Chapter 2. Security in the Microsoft Windows Operating
System
ONE OF THE MORE DIFFICULT TASKS when securing any computer system or network is identifying where to start. There are many components in any computing environment. Each component is a potential point of attack.
Since the operating system provides the ability for software and hardware to interact it is a good starting point for securing an entire environment. On any computer, the operating system enables software to access physical resources. For example, it is the operating system that governs how any application actually reads from, or writes to, a physical disk. Consequently, the operating system is a prime candidate for attack and a valuable resource to protect. From an attacker's point of view, a compromised operating system provides easy access to protected information.
Compromising operating system controls gives the attacker the ability to remove evidence of attacks and "clean up" any leftover log entries or other traces of the attack. A secure operating system is the basis of a secure environment. In this chapter you will learn about the Windows operating system architecture and controls to ensure system security. You will also learn how attackers search for, find, and exploit operating system vulnerabilities. With the knowledge of how attackers operate you'll be able to identify and implement the right controls to secure your environment. Chapter 2 Topics
In this chapter, the following topics and concepts are presented:
What the organization of the operating system components and architecture are
What the basic Windows operating system architecture is
What access controls and authentication are
What security tokens, rights, and permissions are
What users, groups, and Active Directory are
What Windows attack surfaces and mitigation are
What fundamentals of Microsoft Windows security monitoring and maintenance are

Chapter 2 Goals
Upon completion of this chapter, you will be able to:
Distinguish operating system components from architecture
Describe the basic Windows OS architecture

Discuss access controls and authentication
Explain security tokens, rights, and permissions
Research the features of several common security tokens
Identify the purposes of users and groups
Discuss the features of directory services
Analyze the business advantages and challenges of Active Directory
Describe Windows attack surfaces and mitigation
Summarize the fundamentals of Microsoft Windows security monitoring and maintenance

Operating System Components and Architecture
In spite of the reference to an "operating system" as a single entity, an operating system is not a single huge program. An operating system is actually a collection of many programs working together, along with data, to provide access to physical resources. The goal of secure information can simply be expressed as simultaneously ensuring both of the following situations:

1. All required information is available to authorized users.
2. No information is available to unauthorized users.
Although these two basic situations appear to be clear and straightforward, simultaneously ensuring both can be challenging. Once security controls are in place, attackers must identify methods to compromise the controls and gain the privileges of an authorized user. The methods attackers use will rely on one or more vulnerabilities. Your goal is to identify and mitigate as much vulnerability as possible to deny the opportunity for an attacker to realize a threat. The first step in planning how to secure the operating system is to understand the purpose of various operating system components. Each operating system component, and the communication between components, can be a potential point of attack. There are many different operating systems in use today, and often multiple versions of each one; however, there are components and services that are common among them.

The Kernel
The central component of most operating systems is the kernel. The kernelis the part of the operating system that may partially reside in memory and provides the backbone of the operating system's services. The classic definition of the kernel states that the entire kernel resides in memory. Today's more complex operating system kernels are made up of both the main memory resident components and external loadable modules. The use of loadable modules reduces the kernel's memory footprint. The kernel provides access to physical resources and

often runs other operating system programs to complete a task. The memory­resident kernel code will directly handle access to the CPU where efficiency is crucial. In other cases where flexibility is more important the kernel will run device driver programs to handle physical resource access. The second approach is slower but makes it easy for the operating system to support a wide variety of hardware from different vendors. All that is needed is a device driver program for the operating system to support a new device.

Warning
Of course, each new device driver means a new potential vulnerability and possible point of attack.
Ensure your systems do not have device drivers installed for retired devices.

Figure 2­1. Operating system kernel.

Note
Some operating system implementations also refer to the maximum privilege mode as supervisor mode. Many current operating systems actually implement microkernelarchitecture. A microkernel only implements the minimal required functionality in memory resident portion of the operating system, such as memory management, inter­process communication, and process scheduling. Other necessary functionality is supported by external programs. The main difference between internal and external programs is the privilege level at which each runs. A pure microkernel only allows memory­resident components to run at kernel, or maximum privilege, mode.
The kernel also includes areas of memory reserved for the operating system data structures. One example of an operating system data structure is the process, or task table. The process table contains one entry for each running process. Each operating system stores different process properties, but the basic information in the process table is consistent. Figure 2­2 shows a few of the types of information the operating system maintains for processes.

Figure 2­2. Windows process table contents.

