NIST Issues Windows XP Security Guide

routerwhore writes "NIST Special Publication 800-68 (zip file) has been created to assist IT professionals, in particularly Windows XP system administrators and information security personnel, in effectively securing Windows XP systems. It discusses Windows XP and various application security settings in technical detail."

Comments

isolate

[xOleanderx]

Step one: Isolate from network.

Re:isolate

[BrookHarty]

Actually, that is pretty important as theres is no Service Pack 2 XP Cd out. If you install on an open Internet connection, you can be infected before you download the updates. Even our work lan wasnt protected, soon as I plugged my laptop in for updates it was infected, and I had to clean it off. (Ya, ya, zone alarm....) I guess the default XP firewall turned on would at least be some protection.

I think its worth picking up a cheap network router or wireless router so you can have NAT firewall to filter your PC. 802.11b routers are on sale for 20 bux that have NAT built in. Pretty cheap, and then you can update your PC before it gets infected.

I have all service packs merged into my Win2k on CD, but WinXP only has the default SP1 without the updates for a year. So, the unplug or firewall your Internet connection is pretty important.

Looks very usefull at first glance

[Marxist Hacker 42]

Especially for those of us who have mixed LANs at home. This was the first I had heard of a way to disable 445, the replacement Netbios port (even if it's a convoluted way to do it).

Re:Looks very usefull at first glance

[mst76]

Especially for those of us who have mixed LANs at home. This was the first I had heard of a way to disable 445, the replacement Netbios port (even if it's a convoluted way to do it).

There is plenty of information around if you know the right queries.

Re:Looks very usefull at first glance

[Azghoul]

This is probably going to seem like flamebait, but I'm honestly curious: Does anyone else feel it's odd, at best, to have a government agency telling us all how to safely operate a private company's product?

Just seems weird to me, but I guess it happens in other industries as well...

147 pages!

[w1r3sp33d]

Easy broken down into 9 littler chapters for those MCSE's still out there.

Linux is complex?

[TheVidiot]

Only 147 pages of reading to secure your Windows XP?!? And they say Linux requires an in-depth knowledge of the OS...

Actually has some good points

[grunt107]

There are some areas around the registry and memory dump settings that could be useful (how many actually send MS their abend dumps?), shutting remote access, and pointing out the usage and benefits of a firewall. When it comes to internet downloads/emails, though, the standard "Don't open unknown emails/attachments" still abounds. Rather lengthy - could do w/o the graphs and standard defs.

Re:Page 1: For best security...

[xOleanderx]

Hopefully SP2 will fix many of these problems.

Total Cost of Ownership thru the roof

[hey]

Wow, changing all those settings really bumps up the Total Cost of Ownership (TCO) of Windows!

Re:Step one

[crimethinker]

You're only partly correct. If you put the windoze box behind a NAT, you won't get 0WN3D by all of the remote exploits, but that's only half of the solution. You're still vulnerable to virus-laden e-mails (especially if you use MS Outhouse) and malicious web pages (if you use IE).

Yes, you and I have a clue and use something else for mail and web, but most home users are not savy enough to switch away from the vulnerable products, and worms and viruses will continue to spread through these channels for some time to come.

-paul

Quick way to get the post-SP1 pre-SP2 updates

[semifamous]

Quick way to get the post-SP1 pre-SP2 updates:

AutoPatcher

This is a good thing if you need to reinstall Windows soon before SP2 comes out.

Even after SP2 comes out and it shrinks in size, the features it allows you to change are great.

Re:Quick way to get the post-SP1 pre-SP2 updates

[mattOzan]

Even better way to get all those hotfixes RIGHT ONTO YOUR CD, so you don't have to muck about with downloading updates and waiting for them to install: XPCREATE: The XP Distribution CD Creator with Hotfix Slipstreaming

Reminds me of Bastille linux

[mentatchris]

I just briefly read thru that document. It is an excellent read. Lots of the things they mention are fairly well known, but to have it all grouped together in a comprehensive document is a real godsend. Reminds me A LOT of bastille linux .
There is a huge advantage to have predefined profiles you can apply. I imagine myself using these security profiles to harden family member's PCs. I usually have neither the time nor the inclination to lock down my mother's computer.... so having some defaults and a quick checklist will save me a TON of time in the long run.
It's also nice to be able to send someone a link and tell them "Do this stuff" rather than walk them thru all the things they need to do to be safe. As I am sure most Slashdot readers have experienced, the unending number of tech calls from friends and family gets old after a little while. I think this document will help restore the free time that Uncle Bill has taken from me.

