Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Operating Systems Software Windows

NIST Issues Windows XP Security Guide 253

Posted by michael from the step-1:-reformat dept.
routerwhore writes "NIST Special Publication 800-68 (zip file) has been created to assist IT professionals, in particularly Windows XP system administrators and information security personnel, in effectively securing Windows XP systems. It discusses Windows XP and various application security settings in technical detail."
This discussion has been archived. No new comments can be posted.

NIST Issues Windows XP Security Guide More

NIST Issues Windows XP Security Guide

Comments Filter:

  • isolate (Score:4, Funny)

    by xOleanderx ( 794187 ) on Tuesday July 06, 2004 @12:35PM (#9623383)
    Step one: Isolate from network.

    • Re:isolate (Score:2, Interesting)

      by Anonymous Coward
      not really...

      step one is to get a competent admin that will install from a slipstreamed install CD. all of mine are slipstreamed with SP2 so all patches up ot now are included and the machine is not instantly owned on the corperate network. ANYONE installing XP or W2K from origional CD's is nuts. slipstream the patches. My W2K disks are up to the SP4 rev and have all hotfixes on the disk ready for the scripted install after first reboot. and the XP disks are ready to go as well..

      Yes, it's a pain in th

    • Re:isolate (Score:5, Informative)

      by BrookHarty ( 9119 ) on Tuesday July 06, 2004 @12:51PM (#9623579) Journal
      Actually, that is pretty important as theres is no Service Pack 2 XP Cd out. If you install on an open Internet connection, you can be infected before you download the updates. Even our work lan wasnt protected, soon as I plugged my laptop in for updates it was infected, and I had to clean it off. (Ya, ya, zone alarm....) I guess the default XP firewall turned on would at least be some protection.

      I think its worth picking up a cheap network router or wireless router so you can have NAT firewall to filter your PC. 802.11b routers are on sale for 20 bux that have NAT built in. Pretty cheap, and then you can update your PC before it gets infected.

      I have all service packs merged into my Win2k on CD, but WinXP only has the default SP1 without the updates for a year. So, the unplug or firewall your Internet connection is pretty important.

      • Quick way to get the post-SP1 pre-SP2 updates (Score:5, Informative)

        by semifamous ( 231316 ) on Tuesday July 06, 2004 @12:55PM (#9623623)
        Quick way to get the post-SP1 pre-SP2 updates:

        AutoPatcher [autopatcher.com]

        This is a good thing if you need to reinstall Windows soon before SP2 comes out.

        Even after SP2 comes out and it shrinks in size, the features it allows you to change are great.

      • Re:isolate (Score:4, Insightful)

        by eean ( 177028 ) <slashdotNO@SPAMmonroe.nu> on Tuesday July 06, 2004 @01:09PM (#9623781) Homepage
        At my .edu they decided that our firewall would protect us from Blaster. Didn't take them long to figure out how wrong they were.

        Firewalls assume they're aren't malicious things happening on your side of it.
        • Firewalls assume they're (sic) aren't malicious things happening on your side of it.

          Might I suggest that you preprend the words "Poorly configured" to that sentence? A well-administered firewall assumes *anything* going through it is potentially malicious.
          • You misunderstand. Anyone carrying a laptop from home and plugging it into your network ir circumventing the firewall, no matter how well configured it is. What is need is firewalling at each port of a switch. At the very least, laptop users can be placed into a VLAN of their own, probably as part of the WLAN opeartion, so that they can only readily infect each other.

            • Re:isolate (Score:3, Insightful)

              by eean ( 177028 )
              Then the students bring their computers back from the summer.

              Making a campus LAN not a dangerous one is impossible. You have to assume worms are going to get in.
              • Even on a campus LAN, you can make a heavily firewalled segment for doing things like configuring freshly installed Windows machines.
                • We are doing something like this in the summer. All the dorms are going to be on their own segment. The new cisco routers should give us a lot of power. But its still my belief that the underlying assumption should be that a LAN that's any more public then your home network is hostile. Each computer needs to be able to defend itself ultimately.

            • Re:isolate (Score:3, Insightful)

              by Scutter ( 18425 )
              You misunderstand.

