Sorry! The requested paper could not be found.
Windows Issues
Featuring 49 Papers as of June 17, 2014
-
Securing Windows 20003 with ADAM and MIIS Feature Packs by Frederic Dumesle - February 8, 2012
Windows 2003 has been released almost 5 years ago which is a long time in IT terms. Even though hundreds of article, white papers and case study are broadly available a significant number of scenarios involving Windows 2003 in Perimeter Design are scarce at best.
-
Auditing Windows Environments PowerShell XML output, windows security, ossams by Cody Dumont - February 7, 2012
A security professional often performs security assessments for customers and will use many tools to collect data. Each tool stores data in a separate format; this requires the assessor to develop a proprietary automated process or use a manual process to correlate all the data.
-
Protecting Laptop Computers by Gregory Hill - June 11, 2010
The most important facet of protecting laptops is to understand the goals. Carefully building a Threat Model brings the goals into focus by selecting the assets to be protected and assigning an importance to each one in terms of the expected risk exposure of not protecting them. This concentrates limited resources on the critical areas. The information is transferred to the Master Protection Plan to select the most effective methods to achieve the goal. Next, the custom Protection Plan is implemented by installing products and configuring components. Lastly, the protected assets must be monitored and the plan adjusted to keep abreast of changing goals and new threats.
-
Managing Operating System (OS) Lock Down Analyst Paper (requires membership in SANS.org community)
by Dave Shackleford - March 17, 2010- Sponsored By: Trusted Computing Group
Review of a tool specific to OS lock down from Trusted Computer Solutions (TCS) called Security Blanket, which automates OS configuration for a wide variety of UNIX and Linux platforms.
-
Winquisitor: Windows Information Gathering Tool by Michael Cardosa - January 19, 2010
Winquisitor is a tool that facilitates the timely retrieval of information from multiple Windows systems enabling the administrator to respond in an appropriate amount of time. Unlike other command line tools, Winquisitor allows multiple types of queries in a single command with several output formats.
-
Preventing Incidents with a Hardened Web Browser by Chris Crowley - December 15, 2009
There is substantial industry documentation on web browser security because the web browser is currently a frequently used vector of attack. This paper investigates current literature discussing the threats present in today's environment.
-
Session Hijacking in Windows Networks by Paul Jess - March 28, 2008
Before we can explore the session hijack attack, it is essential that we gain a basic understanding of network communications. The first section of this paper covers some of this background information needed to understand how computers communicate on a network. First we take a look at the TCP/IP protocol (Transmission Control Protocol/Internet Protocol) examining a concept critical to network communication called the three-way-handshake. Once we have a basic understanding of these concepts, we can then work towards understanding how the session hijack attack exploits the design flaws inherent in the TCP/IP protocol.
-
Windows Remote Desktop Heroes and Villains SANS.edu Graduate Student Research
by Greg Farnham - December 14, 2007This paper will focus on a fictitious scenario of a non-profit organization that would like to understand the threats to remote desktop and improve security. This paper will review past vulnerabilities in the Windows Remote Desktop service, review threats, review mitigation techniques and summarize the results.
-
Laptop Security: Windows® Vista vs. XP by Gregory Hill - July 26, 2007
Laptop computers are an irresistible target for criminals, resulting in hundreds of thousands of thefts and millions of electronic intrusions causing billions of dollars in losses. The majority of these computers run the Microsoft XP operating system, which, although containing many security enhancements over its predecessors, is nonetheless frequently compromised.
-
How to Avoid Information Disclosure when Managing Windows with WMI by Alex Timkov - July 17, 2007
This paper provides an introduction to accessing Windows via WMI in a secure manner.
-
Windows Security Patch Management Case Study: Using Software Update Services to Deploy Critical Windows Updates by Michael Shepherd - May 5, 2005
This paper covers the use of Microsoft Software Update Services (SUS) software to roll out Windows updates at a small office.
-
Exploitation of the SSL PCT Overflow by Eric Zielinski - May 5, 2005
This document establishes a detailed scenario in which a given exploit is used to gain complete control of a targeted system. The attack will be demonstrated in phases which will include intelligence gathering, network information disclosures, and a vulnerability assessment.
-
Exploiting Microsoft Internet Explorer Cursor and Icon File Handling Vulnerability by Jerry Chen - May 5, 2005
This paper will focus on Microsoft .ANI file handling vulnerability, which was discovered by eEye Digital Security Company on November 15, 2004.
