you start your computer. |
|
|