Microsoft Windows Security Essentials

Darril Gibson, MCSE, MCITP, ITIL v3, Security+, CISSP, is the CEO of Security Consulting and Training, LLC. A Microsoft Certified Trainer since August, 1999, he regularly teaches, writes, and consults on a wide variety of security and technical topics. He has authored, coauthored, or contributed to 14 books on a wide range of topics that include Server 2008, Windows 7, SQL Server, CompTIA Security+, and security.

• Introduction xixChapter 1 Understanding Core Security Principles 1Understanding Risk 1Exploring the Security Triad 4Protecting Against Loss of Confidentiality 5Protecting Against Loss of Availability 5Protecting Against Loss of Integrity 6Implementing a Defense-in-Depth Security Strategy 7Enforcing the Principle of Least Privilege 9Hardening a Server 10Reducing the Attack Surface 11Keeping a System Updated 14Enabling the Firewall 16Installing Antivirus Software 16The Essentials and Beyond 16Chapter 2 Understanding Malware and Social Engineering 19Comparing Malware 19Viruses 21Worms 22Trojan Horses 23Buffer-Overflow Attacks 25Spyware 26Understanding the Threat 27Protecting Against Malware 28Using Antivirus Software 29Using Microsoft Security Essentials on Desktops 31Thwarting Social-Engineering Attacks 34Social Engineering in Person 34Social Engineering with a Phone Call 34Recognizing Phishing Attempts 35Recognizing Pharming 38Protecting Email 39The Essentials and Beyond 41Chapter 3 Understanding User Authentication 43Comparing the Three Factors of Authentication 44Using Passwords for Authentication 45Comparing Password Attack Methods 45Creating Strong Passwords 47Enforcing Strong Passwords 49Exploring Account Lockout Policies 51Unlocking an Account 53Resetting a Password 55Changing a Password 57Creating a Password-Reset Disk 58Using Smart Cards and Token Devices for Authentication 59Using Biometrics for Authentication 60Starting Applications with Run As Administrator 61Preventing Time Skew with Kerberos 63Identifying RADIUS Capabilities 64Identifying Unsecure Authentication Protocols 65LM 66NTLM (NTLMv1) 66The Essentials and Beyond 67Chapter 4 Securing Access with Permissions 69Comparing NTFS Permissions 69Identifying Basic NTFS Permissions 70Identifying Advanced NTFS Permissions 71Combining Permissions 75Enabling and Disabling Permission Inheritance 76Moving and Copying Files 79Comparing NTFS and FAT 81Exploring Share Permissions 81Identifying Share Permissions 83Combining NTFS and Share Permissions 85Identifying Active Directory Permissions 87Viewing Active Directory Users and Computers 87Comparing NTFS and Active Directory Permissions 88Viewing Active Directory Permissions 88Assigning Registry Permissions 91The Essentials and Beyond 93Chapter 5 Using Audit Policies and Network Auditing 95Exploring Audit Policies 96Exploring Object Access Auditing 99Comparing Account Logon and Logon Events 101Exploring Directory Service Access Auditing 102Understanding Account Management Auditing 103Understanding System Events Auditing 103Understanding Privilege Use Auditing 104Understanding Policy Change Auditing 105Understanding Process Tracking 105Enabling Auditing 105Enabling Object Access Auditing 107Enabling Directory Service Access Auditing 108Viewing Audit Information 110Managing Security Logs 111Saving Audit Information 113Securing Audit Information 113Auditing a Network with MBSA 114Installing MBSA 116Running MBSA 116The Essentials and Beyond 117Chapter 6 Protecting Clients and Servers 121Understanding User Account Control 122Understanding the Dimmed Desktop 123Modifying User Account Control 123Keeping Systems Updated 125Updating Systems with Automatic Updates 126Updating Systems with WSUS or SCCM 128Using Group Policy to Configure Clients 129Protecting Clients 130Understanding Offline Folders 130Encrypting Offline Folders 132Using Software-Restriction Policies 133Protecting Servers 135Using Separate VLANs 136Separating Services 136Using Read-Only Domain Controllers 139Exploring