Re:Reminds me of Bastille linux

[Anonymous Coward]

The problem with Linux is all the non-orthogonal options, and trying to figure out how they interact. To wit,

• standard "chmod" permissions
• extended attribute "chattr" permissions
• bastille linux on top of the above
• access control lists
• Kerberos
• Pam
• selinux
• ssh
• beecrypt
• sasl
• a dozens more miscellaneous options and utilities.

I wish there would be a unified solution. There are various bits of overlap, and the permutations of the above lead to quite a bit of complexity. Of course, as far as I know XP is not one bit simpler.

Re:Reminds me of Bastille linux

[vadim_t]

Many of those have nothing in common. Please at least do some reading on this stuff.

Bastille was a script that tweaked things for you last time I checked. It does nothing you can't do by editing config files and using chmod if you know how.

ACLs are approximately a WinNT-like permission system for Linux.

selinux goes MUCH further, adding capabilities that didn't exist before, making it possible to precisely specify what a process is supposed to do and what not. While quite complicated, it allows doing nifty things.

PAM has an unique purpose - handling authentication. If you want your users to use a smartcard or a fingerprint reader, that's what you need.

ssh is an encrypted telnet (simplifying things a bit)

sasl is an encryption library, beecrypt is another.

kerberos is an authentication method - which has absolutely nothing to do with things like filesystem permissions.

So, where are those interactions you talk about? SeLinux with all its power has nothing to do with encryption and doesn't replace it. Different encryption libraries don't conflict with each other and in most cases users don't even need to deal with them. PAM could be said to be related to SeLinux a tiny bit, but they do very different things. SeLinux handles permissions, while PAM defines how users are authenticated to the OS. Kerberos is just a protocol.

Re:50%

[Pharmboy]

You're in IT? Notify the upper-management about the best tools available then implement those tools. If you can't make a reasonable argument why Windows is a hazard than get another career and move over for someone that can. It is POSSIBLE.

IT departments are the problem and Windows will be the dominant OS for decades to come until more IT "men" grow some balls.

HA! Just ask the boss for money and he gives it to you? Thats rich. So, if windows allows an email client to arbitrarily execute code in an email, its the IT depts fault? If Windows IIS allows you to run code by simply sending a malformed URL, its the IT depts fault? So, the solution is buy yet more software, that will not know about these exploits until they are exposed anyway, so is useless for unknown (but will be discovered) vulnerabilities?

And MS is the good guy and the IT guys are the bad guys, because all they have to do is go spend a bunch of money to secure an operating system they already paid alot of money for? And if the company is dependent on software that will only run on Windows for a year or two, its the IT depts fault if the boss won't change to Linux?

I gotta admit, I did enjoy the "grow some balls", coming from an AC. You sound more like a pissed off 20 year old who just finished a program at Devry and can't believe someone won't hire him for $80k.

I'd read through that....

[nukem1999]

but I'm not supposed to download unknown zip files on my Windows machine.

Free Windows Security Update CD

[not_hylas( )]

http://www.microsoft.com/security/protect/cd/order .asp

See? Wasn't that easy?

How to install Windows XP in 5 hours or less

[spoonyfork]

From Mark Pilgrim's How to install Windows XP in 5 hours or less:

