Sinergija09 :: Akcija!!!
•
•
Besplatno testiranje bezbednosti web sajta za sve firme-učesnike Sinergije09 !
Kompanija Microsoft Software je u saradnji sa partnerskom firmom Network
Security Solutions rešila da pokloni svim zainteresovanim firmama učesnicama
Sinergije09, bez obzira na broj prijavljenih posetilaca konferencije, po jednu
besplatnu osnovnu procenu bezbednosti web sajta.
Prijave do 30. Novembra http://www.netsec.rs
Protecting Windows and
Web applications
Dejan Levaja, MVP [Enterprise Security]
Network Security Solutions
http://www.netsec.rs
Agenda
•
•
•
•
•
•
•
Server 2008 Security mehnizmi - podsetnik
IIS 7 security
Patching
Auditing
Scanning and Assessment
Hardening
Security Testing
Security and protection
•
•
Security improvements to the kernel
– Kernel patch protection for 64-bit editions
– Security improvements to the heap
manager
– Security improvements to the registry
– Code integrity
– Data Execution Prevention
– Address Space Layout Randomization
– Windows Resource Protection
Security improvements to Windows services
– Windows service hardening
– Session 0 isolation
– Named pipe hardening
•
•
•
•
•
Windows Integrity Mechanism
Windows Internet Explorer 7/8
– Protected mode
– Extended Validation SSL certificates
Extensible logon architecture
Cryptography Next Generation
Authentication protocol improvements
– Windows implementation of the Kerberos
protocol
– TLS/SSL cryptographic enhancements
Threats and vulnerabilities mitigation
•
•
•
•
•
•
•
Server role security configuration
Server Core installation option
User Account Control
Web Server (IIS) role
Backup and recovery
Windows Firewall with Advanced Security
Network Policy and Access Services role
– Network Policy Server
– Network Access Protection
– Routing and Remote Access
Secure configuration assessment and
management
•
•
•
•
•
•
Security auditing
Server security policy management
Security Configuration Wizard
Authorization Manager
Group Policy
Active Directory Domain Services
– Fine-grained password policies
– Auditing
Identity and access control
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Smart cards
802.1X authenticated wired and wireless
access
Backup and restore of stored user names
and passwords
Credential Security Service Provider and
single sign-on for Terminal Services logon
Previous logon information
Access control user interface
TrustedInstaller SID
Restricted SIDs checks
File system namespace modifications
Default permissions changes
Changes to tokens
Integrity levels
Icacls command-line tool
OwnerRights SID
•
•
•
•
•
BitLocker Drive Encryption
Encrypting File System
Active Directory Certificate Services
– Cryptography Next Generation
– Online Certificate Status Protocol
– Network Device Enrollment Service
– Web enrollment
– Policy settings
– Restricted enrollment agent
– Enterprise PKI snap-in
Active Directory Domain Services
Active Directory Rights Management Service
IIS 7 Security
•
Ranjivosti
–
–
–
–
•
•
•
•
•
IIS 7
Apache 2.2
IIS 6
Apache 2.0
(2006. – Sinergija09)
(2006. – Sinergija09)
(2003. – Sinergija09)
(2003. – Sinergija09)
Authentication
IP and Domain Restriction
URL Authorization
Request Filtering
Certificates
=> 2
=> 17
=> 8
=> 41
IIS 7 Security - Authentication
•
Izmene
–
–
–
–
–
–
•
IUSR_machine_name => IUSR
IUSR_machine_name postoji samo ako postoji i FTP
IUSR radi u bezbednosnom kontekstu worker procesa (network service)
IUSR nema lozinku
IUSR_WPG => IIS_IUSR
Najvažnije: IUSR i IIS_IUSR su Built-In nalozi –> svuda isti SID -> moguć XCOPY /O
Authentication
–
–
–
–
–
–
–
Anonymous
Basic
Windows
Forms
Certificates*
Digest
ASP.NET Impersonation
IIS 7 Security - IP and Domain Restriction
•
•
Ograničenje pristupa po IP adresi
Ograničenje pristupa po imenu domena (zahteva reversni DNS lookup!)
– Demo
•
Dynamic IP Restrictions Extension (beta)
– http://www.iis.net/extensions/DynamicIPRestrictions
IIS 7 Security - URL Authorization
•
NTFS vs URL autorizacija
– xcopy /o
•
Demo
– Scenario
• Isključimo Anon Auth, uključimo Basic
• kreiramo grupu
• kreiramo korisnike i dodamo ih u grupu
• obrišemo defaultni URL Authorization Rule i kreiramo novi
– Sve ovo može i iz CMD-a (appcmd.exe)!