DNS Security Issues 140Protecting Against Email Spoofing with SPF Records 141Understanding Dynamic Updates 141Using Secure Dynamic Updates 142The Essentials and Beyond 144Chapter 7 Protecting a Network 147Identifying Common Attack Methods 147Denial of Service 148Distributed Denial of Service 149Sniffing Attack 149Spoofing Attack 151Port Scan 151Exploring Firewalls 153Comparing Hardware-Based and Software-Based Firewalls 154Comparing UTMs and SCMs 155Isolating Servers on Perimeter Networks 157Using Honeypots 159Isolating a Network with NAT 159Exploring Network Access Protection 159Understanding NAP Components 160Evaluating Client Health with VPN Enforcement 162Using Other NAP Enforcement Methods 163Identifying NAP Requirements 163Identifying Protocol Security Methods 164IPsec 165Comparing Tunneling Protocols 166DNSSEC 167The Essentials and Beyond 168Chapter 8 Understanding Wireless Security 171Comparing Wireless Devices 171Wireless Adapters 172Wireless Access Points 173Wireless Routers 173Comparing Wireless Security Methods 174Understanding Encryption Keys 175Wired Equivalent Privacy 175Wi-Fi Protected Access 176Wi-Fi Protected Access Version 2 177Extended Authentication Protocol 178Viewing Windows 7 Wireless Settings 179Configuring Wireless Routers 183Changing the Default Administrator Password 183Changing the SSID 183To Broadcast or Not to Broadcast 185Using MAC Filters 187Configuring Windows 7 for Wireless 189The Essentials and Beyond 190Chapter 9 Understanding Physical Security 193Comparing Site Security and Computer Security 194Understanding the Importance of Physical Security 194Controlling Physical Access 196Using Switches Instead of Hubs 199Using Group Policy to Enhance Computer Security 200Understanding Default GPOs 200Designing OUs and GPOs to Manage Users and Computers 201Creating OUs in a Domain 202Moving Objects into an OU 203Creating GPOs to Manage Users and Computers 203Understanding Security Settings in a GPO 204Disabling Log On Locally with Group Policy 206Controlling Removable Storage Access with Group Policy 209Exploring Mobile Device Security 211Protecting Mobile Devices Against Malware 212Minimizing Risks with Bluetooth Devices 212The Essentials and Beyond 213Chapter 10 Enforcing Confidentiality with Encryption 215Comparing Encryption Methods 216Understanding Symmetric Encryption 216Exploring AES 218Understanding Asymmetric Encryption 219Using Certificates to Share Public Keys 222Understanding Hashing 223Securing Email 225Encrypting Email 226Digitally Signing Email 228Understanding EFS 231Encrypting and Decrypting Files with EFS 232Understanding the Recovery Agent 233Understanding Behavior When Files Are Moved or Copied 233Exploring BitLocker Drive Encryption 235Understanding BitLocker Requirements 235Understanding Recovery Keys 236Using BitLocker To Go 237The Essentials and Beyond 238Chapter 11 Understanding Certificates and a PKI 241Understanding a Certificate 241Comparing Public and Private Keys 243Understanding Certificate Errors 245Viewing Certificate Properties 248Exploring the Components of a PKI 251Understanding the Certificate Chain 252Comparing Certificate Services 254The Essentials and Beyond 255Chapter 12 Understanding Internet Explorer Security 257Exploring Browser Settings 257Understanding IE Enhanced Security Configuration 259Selecting Cookies Settings 260Manipulating the Pop-up Blocker 262Using InPrivate Filtering and InPrivate Browsing 263Deleting Browser History 265Managing Add-ons 266Exploring Advanced Security Settings 268Comparing Security Zones 269Using IE Tools to Identify Malicious Websites 272Understanding the SmartScreen Filter 272Modifying Protected Mode 273The Essentials and Beyond 273Appendix A Answers to Review Questions 277Chapter 1 277Chapter 2 278Chapter 3 278Chapter 4 279Chapter 5 280Chapter 6 281Chapter 7 282Chapter 8 282Chapter 9 283Chapter 10 284Chapter 11 285Chapter 12 286Appendix B Microsoft’s Certification Program 287Certification Objectives Map 288Index 293