One common process property is the mode in which a process is run. Processes generally run in either "user mode" or "supervisor mode."Processes run in supervisor mode can perform more tasks and access more restricted parts of the computer system. One way for an attacker to access a protected resource is to modify the process table entry and change a user mode process to supervisor mode. The process table is only one example of a kernel data structure that must be secured from changes. However, processes running in user mode should be able to view the information in the process table to see what is running at any point in time. The kernel keeps track of what processes can do and what they can't.

Operating System Components

Operating System Components
Operating systems contain far more than just the kernel. The kernel provides core services of the operating system and calls external programs to provide many more operating system services. Table 2­1 contains a list of general services most current operating systems provide.
Table 2­1. Operating system general services.
OPERATING

DESCRIPTION

SYSTEM
SERVICE
Program/process

The operating system manages locating, loading, and

management

actually executing all programs. It handles memory allocation, CPU scheduling, and providing the necessary environment for each program.

Input and

Nearly every program requires input and produces

Output

output. The operating system hides the details of the physical hardware and provides programs with the ability to process input and output.

File System

The operating system also provides access to long­ term storage, such as disk drives, and helps to organize the information to make it easily and efficiently accessible.

Communication

Programs often need to communicate with other programs, both locally and on other computers. The operating system provides the support for exchanging information between programs.

Error Detection

The operating system is responsible for monitoring

and Alerts

activities that occur within the computer and for responding when errors occur.

From a security view, the most important concept of this section is that the operating system is the collection of programs that control access to the physical hardware. Since information is stored and transmitted on physical hardware, ensuring the security of protected information starts with ensuring the security of the operating system.

Basic Windows Operating System Architecture
The Microsoft Windows operating system has changed a lot from the simple personal computer operating system,

DOS. It has grown from a single product offering to a full family of products to meet different needs. The current versions of Windows address a wide variety of computing needs, from portable devices and workstations to enterprise class high performance platforms. The Windows operating system is designed to be a modular system to provide the widest variety of services for most platform requirements.
The current versions of client and server operating systems, Windows 7 and Windows Server 2008 R2, are both based on the Windows NT code base. Windows NT was Microsoft's first operating system designed with security in mind. The first commercial version of Windows NT was version 3.1, released in 1993. At the time, Windows NT was a ground­breaking product from Microsoft. Several versions of Windows share a common ancestry back to
Windows NT.

Note
Windows 7 and Windows Server 2008 R2 are both based on the NT 6.1 kernel.

Based on the same kernel, both Windows 7 and Windows Server 2008 R2 operating systems are designed with modified microkernel architectures. The operating system design allows many system functions to be implemented as external programs that run in kernel mode. In a pure microkernel architecture external programs are not allowed to run in kernel mode. Because of the modular nature of Windows major components can be removed, replaced, or enhanced without having to rewrite the entire operating system. This design allows

Microsoft to create different versions of the same base operating system to provide specific services for different client and server environments.

Windows Run Modes
The architecture of the Windows operating system consists of two main layered components ­ user mode programs and kernel mode programs. Kernel mode programs run in a privileged mode, also called kernel or supervisor mode, and interact closely with the physical hardware. User mode programs interact with both users and kernel mode programs. Figure 2­3shows the basic architecture of a Windows operating system.

Figure 2­3. Windows operating system components.

Kernel Mode

Programs running in kernel mode have complete access to the computer's hardware and system services. This level of access is needed by the operating system and provides an attractive target for attackers.
Table 2­2 shows the main kernel mode program components.

technical TIP
One common goal of attackers is to run a program of their choice in kernel mode. At that privilege an attacker can pretty much own a computer. Pay special attention to any vulnerability you encounter that could allow an attacker to escalate privilege to kernel mode.

Table 2­2. Windows kernel mode components.
COMPONENT

DESCRIPTION

Hardware

The HAL provides the actual access to physical

Abstraction

hardware. All other kernel mode programs interact with

Layer (HAL)

hardware through the HAL. This allows Microsoft to support multiple hardware platforms by just writing

different HAL modules, instead of rewriting all operating system programs.
Kernel mode

Kernel mode drivers provide user programs and other

drivers

kernel mode programs access to individual hardware devices, through the HAL. These drivers provide the translation to allow other programs to access devices as file objects.

Microkernel

The microkernel is the memory resident portion of the operating system that provides the core functionality of operating system functionality, including CPU synchronization, process thread/interrupt scheduling, and exception handling.