-
Implementing a Secure WebDAV System by Richard Ross - January 18, 2005
This paper describes the process of implementing a secure remote file sharing system using WebDAV. It tells why a remote file sharing system is needed, how a secure solution is implemented and assesses the security of the solution.
-
Policy and the Windows Server 2003 Group Policy Management Console by Norman Knight - April 8, 2004
Group policy was first introduced with the release of Windows 2000 Server and Active Directory in the year 2000. With the introduction of Windows Server 2003, Microsoft has also released the Group Policy Management Console.
-
Highly Available PC First Step in Business Continuity for Executives by Joseph Fraher - March 4, 2004
There are many ways to make users adhere to rules that are in their best interest. Local Policies and Domain policies are great for enforcing such rules. Forcing users to save data to a network drive is easily achievable through such policies. Enforcing these policies is another issue.
-
Windows Vista: First Steps by Johannes Ullrich - December 23, 2003
Guide to Microsoft Windows Vista settings. Vista tips for home users and small businesses without a firewall, who rely on downloading patches from Microsoft directly.
-
An Overview of the Kerberos Authentication Proto by Pam Todaro - December 14, 2003
This paper will expound on some of the benefits gained by using the Kerberos authentication protocol rather than the Windows NT LAN Manager protocol.
-
Securing IIS6: From the OS, Up by Joey Peloquin - November 5, 2003
This document provides a detailed look at securing Internet Information Services v6.0 (IIS6), using a combination of security templates and manual techniques.
-
Centralized Windows 2000 Event Logging: A Step-by-Step Guide by Scott Richardson - November 5, 2003
The purpose of this paper is to show you how to setup a centralized logging system for your Windows 2000 Corporate Network.
-
Discretionary Access Control Knowledge, a Practical System by Dean Bushmiller - August 13, 2003
This paper offers a new solution for administrators to reduce abuse of access controls and simplify permissions management.
-
NetMeeting 3.01 Remote Desktop Sharing: Security Concerns by Randy Humphrey - July 14, 2003
This paper examines the concept of Remote Desktop, in particular analyzing Microsoft's NetMeeting 3.0 Remote Desktop Sharing (RDS) offering.
-
Top 10 Mistakes on Windows Internal Networks by Deirdre Hurley - May 8, 2003
In this paper I aim to highlight ten common mistakes on Windows systems, which make the job of a disgruntled employee or a malicious attacker who manages to get past your firewall, far easier.
-
Taking the Confusion Out of Security Templates by Robert Aitken - March 27, 2003
This paper will address how security templates are constructed using the Security Templates Snap-in to the Microsoft Management Console (MMC).
-
Security Issues For Exchange 2000 Outlook Web Access Implementation by Paula Kohrt - February 7, 2003
The purpose of this paper is to cover the fundamental security considerations during the implementation of an Exchange 2000 Outlook Web Access (OWA) Front End (FE) server in a demilitarized zone (DMZ) using secure HTTP access.
-
Security-What Does "Trust" Have To Do With It? by Ken Lange - February 4, 2003
A large part of the technology industry is concerned with information security and trustworthy computing, and the purpose of this paper is to determine how the infrastructure and relationship between trust and security has evolved in technology.
-
Microsoft Windows XP Home Edition Security Implementation by Dennis Schrader - January 10, 2003
This document is designed to guide home users on how to implement sufficient security measures on a home computer running Microsoft Windows XP Home Edition.
-
Microsoft .NET - An Overview by Rob McBee - September 14, 2002
This paper discusses the Windows .NET Server operating system, purported to provide many important new security features and improve on the ones included in the original Windows 2000 Server.
-
Vulnerability Risk Mitigation - Patching the Microsoft Windows Environment by Tracy Lynn - June 20, 2002
This manuscript discusses procedures for regularly patching a Microsoft Windows environment, beginning with a discussion what vulnerabilities are, how they find their way into developers' code, and why they have become such an issue. The balance of the paper presents a number of options for patching the vulnerabilities, using either freely available tools or products that require purchasing licenses.
-
Windows NT/2000 Event Logs by William Mendez - April 21, 2002
This paper will help one to completely automate the process of gathering, filtering and alerting when relevant events are found using inexpensive tools and resources already available. The goal is to prevent potential attacks or misusage by making it easy and cost effective to gather and review event logs.
-
The Raw And The Uncooked: The Windows XP Raw Sockets Saga, Final Words (Hopefully) by Tony Menzies - March 7, 2002
Following the large amount of often emotional debate surrounding the introduction of raw sockets into Microsoft Windows XP, and the relative lack of clarity on the issue, this paper is intended to provide a comprehensive review of all major aspects of the issue so as to permit the reader to formulate their own opinion on the issue. The author's personal conclusion is also included.