              No, I understand perfectly, but protecting an internal network is not the firewall's job. The firewall's job is to act as a gatekeeper to traffic passing through it wherever it's placed in the network. What you are proposing is a fundamental change in network design, of which the firewall is only a very small part. VLAN's, proxy servers, etc. all play a part in securing an internal network. It doesn't make sense to place the blame for an insecure internal network at the feet of a sin
      • I think its worth picking up a cheap network router or wireless router so you can have NAT firewall

        Which unfortunately does you little good with our wonderful wireless routers having backdoors in them. I don't use Linux regularly, but where I do use it, is as my firewall. I've never trusted a Windows box to be on the net and these days, I don't trust the wireless routers. I'm sticking with my old Linux box. It's just an old cheap PII, and the power consumption is probably a bit high for a router, but it w
        • >Which unfortunately does you little good with our wonderful wireless routers having backdoors in them.

          A NAT with a backdoor will still help you quite a bit. Sure, someone can get in your box with some effort...but any old worm trying to infect your machine will be effectively stopped.

          Depending on your situation, the chances of someone try to manually hack your box are zilch. Not a good excuse for bad security...but still.

      • Allow me to second this. Two weeks ago, I gave one of my old computers to a friend of mine as a replacement for her broken notebook. The system had SuSe 9.0 installed when I gave it to her but she wasn't comfortable at all with it, and since she had a term paper due, I agreed to install Windows XP for her.

        So, I set the system up (quick'n'dirty install since I was in a rush) and hook her 56k modem up to at least install a decent, up-to-date virus scanner, SP1 and some critical updates. The computer was supp

      • oh come on, it's easy:
        1. unplug network
        2. install XP
        3. enable ICF (firewall)
        4. plug in network
        5. install updates
      • Even our work lan wasnt protected, soon as I plugged my laptop in for updates it was infected...

        I think you need to have a frank discussion with whomever manages your firewall.

    • Re:isolate (Score:2, Funny)

      by DarkMantle ( 784415 )

      Step 2: install 3 popup blockers, 4 spyware utilities, and 5 Antivirus programs, 3 firewalls, and make sure it's behind a good external firewall, get all windows updates on a CD to install them offline.

      Step 3: Keep off network

  • Especially for those of us who have mixed LANs at home. This was the first I had heard of a way to disable 445, the replacement Netbios port (even if it's a convoluted way to do it).

    • Re:Looks very usefull at first glance (Score:5, Informative)

      by mst76 ( 629405 ) on Tuesday July 06, 2004 @12:47PM (#9623524)
      Especially for those of us who have mixed LANs at home. This was the first I had heard of a way to disable 445, the replacement Netbios port (even if it's a convoluted way to do it).
      There is plenty of information around if you know the [google.com] right [google.com] queries [google.com].
      • Yeah- assuming you knew that Microsoft was using port 445 in the first place for that purpose, you could google it.

        That's one of two problems I have with google- not knowing the terms I want to learn about and information overload once I do have the terms. Which only makes it moderately usefull for protecting against security holes that I don't know about to begin with. I had only heard about 445 last week, thus this article is usefull to me. I'm sorry if it's not usefull to you to have this much inform
        • But of course the first thing you did was to run nmap and Nessus against your shiny new XP box and then search on the ports that they found.

          Or maybe I'm just a freak.....

          But yea info and lots of it in one place is a *very* good thing. But it sounded like the grandparent knew it was there did not like it and had done nothing and was all out of ideas.

          Or like I said maybe I'm just a freak...
    • >This was the first I had heard of a way to disable 445, the replacement Netbios port (even if it's a convoluted way to do it).

      What's wrong with using a firewall? Or a NAT?

    • Re:Looks very usefull at first glance (Score:5, Interesting)

      by Azghoul ( 25786 ) on Tuesday July 06, 2004 @02:28PM (#9624669) Homepage
      This is probably going to seem like flamebait, but I'm honestly curious: Does anyone else feel it's odd, at best, to have a government agency telling us all how to safely operate a private company's product?