1. Back up entire d: drive to iMac upstairs. rsync rocks.
2. Find Windows XP install disc.
3. Reboot with Windows XP install disc.
4. Asked for product activation. Curse Microsoft.
5. Search my house in vain for my original, 100% legitimate, retail Windows XP box.
6. Reboot.
7. Search control panels in vain for a window, dialog, tab, or pane that displays my current product key.
8. Search Google for "windows xp get current product key".
9. Find a utility on a cracker web page in Russia that displays the current product key. This is one of the more lame utilities, since most of the good ones allow you to change it. I don't wish to change it; I actually have a perfectly good product key, I just don't know what it is.
10. Reboot with Windows XP install disc.
11. Reboot repeatedly as required.
12. Boot screen. Choose between "Windows XP Professional" and "Windows XP Professional". Brilliant. Pick one. The wrong one. Boot into fucked Windows XP install. Hard reboot. Pick the right one. Make mental note to hack boot.ini later.
13. "Welcome to Windows XP. You have no useful programs and no internet access. You have 30 days left for activation. Would you like to activate now?" Yes, I would, but I have no internet access.
14. Unnecessarily loud and cheerful startup noises. Make mental note to turn off all sounds later.
15. Search the "Network and Internet Connections" wizards in vain for some way to set up my Linksys wireless card. Having never done a clean install of XP (I previously upgraded from Windows 2000), and having been moderately impressed by the new wireless networking features in XP, I naively assumed this would "just work". Silly rabbit.
16. Search my house for my Linksys wireless card driver install disc. Find the install disc that came with the old card, that broke and was replaced by the new-and-improved version 3.0 card. Wonder if that will suffice.
17. Fight with the "Add New Hardware Wizard" trying to install the obviously inferior drivers off this disc.
18. Wonder where the "Device Manager" is hiding.
19. Find the "Device Manager". Right-click on the unknown device, "Linksys_Instant_Wireless_Card". Update driver. "Windows was unable to locate a driver for this device. Would you like to search on the internet?" Yes, I'd love to, but I can't, you moron. Install driver from specific location. Specify WIN2000 folder on old-and-inferior install disc.
20. "This driver is not digitally signed." OK.
21. "This driver may cause your computer to become unstable." OK.
22. "This driver may anally rape your mother while pouring sugar down your gas tank." OK.
23. Nothing. No connection, no internet access, no acknowledgment of any device whatsoever.
24. Reboot.
25. Doesn't work.
26. "Take a tour of Windows XP!" I am.
27. Reboot.
28. Doesn't work.
29. Dig out old wired PCMCIA card. Take computer upstairs. Plug directly into switch. cmd. ipconfig. We have an IP address. ping www.google.com. We have name resolution and internet access.
30. Fire up Internet Explorer. runonce.msn.com. No. www.linksys.com. Support. Downloads. WPC11. Windows XP. Linksys.com rocks.
31. Insert Linksys wireless card.
32. Back to Device Manager.
33. Uninstall old-and-inferior driver.
34. Update driver.
35. "This driver is not digitally signed." OK.
36. "This driver may cause your computer to become unstable." OK.
37. "This driver may…" OK.
38. cmd. ipconfig. We have internet access.
39. "Add your .NET Passport to Windows XP!" No.
40. Fire up Internet Explorer. www.msn.com. No. www.mozilla.org. Download Mozilla.
41. Realize I should create an "f8dy" user because it will make my life easier later.
42. Create "f8dy" as an administrator. Log out. Log in.
43. Install Mozilla. Yes, I would like to make you my default

Re:Missing step 148.

[dmaxwell]

Think lineage of image here. If you're making a new image or install, it will still be easier to start from an image you made 9 months ago than to start from an XP cd. All the little desktop tweaks will be the way you like them and you'll only have 12 or so patches and 3 reboots rather than 47 or so and 7 reboots. Not only that, a good deal of your software won't have changed. You'll be saved some work there as well.

I finished new OS 9 images for some Macs I maintain (I know, I know but it has to be this way.) I didn't start from an OS 9.0 cd and patch it up to 9.2.2 + add a boatload of apps. I installed last year's image, made changes and then created a new image. I still saved a considerable amount of work and thumb twiddling watching progess bars.

Re:Obvious

[Kjella]

2. I don't run executable content I get through email unless I know the source and am expecting the file. Outlook has not auto run scripts in years now. (...) The other is that I don't download software of dubious origin.

Last I checked, IE ran executable code automagically due to a buffer overflow late last year, not sure if there are any such bugs this year.

Anyway, I realize what you're trying to say but it is still a poor situation. It's like saying "Yeah, I drive a crappy and hazardous car with poor brakes, but I'm a good driver and drive defensively so I don't get into any accidents anyway."

And regardless of how obvious it may seem to you, it is not common sense. It's your computer knowledge. Don't confuse common sense with logic. It is logical to you because you know how a computer works. It is not logical to a person that doesn't know what's ihside that beige box, and has no idea what an OS is or does. And that really have no idea what is nor should be happening when they open a file.

People have no clue what makes up a "dubious" origin. Hell, RealPlayer counts as dubious in my book (once a villain, always a villain), while an OSS project who has no corporate backing, not knowing any of the coders, is usually less dubious. How do you know which are reputable companies? Knowledge, which implies that it is not common sense.

Kjella