Executive

The executive is at the "highest level" of the kernel mode programs. It provides services, such as managing objects,
I/O, security, and process management. User mode programs interact with the operating system via the executive. Table 2­3. Windows user mode components.
COMPONENT

DESCRIPTION

Environment

The Environment subsystem provides the ability to run

subsystem

programs written for different operating systems, including previous Windows versions and UNIX.

Integral

The Integral subsystem handles the user mode functions

subsystem

on behalf of the environment subsystem, including login and access control, network access, and providing network services.

User Model
All non­kernel mode programs run under user mode. This includes application programs and the user mode layer of Windows. The Windows user mode layer programs handle all user interaction and processing requests, and pass
I/O requests to the necessary kernel mode drivers, using the executive. Table 2­3 lists the two main user mode program components.

Access Controls and Authentication

Access Controls and Authentication
All computer users, including attackers, need to establish access to a computer system before accessing its resources. The operating system is responsible for providing access to authorized users while denying access to unauthorized users. This process of providing and denying access is calledaccess control. As developers of operating systems have become more concerned with security issues, access control has matured with each new operating system release. Access control is a multi­step process, starting withidentification and authentication. Regardless of the methods used, the operating system needs to identify the user asking for access to a resource. Most often, the user provides a username (or user ID). A username alone is not sufficient to use as a basis for granting access to resources, however. Anyone can claim to be any user. There must be a process that validates that a user is authentic.

Warning
Attackers know that passwords are common and many people have trouble memorizing the complex ones. So an attacker will likely explore words and numbers that are easily remembered, such as birthdays, anniversaries, and names of pets or children. Another favorite attack is to walk around an office and look for sticky notes on monitors and under keyboards. Many users write down passwords there. The authentication process ensures that users are who they claim to be. There are many methods to authenticate users. The most common method in use is the password. Although anyone can claim to be a particular user, no one else but the real user should know the user's password. The ability to provide both the username and password provides the authentication that the user is valid and authentic.

Authentication Methods
Authentication methods aren't limited to just passwords—they can be one of three types. Each type of authentication is useful in different applications and has strengths and weaknesses. Table 2­4 lists the three authentication types:Type I, Type II, and Type III.
Regardless of the type, or types, of authentication used, the authentication system performs the following tasks:
Collects identification credentials, such as a username
Collects authentication credentials, such as a password
Finds the stored information that corresponds to the supplied credentials in the user list, often in an authentication database
Compares the stored credentials to the supplied credentials. If they match, the user is authenticated
Table 2­4. Authentication types.

TYPE

DESCRIPTION

STRENGTHS

WEAKNESSES

I—

Some piece of

Simple to

Password overuse

What

information only a

implement

(using one password in

you

valid user knows. The

Simple for

multiple applications,

know

most common

users

allowing a

examples of Type I

compromised password

authentication is a

to provide access to

password or PIN.

multiple systems)
Writing down complex passwords—easy to find

II—

A physical object that

More secure

More complex to

What

contains identity

than Type I

implement and

you

information, such as a

Little or

distribute devices

have

token, card, or other

nothing to

Must handle lost

device

remember

devices

III—

Physical characteristic

Very secure

Expensive

What

(biometric), such as a

Hard to

Difficult to implement

you

fingerprint, hand

compromise

Slow process in some

are

print, or retina

Nothing to

characteristic

applications

carry or remember The strongest authentication comes from using more than one type at the same time. Using two types of authentication is called two­factor authentication and using more than two types is called multi­factor authentication. Any operating system or application that requests more than one response during authentication is using two­factor or multi­factor authentication. Using more than a single authentication type strengthens the process by increasing the difficulty of impersonating a valid user.

Access Control Methods
Once a user is identified and properly authenticated, the operating system can grant or deny access based on different rule sets. Access control doesn't only apply to users. Any user or program that requests access to a resource is called the access subject. The resource to which the subject requests access is called the access object.
Using these terms, access control is the process of granting or denying subjects access to specific objects.
The most common types of access control rules are mandatory access control (MAC), discretionary access control (DAC), and role based access control (RBAC). DAC strategies are defined primarily at the user, or subject, level. Each object has a defined owner and the owner has complete control over which users can access the object. In an operating system environment this means access is granted to resources based on the user's settings.