      Just seems weird to me, but I guess it happens in other industries as well...

  • 147 pages! (Score:4, Funny)

    by w1r3sp33d ( 593084 ) on Tuesday July 06, 2004 @12:37PM (#9623417)
    Easy broken down into 9 littler chapters for those MCSE's still out there.

    • " Easy broken down into 9 littler chapters for those MCSE's still out there."

      Or, nine PowerPoint bullets for the pointy-haired bosses still out there.

  • Linux is complex? (Score:4, Funny)

    by TheVidiot ( 549995 ) on Tuesday July 06, 2004 @12:39PM (#9623435) Homepage

    Only 147 pages of reading to secure your Windows XP?!? And they say Linux requires an in-depth knowledge of the OS...

    • Re:Linux is complex? (Score:2, Informative)

      by databyte ( 321386 ) *
      Not all of it is related solely to security.
      • Section 1 - Introduction (15-16)
      • Section 2 - Windows XP Security Guide Development (17-32) about general networking guidelines and how this guide came to be
      • Section 3 - Windows Security Components Overview (33-38) with summary notes on the last page (38), the rest was features and footprint
      • Section 4 - Installation, Backup, and Patching (39-48) consists of advise on running Windows Update, using strong passwords, etc. Notes are again, on the last page.
      • Section

  • Actually has some good points (Score:5, Informative)

    by grunt107 ( 739510 ) on Tuesday July 06, 2004 @12:41PM (#9623450)
    There are some areas around the registry and memory dump settings that could be useful (how many actually send MS their abend dumps?), shutting remote access, and pointing out the usage and benefits of a firewall. When it comes to internet downloads/emails, though, the standard "Don't open unknown emails/attachments" still abounds. Rather lengthy - could do w/o the graphs and standard defs.

  • Total Cost of Ownership thru the roof (Score:5, Funny)

    by hey ( 83763 ) on Tuesday July 06, 2004 @12:47PM (#9623529) Journal
    Wow, changing all those settings really bumps up the Total Cost of Ownership (TCO) of Windows!
    • Well most people dont do this over and over again on each and every machine. That is we have GPOs (Group Policy Objects), scripting, and tons of third party apps. All those settings were done at my end once, and i update them at the release of every service pack. For security the amount of time i waste is barely nothing
  • I've only kept my XP box around for games, movies, and entertainment. If I have to do something that needs to be secure I either use mac osx or linux. I try to avoid the IE browser except when reading webcomics or news and I do online banking far away from IE but I'm not worried about that cause I'm pretty sure my money is still federally insured under a plan that I forgot its name. I like XP for games and that is about it so far besides movies. I just hope SP2 doesn't ruin compatibility to some of my o

  • Reminds me of Bastille linux (Score:5, Insightful)

    by mentatchris ( 585868 ) on Tuesday July 06, 2004 @01:00PM (#9623689) Journal
    I just briefly read thru that document. It is an excellent read. Lots of the things they mention are fairly well known, but to have it all grouped together in a comprehensive document is a real godsend. Reminds me A LOT of bastille linux [bastille-linux.org].
    There is a huge advantage to have predefined profiles you can apply. I imagine myself using these security profiles to harden family member's PCs. I usually have neither the time nor the inclination to lock down my mother's computer.... so having some defaults and a quick checklist will save me a TON of time in the long run.
    It's also nice to be able to send someone a link and tell them "Do this stuff" rather than walk them thru all the things they need to do to be safe. As I am sure most Slashdot readers have experienced, the unending number of tech calls from friends and family gets old after a little while. I think this document will help restore the free time that Uncle Bill has taken from me.

    • Re:Reminds me of Bastille linux (Score:4, Interesting)

      by Anonymous Coward on Tuesday July 06, 2004 @01:16PM (#9623870)
      The problem with Linux is all the non-orthogonal options, and trying to figure out how they interact. To wit,
      • standard "chmod" permissions
      • extended attribute "chattr" permissions
      • bastille linux on top of the above
      • access control lists
      • Kerberos
      • Pam
      • selinux
      • ssh
      • beecrypt
      • sasl
      • a dozens more miscellaneous options and utilities.
      I wish there would be a unified solution. There are various bits of overlap, and the permutations of the above lead to quite a bit of complexity. Of course, as far as I know XP is not one bit simpler.
      • The Bastille Linux of which the grandparent spoke is not a distribution. It is a hardening script that is designed to implement the Linux Security HOWTO. There are versions of it for all major distributions. Bastille gives you sane security base on which to starting building a server or workstation.