-
Assessing the security of the Windows XP Internet Connection Firewall by David Collins - February 18, 2002
This paper describes an empirical evaluation comparing Microsoft's Internet Connection Firewall (ICF) with ZoneAlarm Pro, a popular workstation firewall.
-
Configuring Internet Explorer Security Zones: A New Tool for the Security Community by Ken Barber - February 13, 2002
This paper reviews the literature on risks inherent in each of the active content technologies, and the very different ways in which they approach security, as well as the meanings and implications of all but one of IE's security zone settings. In addition, Microsoft's System Policy Editor tool for Windows NT is examined and a policy editor template for the IE security zones is suggested.
-
NULL Sessions In NT/2000 by Joe Finamore - December 10, 2001
This paper is going to discuss the issue of null sessions in NT 4.0 and Windows 2000. It will investigate the uses and vulnerabilities of such sessions, and will show how to control and/or eliminate those vulnerabilities.
-
XP - The Future of Secure Operating Systems? by Justin Coburn - November 20, 2001
This paper examines why Windows XP is a major step in the direction of more security and fewer vulnerabilities than earlier versions of Windows.
-
Windows 9X in a Bad Neighborhood by Terry Wehunt - October 28, 2001
This paper discusses security of Windows 9X machines under the control of certain registry settings and the impact of malicious code on maintaining registry setting.
-
NT/2000 Security Tool Kit on A Budget by Albert Rice - October 9, 2001
This paper will focus on the shareware, freeware and low cost commercial security tools that one security administrator has found useful and has used to solve real time security issues for his company.
-
SANS Windows Security Training by Philip Blow - September 30, 2001
This paper will suggest a network architecture and installation process that can be used when the inclusion of IIS web servers in a Windows Domain cannot be avoided.
-
An investigation of Microsoft's Passport protocol and issues regarding its security, privacy by Arthur Hermann - September 29, 2001
An investigation of Microsoft's Passport protocol and issues regarding its security, privacy standards and utilization in the XP and .Net initiatives
-
Three Defenses to a Secure System: Virus Scanning, Applying Patches and System Monitoring by Angelina Lucero - September 18, 2001
This document describes issues to consider when setting up virus scanning software, using Microsoft tools to make patching operating systems easier, and a few specific tools that you can use to benchmark or monitor your operating system that might help you spot those abnormalities that should not be there.
-
Event Logs: Defining Their Purpose in Today's Network Security Environment by Steve Meyer - August 16, 2001
The purpose of this research topic is to identify the purpose of the event log in today's network security environment.
-
Introduction to the Microsoft Windows XP Firewall by Matt Snitchler - August 13, 2001
This paper examines how Microsoft's Internet Connection Firewall (ICF) functions and reviews its worthiness.
-
Windows XP and Full Raw Sockets: A New Security Concern from Home-based PC's or a Desirable N by Jim Kehres - August 10, 2001
This paper examines what raw sockets are and how they can be used for malicious intent.
-
NetMeeting Security Concerns by Jody Weiner - July 23, 2001
This paper examines how NetMeeting allows a system's firewall perimeter defense to be bypassed in three ways: via social engineering; holes or vulnerabilities created in the firewall configuration; and, bugs in the program itself can cause security issues.
-
Quick Guide to IIS Web Server Security by Brian LeVasseur - July 19, 2001
The author describes his experience learning how to secure his organization's systems on the fly.
-
Tightening Site Access by Stephen Willis - July 9, 2001
This document shows some of the steps one system administrator has taken (albeit gradually) to tighten up access to his organization's IT site.
-
Microsoft Windows Security Patches by Dan Rolsma - July 3, 2001
This paper is for those who have a Microsoft Windows computer attached to the Internet, and haven't installed the latest Microsoft security patches: the first section is where to get these patches and how to install them, and the second is why.
-
Using Microsoft Terminal Services and Windows Terminals to Protect Confidentiality, Integrity, and A by Tony Sweeney - July 1, 2001
This paper examines Terminal Services with Windows terminals and its range of technical, educational, cultural, political, and internal marketing challenges.
-
IP Security in Windows 2000: Step-by-Step by Timothy Rogers - April 4, 2001
This paper provides an overview of Internet Protocol Security (IPSec)
Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.
All papers are copyrighted. No re-posting or distribution of papers is permitted.
SANS.edu Graduate Student Research - This paper was created by a SANS Technology Institute student as part of the graduate program curriculum.
