|
|
HardeningWhen you install a new operating system, your security settings are all set to their default values. The same goes for installing a new web server or a browser. These settings need to be changed to harden the system against attacks or unauthorized access. File SystemsWhen you install Windows, all versions have one thing in common: weak security. The obvious example is that after logging in, all users have full control (all permissions) at the root of every drive and at most of the drives' subdirectories and files. NT4 was the first Windows operating system to introduce a distinction between rights and permissions. A right allows the user to access the resources of the operating system itself, such as shutting down the system. A permission allows the user to access the file system's resources, such as reading and writing files. NT4 was also the first Windows product with DAC, which is discussed in more detail later in this chapter. The Windows default for permissions is for the Everyone group to have full control from the root of each drive down. For a single user station, this is okay, but for a web server or file server, this is not acceptable. If you do not change the permissions, any user who logs in, no matter how, has full control. The easiest way to adjust these permissions is by using Windows Explorer as follows:
In Figure 7-3, you can see the default for Windows security. Every user logged in to the system has Full Control. This leaves the system wide open to any kind of unauthorized access. Therefore, you need to change those permissions. The case study in this chapter gives you an example of how to change these permissions. There is much more to securing a web server than hardening the file system. Other things you need to do are
On the Microsoft website, you can find sample information on security. Here is a good starting point if you need additional information: http://www.microsoft.com/technet/Security/tools/default.mspx. The first four items in the list of tasks for securing the web server will not be discussed in detail in this book. NOTE For more information about policies and group rights, you can look at Web Security Field Guide by Steve Kalman from Cisco Press. The last item in the list of tasks for securing the web server is removing or disabling unnecessary services. When you start your PC, many services run in the background. Disable all services that you do not need. Table 7-1 lists the services that you can disable. This is not a complete list, so be careful when disabling these services. Some services might be needed for operation.
DAC is a means of restricting access to information based on the identity of users and membership in certain groups. Access decisions are typically based on the authorizations granted to a user based on the credentials presented at the time of authentication (username, password, hardware/software token, and so on). In most typical DAC models, owners of information or resources can change permissions at their discretion (thus the name). DAC's drawback is that administrators cannot centrally manage these permissions on files and information stored on the web server. A DAC access control model often exhibits one or more of the following attributes:
Web ServersA freshly installed web server is a completely defenseless platform. Before you can start using it as a web server, you need to secure it. This section shows you how. After the web server is installed, you can take several steps to secure it: You can prevent access to the server, and you can enable logging to monitor events on your web server. LoggingLogging is an essential part of maintaining a secure web environment. To enable logging, open Internet Information Services in the Administrative tools menu, expand the tree, right-click Default Web Site, and choose Properties. Then click the Web Site tab to see the screen shown in Figure 7-4. Figure 7-4. Default Web Site Properties
Near the bottom of the page, make sure that the Enable Logging check box is enabled. Internet Information Services (IIS) supports four log file formats, each with varying types and quantities of data collected. The default, W3C Extended Log File Format, is the most detailed. Now you can click Properties to bring up the screen in Figure 7-5. Figure 7-5. Extended Logging Properties
In Figure 7-5, you can see that, by default, a new log file will be created every day. The default log file directory is %WinDir%\System32\LogFiles; however, you should change this to point to somewhere elsepreferably to another server. Log files should preferably be archived offline. Intruders usually hide their tracks by altering or deleting the log file. If intruders take control of your PC, a log in this location is vulnerable. Restricting AccessYou can restrict access to a website or to a specific folder of a website on a user-by-user basis or based on IP addresses. To configure access for user authentication, start the Internet Service Manager. Right-click the folder you want to use for basic authentication, which brings up a screen similar to Figure 7-6. Figure 7-6. Folder Properties
On that screen, select the Directory Security tab. This brings you to a screen like the one in Figure 7-7, where you can edit the authentication method, IP address, or domain name restrictions. Figure 7-7. Directory Security
Click Edit for the anonymous access and authentication control to select the authentication method you want to use for that folder, as shown in Figure 7-8. Figure 7-8. Authentication Methods