        What you're asking for isn't all that reasonable. Linux can be used for a myriad of purposes so all that stuff wouldn't necessarily be installed. It is possible to automate quite a bit of security for say h

      • Re:Reminds me of Bastille linux (Score:4, Informative)

        by vadim_t ( 324782 ) on Tuesday July 06, 2004 @02:37PM (#9624760) Homepage
        Many of those have nothing in common. Please at least do some reading on this stuff.

        Bastille was a script that tweaked things for you last time I checked. It does nothing you can't do by editing config files and using chmod if you know how.

        ACLs are approximately a WinNT-like permission system for Linux.

        selinux goes MUCH further, adding capabilities that didn't exist before, making it possible to precisely specify what a process is supposed to do and what not. While quite complicated, it allows doing nifty things.

        PAM has an unique purpose - handling authentication. If you want your users to use a smartcard or a fingerprint reader, that's what you need.

        ssh is an encrypted telnet (simplifying things a bit)

        sasl is an encryption library, beecrypt is another.

        kerberos is an authentication method - which has absolutely nothing to do with things like filesystem permissions.

        So, where are those interactions you talk about? SeLinux with all its power has nothing to do with encryption and doesn't replace it. Different encryption libraries don't conflict with each other and in most cases users don't even need to deal with them. PAM could be said to be related to SeLinux a tiny bit, but they do very different things. SeLinux handles permissions, while PAM defines how users are authenticated to the OS. Kerberos is just a protocol.

  • I'd read through that.... (Score:5, Funny)

    by nukem1999 ( 142700 ) on Tuesday July 06, 2004 @01:04PM (#9623721)
    but I'm not supposed to download unknown zip files on my Windows machine.

  • "in effectively securing Windows XP systems" (Score:4, Funny)

    by Alexis de Torquemada ( 785848 ) on Tuesday July 06, 2004 @01:05PM (#9623732)
    There are already a lot of people who can do this. Well, without the first blank, that is.
  • Great free tool to deploy security updates if you complement it with a few VBScripts to check the status of the GPO and to force deployement...
    Too bad version 2 which will support Office, IIS and SQL patches keeps getting delayed..

  • "effectively securing Windows XP systems" (Score:3, Funny)

    by WarMonkey ( 721558 ) on Tuesday July 06, 2004 @01:10PM (#9623782)

    effectively securing Windows XP systems

    That's the great thing about Slashdot -- timely reviews of only the very best science-fiction literature.

  • Free Windows Security Update CD (Score:4, Informative)

    by not_hylas( ) ( 703994 ) on Tuesday July 06, 2004 @01:11PM (#9623801) Homepage Journal
    http://www.microsoft.com/security/protect/cd/order .asp

    See? Wasn't that easy?
    • Not so much. I tried to order the CD from Mozilla on my FreeBSD workstation and it told me I don't have cookies enabled. The website switches from www.microsoft.com to oms.one.microsoft.com and complains about no cookies being set. Strange.

  • I'm being double charged (Score:3, Insightful)

    by maximilln ( 654768 ) on Tuesday July 06, 2004 @01:15PM (#9623862) Homepage Journal
    Glad to know that my taxpayer dollars not only go to subsidize their schooling and subsidize their certification programs but also to generate a nice neat HOWTO manual for them to do their jobs.