Request Filtering – simple WAF
•
URLScan => Request Filtering
– Filter Double-Encoded Requests
• ‘\’ => %5c
– ‘% ‘=> %25
» %255c
• scripts/..%255c..%255c..%255cwinnt/system32/cmd.exe?/c+dir+c:\ (IIS 5.0)
– Filter High Bit Characters
– Filter Based on File Extensions
– Filter Based on Request Limits
– Filter by Verbs
– Filter Based on URL Sequences
• /../ ,
– Filter Out Hidden Segments
Certificates
•
SSL
–
–
–
–
–
•
one to many mapping
one to one mapping
AD mapping
CLR, delta CRL
Next, next, finish
Demo
Patching
•
Windows Update
– <= Vista
– OS + IE
•
Microsoft Update
– Windows Update + MS Office + Exchange + SQL + ...
– http://www.update.microsoft.com/
•
•
•
Automatic Update
Patch Tuesday ( and Exploit Wednesday  )
Microsoft Catalog
– http://catalog.update.microsoft.com
Patching
•
WSUS 3.0
–
–
–
–
Sastavni deo Servera 2008 (KB 940518)
SUS == OS; WSUS == OS + ostalo
WSUS = IIS 7+ SQL (WID) + Microsoft Update
GPO ili Registry
• GPO => Computer Configuration\Administrative Templates\Windows
Components\Windows Upddate\Specify Intranet Microsoft Update Service
Location
• Registry => KLM\Software\Policies\Microsoft\Windows\WindowsUpdate\
– reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
» /v WUServer /t REG_SZ /d http://wsus.netsec.local
» /v WUStatusServer /t REG_SZ /d http://wsus.netsec.local
Auditing
•
Auditing in Server 2008
–
–
–
–
•
4GB vs >petabyte
n*1000 evt/sec vs n*10000 evt/sec
granular audit policy (GAP)
GPO (R2), AuditPol.exe
EventViewer
– XML
•
•
eventquery.vbs wevtutil.exe
Demo: Failed logons
– wevtutil qe Security /q:"*[System[(EventID=4624)]]" /f:text > logon.txt
Scanning
•
MBSA
–
–
–
–
–
–
–
–
Security Updates, Administrative Vulnerabilities, IIS, SQL, Desktop apps
WSUS i MBSA
GUI, cmd (mbsacli.exe)
Online, Offline
wsusscn2.cab - http://go.microsoft.com/fwlink/?LinkId=76054
Visio Connector (2003,2007)
%userprofile%\SecurityScans
Demo:
• mbsacli.exe /target 192.168.0.10 /u administrator /p P@ssw0rd
• mbsacli.exe /n SQL+IIS /catalog c:\wsusscan2.cab /nd
Assessment
•
MSAT
– MSAT is designed to help you identify and address security risks in your IT environment.
– http://technet.microsoft.com/en-us/security/cc185712.aspx
•
•
•
Preko 200 pitanja baziranih na ISO 27001
Infrastructure, Applications, Operations, People
Demo
Hardening
•
•
Windows Firewall with Advanced Security
IPSec => Server and Domain Isolation
– R2 or not R2 ?
– Demo
•
Security Configuration Wizard
– Demo
Security Testing
•
Vulnerability Assessment
– popisuje ranjivosti
– MBSA, ...
•
Penetration Testing
– dokazuje da je moguće iskoristiti pronađene ranjivosti
– browser + proxy, metasploit, ...
•
•
Besplatno testiranje bezbednosti web sajta za sve firme-učesnike Sinergije09 !
Prijave do 30. Novembra http://www.netsec.rs
Molimo vas da popunite ankete!
Please fill out the evaluations!
Vaše mišljenje čini osnovu
sledeće Sinergije i
omogućava nam da
oblikujemo sadržaj u skladu
sa Vašim željama.
Your opinion forms the next
Sinergija conference, and it
provides us with the means
to shape its content to best
suit you.
Svi posetioci koji popune
ankete ulaze u nagradnu
igru
All attendees that fill out the
evaluations are taking part
in drawing of special prizes
Hvala!
dejan.levaja@netsec.rs
Microsoft Community Serbia
http://www.msforge.net