On the Authentication Methods screen, you can check boxes to indicate that anonymous access is allowed or to select basic authentication, for which the password is sent in clear text. You can also select to have integrated Windows authentication. To use integrated Windows authentication, add all the different users in Windows because IIS uses integrated Windows authentication to grant access to the website. Access can also be controlled based on a PC's IP addresses. You can set specific addresses, address ranges, or DNS names from which access is either allowed or denied. After you click Edit IP addresses and domain name restrictions, you see a page, as shown in Figure 7-9. Figure 7-9. Authentication Methods
This dialog box needs careful reading. It either grants (the default) or denies access to all addresses except those you add manually. When you click Add, you see a screen as shown in Figure 7-10. Figure 7-10. Deny IP Addresses
If you want to deny only one particular address, select Single computer; however, you can also restrict access to a group of computers or to a domain name. You can repeat these steps to exclude more than one domain or range. NOTE For more information on hardening IIS, you can always visit the following website: http://www.microsoft.com/technet/security/tools/locktool.mspx. BrowsersWe all use browsers these days, and most of us run third-party plug-ins. This is not necessarily dangerous, but it is always better to keep in mind that malicious people can write plug-ins, too. The most popular scripting languages used for writing plug-ins today are the following:
Be very careful when installing plug-ins, just as you should be when downloading any software program from the Internet. Security ZonesBecause most people using the Internet today use Microsoft Internet Explorer to browse web pages, this chapter covers only that program. Internet Explorer has four zones of security. When you access a resource on another machine, the other machine's zone relative to yours is determined, and the restrictions placed on that zone control the interaction with that resource. Users can set the security policy on their computer. The four zones are as follows:
NOTE For understanding and maintaining security with Internet Explorer, visit the following URL: http://www.microsoft.com/windows/ie/security/default.asp. To change the settings for these four zones in Internet Explorer, choose Tools > Internet Options. On the page that appears, select the Security tab, and you see a page as shown in Figure 7-11. Figure 7-11. Security Setting Page
As you can see in Figure 7-11, there are four predefined security levels. In addition, you have the ability to customize the settings for any or all the zones. Of the web content zones shown in Figure 7-11, the Internet zone is the one you need handle most carefully. The default setting here is Medium, which is not so secure for the World Wide Web. Table 7-2 lists all the security levels with a brief explanation of their purposes.
Because you cannot set the security level for the Internet zone to High, you must change the custom level. After you click the Custom Level button, you see a screen similar to that in Figure 7-12. Figure 7-12. Scripting Options
The window that appears has several items you can change, such as the following:
Figure 7-12 shows Scripting. On this screen, you first change the custom settings on the bottom of the screen from Medium to High. At this point, you receive a warning asking if you are sure that you want to make this change. After you click Yes, you can take another look at the scripting options, as shown in Figure 7-13. Figure 7-13. High Security Settings
As you can see, some settings have changed. All the scripting items have been disabled. Be sure to check your browser every time you install a new version to ensure that these settings are correct. By disabling some features, such as ActiveX, you can occasionally cause a web page to generate an error. Most of the time, it is better to have that error than to let ActiveX run, but in some cases, you know the ActiveX controls can be trusted, and you need to let them work. You can do this by making the site a trusted site and by setting trusted site security so that ActiveX can run. To do that, you need to go back to the Security page of the Internet Options. After you click Trusted sites, you see a page as shown in Figure 7-14. Figure 7-14. Security Setting Page
The default security for a trusted site is Low. You can set security to Medium-low or Medium to increase security. On that same page, you also need to add the site you trust. To do that, click Sites, which brings you to a screen as shown in Figure 7-15. Figure 7-15. Trusted Sites
On that screen, you need to clear the check box requiring HTTPS, type in the domain of the site you trust, and then click Add. At this point, if you try to reload the page with the ActiveX content, it works and the content is visible. CookiesAs you might already know, HTTP is a stateless protocol. Every time you visit a website, it looks as if that visit to the website is your first because HTTP does not keep track of your web history. To simulate a stateful environment, the HTTP protocol includes features such as cookies. There are two types of cookies:
You can manage cookies in several ways. You can delete all your cookies, or you can configure your browser to not accept cookies at any time. This would make browsing the Internet rather difficult because many sites need cookies to function properly. A better solution would be to force all your cookies to be session cookies. You can do this by making the folder where the cookies are stored read-only. Your browser will accept them but will be unable to save them to disk.  |
|
|