    No wonder there's so many pencils stuck in the ceiling.
  • From Mark Pilgrim's How to install Windows XP in 5 hours or less [diveintomark.org]:

    1. Back up entire d: drive to iMac upstairs. rsync rocks.
    2. Find Windows XP install disc.
    3. Reboot with Windows XP install disc.
    4. Asked for product activation. Curse Microsoft.
    5. Search my house in vain for my original, 100% legitimate, retail Windows XP box.
    6. Reboot.
    7. Search control panels in vain for a window, dialog, tab, or pane that displays my current product key.
    8. Search Google for "windows xp get current product key".
    9. Find a utility on a cracker web page in Russia that displays the current product key. This is one of the more lame utilities, since most of the good ones allow you to change it. I don't wish to change it; I actually have a perfectly good product key, I just don't know what it is.
    10. Reboot with Windows XP install disc.
    11. Reboot repeatedly as required.
    12. Boot screen. Choose between "Windows XP Professional" and "Windows XP Professional". Brilliant. Pick one. The wrong one. Boot into fucked Windows XP install. Hard reboot. Pick the right one. Make mental note to hack boot.ini later.
    13. "Welcome to Windows XP. You have no useful programs and no internet access. You have 30 days left for activation. Would you like to activate now?" Yes, I would, but I have no internet access.
    14. Unnecessarily loud and cheerful startup noises. Make mental note to turn off all sounds later.
    15. Search the "Network and Internet Connections" wizards in vain for some way to set up my Linksys wireless card. Having never done a clean install of XP (I previously upgraded from Windows 2000), and having been moderately impressed by the new wireless networking features in XP, I naively assumed this would "just work". Silly rabbit.
    16. Search my house for my Linksys wireless card driver install disc. Find the install disc that came with the old card, that broke and was replaced by the new-and-improved version 3.0 card. Wonder if that will suffice.
    17. Fight with the "Add New Hardware Wizard" trying to install the obviously inferior drivers off this disc.
    18. Wonder where the "Device Manager" is hiding.
    19. Find the "Device Manager". Right-click on the unknown device, "Linksys_Instant_Wireless_Card". Update driver. "Windows was unable to locate a driver for this device. Would you like to search on the internet?" Yes, I'd love to, but I can't, you moron. Install driver from specific location. Specify WIN2000 folder on old-and-inferior install disc.
    20. "This driver is not digitally signed." OK.
    21. "This driver may cause your computer to become unstable." OK.
    22. "This driver may anally rape your mother while pouring sugar down your gas tank." OK.
    23. Nothing. No connection, no internet access, no acknowledgment of any device whatsoever.
    24. Reboot.
    25. Doesn't work.
    26. "Take a tour of Windows XP!" I am.
    27. Reboot.
    28. Doesn't work.
    29. Dig out old wired PCMCIA card. Take computer upstairs. Plug directly into switch. cmd. ipconfig. We have an IP address. ping www.google.com. We have name resolution and internet access.
    30. Fire up Internet Explorer. runonce.msn.com. No. www.linksys.com. Support. Downloads. WPC11. Windows XP. Linksys.com rocks.
    31. Insert Linksys wireless card.
    32. Back to Device Manager.
    33. Uninstall old-and-inferior driver.
    34. Update driver.
    35. "This driver is not digitally signed." OK.
    36. "This driver may cause your computer to become unstable." OK.
    37. "This driver may&#133;" OK.
    38. cmd. ipconfig. We have internet access.
    39. "Add your .NET Passport to Windows XP!" No.
    40. Fire up Internet Explorer. www.msn.com. No. www.mozilla.org. Download Mozilla.
    41. Realize I should create an "f8dy" user because it will make my life easier later.
    42. Create "f8dy" as an administrator. Log out. Log in.
    43. Install Mozilla. Yes, I would like to make you my default

    • Re:How to install Windows XP in 5 hours or less (Score:2, Funny)

      by Anonymous Coward
      There's two more steps

      148. System continually bluescreens on boot.
      149. Go to step 1
    • Good God man, wouldn't finding a freaking Linux CD be easier?

    • Missing step 148. (Score:4, Insightful)

      by Tenebrious1 ( 530949 ) on Tuesday July 06, 2004 @01:33PM (#9624067) Homepage
      147. Search Google for "apache 2.0 win32?. Download. Install. Copy and paste custom stuff into httpd.conf. Restart Apache service.

      148. GHOST MACHINE. Never have to reinstall again.

      • Re:Missing step 148. (Score:2, Insightful)

        by Agilo ( 727098 )
        Wrong, because by the time you've ghosted, and are installing another machine, oh, say, half a year later, it turns out there's 80 new patches available on Windows Update, and Apache has been cracked to shits, thus requiring updates, and, well, just about the same for a whole lot of programs.
        Then once you have installed that, go ahead, ghost it again, but it's an viscious circle if you ask me.

        This'll be really wortless if you ghost the image to a DVD/CD, waist of DVD/CD in my opinion.

        Then again, I don't u

        • Re:Missing step 148. (Score:5, Informative)

          by dmaxwell ( 43234 ) on Tuesday July 06, 2004 @02:19PM (#9624579)
          Think lineage of image here. If you're making a new image or install, it will still be easier to start from an image you made 9 months ago than to start from an XP cd. All the little desktop tweaks will be the way you like them and you'll only have 12 or so patches and 3 reboots rather than 47 or so and 7 reboots. Not only that, a good deal of your software won't have changed. You'll be saved some work there as well.

          I finished new OS 9 images for some Macs I maintain (I know, I know but it has to be this way.) I didn't start from an OS 9.0 cd and patch it up to 9.2.2 + add a boatload of apps. I installed last year's image, made changes and then created a new image. I still saved a considerable amount of work and thumb twiddling watching progess bars.
        • Wrong, because by the time you've ghosted, and are installing another machine, oh, say, half a year later, it turns out there's 80 new patches available on Windows Update, and Apache has been cracked to shits, thus requiring updates, and, well, just about the same for a whole lot of programs.

          Insightful? Jeez, moderators need to get a clue.

          How long does it take to install 40 some apps? How long to customize each app the way you like? About four days worth of customization; I know, as a systems integrato
    • Sucker, he could have installed $DISTRO and used the extra 4.5 hours saved to get the XP Tour and SP1 running in Wine! :)
    • Five hours!!! that's a bit optimistic isn't it???
    • If you had ready the XP deployment tools, you could have created a winnt.sif file (plain text, manually edited) which placed on a floppy disk in the drive, or in /i386 on the windows install disk (need WinISO and nero do to this) automates the install and allows you to specify classic theme, classic start menu, not installing msn messenger or explorer or wordpad or games or other crap..

      Oh and you can slipstream the disk with SP1 to save a LOT of time downloading too. I'm typing this from a clean install wh
    • Don't forget to read the EULA. In it you'll find out you aren't allowed to install an IMAP server, SMTP server, or apache server for non-local connections. It's right there [clendons.co.nz] on page 1.

  • ... before it's too old for the front page. Probably a good idea to read before heading straight to the zip file.

    guidance_WinXP.html [nist.gov]

  • Great document (Score:2, Interesting)

    by glass_window ( 207262 )
    Going along the lines of the earlier slashdot story
    (http://slashdot.org/article.pl?sid=04/07/0 6/12172 43&mode=thread&tid=146&tid=188&tid=192&tid=99)
    I wish my college prof threw out the books for class and asked us to use stuff like this, it has everything the books had in it, and it covers it so much better.
  • I happen to work at NIST and I'm on the Gaithersburg, MD campus right now. Perhaps reading this article can be considering reading slashdot and working at the same time?
  • and I thought the gentoo handbook was a long read.

  • NSA's guide or NIST's? (Score:4, Insightful)

    by Danathar ( 267989 ) on Tuesday July 06, 2004 @02:25PM (#9624636) Journal
    Since NSA already has a guide for Securing WinXP...which part of the government is authoritative on recommendations?

    Here is the link to the page for NSA's Windows XP security Guide (And others)

    http://www.nsa.gov/snac/downloads_winxp.cfm?Menu ID =scg10.3.1.1

  • zerg (Score:3, Informative)

    by Lord Omlette ( 124579 ) on Tuesday July 06, 2004 @06:18PM (#9627172) Homepage
    For any part that says "disable unused services", don't forget to check out XP Service Config Guide [blackviper.com] by Black Viper.

Slashdot Top Deals

You know you've landed gear-up when it takes full power to taxi.

Close