Windows extends this concept to allow object properties that can further restrict access. While this approach is simple to define, it can be challenging to maintain in large environments with many users.
The next main type of access control is MAC. A familiar MAC implementation is used in military and government environments. In such an environment, all data objects are labeled with a specific classification. Government classifications include: unclassified, restricted, confidential, secret, and top secret. Likewise, all subjects are granted a specific clearance. A subject must hold a clearance at, or above, the classification level of the desired object to access it. In most environments, subjects must also demonstrate a specific "need to know."
The final type of access control is RBAC. In one point of view, RBAC extends, or generalizes, DAC. Object access is defined by role, as opposed to individual users. Each user is assigned one or more roles. The roles to which a user is assigned define which objects that user (subject) can access. Most operating systems, including Windows do not directly use RBAC, but use a combination of DAC and RBAC. This combination of access control methods is implemented using both user and user group based permissions.

Security Access Tokens, Rights, and Permissions
In a Windows environment each local system defines local users and groups during the installation process. You can add more local users and groups at any time using the Computer Management tool.
The Local Users and Groups section of the Computer Management tool allows you to add, remove, and manage

local users and groups. This tool is most commonly used to create new users and groups, and to associate users with groups. Figure 2­4 shows the Local Users and Groups section of the Computer Management tool.

technical TIP
Here's how to open the Computer Management tool:

1. Select Start
2. Right mouse click Computer (open the Computer context menu)
3. Select Manage

Figure 2­4. Computer Management tool with open Local Users and Groups.

Security Identifier
Each local user and group in Windows has a unique security identifier (SID). Windows uses the SID to identify users and groups, not the names. Once you create a local user or group the SID remains the same, even if you

change the user or group name. There are several well­known users and groups that are defined for all Windows machines, but aside from the Microsoft defined SIDs, all other SIDs are unique to a local machine. Table 2­5 lists a few of the Windows well­known SIDs.
Table 2­5. Well­known SIDs.
WELL­

STRING

KNOWN

IDENTIFIES

VALUE

SID
Null SID

S­1­0­0

Group with no members, often used when a
SID is not known

World

S­1­1­0

Group that includes all members

Local

S­1­2­0

Users who log on local terminals

Creator

S­1­3­0

SID replaced by the SID of the user who

Owner ID
Creator
Group ID

created a new object
S­1­3­1

SID replaced by the primary group SID of the user who created a new object

If you create a user named "Fred" on two different Windows computers each account will have a different SID. To
Windows, the users are completely different, even though they share the same username. This uniqueness between machines makes it difficult to synchronize security settings among multiple standalone computers.
Every time a Windows user logs in, the operating system fetches the user's SID and the SIDs for all groups to which the user is assigned. The operating system also looks up any local rights for this computer. All of the SIDs and local rights are written to an ID object called your Security Access Token (SAT). Your session's SAT is attached to all your processes. When you run any process Windows looks at the SAT and any defined access control information for resources to decide whether to grant or deny access to any requested resources.

Access Rules, Rights, and Permissions
Defining local users and groups is only the first part of the access control implementation process. Windows allows you to associate specific rights and permissions to each user that tell Windows what a user can do.
User rightsdefine tasks that a user is permitted to carry out, such as take ownership of objects or shutdown the computer. Permissions define what a user can do to a specific object, such as read or delete the object. Windows stores access rules, or permissions, for resources (objects) in Access Control Lists (ACLs). Each object has an associated ACL and can be used to allow or deny access to the object by user or group. The most common use of
ACLs to the general user is to protect files or folders. The properties window of files and folders contain a 'Security' page that allows you to change the object's access permissions for specific users or groups. The collection of access permissions for each object is called the object's ACL. Windows uses the SAT attached to the currently running

process and the ACLs defined for a requested resource to decide whether to grant or deny the requested access.

Users, Groups, and Active Directory
Today's computing environments are quickly becoming more diverse and integrated. Fewer environments are comprised of isolated and unconnected personal computers. Windows environments, both home and office are becoming more dependent on shared resources. Even the smallest home networks commonly share printers, storage devices, and network access devices. While defining access permissions for small home networks is fairly easy, the same cannot be said for larger business networks.

Workgroups
In a business network there may be dozens, hundreds, or even thousands of computers. It is desirable to allow users to access network resources from multiple computers attached to the network. By default, Windows allows computers to share resources by creating a workgroup. A workgroup simply allows standalone computers to "see" each other's shared resources. Common shared resources include files, folders, and printers. Each resource can be shared or hidden, and the access to each resource can be controlled by user and group permissions.
So far, workgroups sound good. The main problem with Windows workgroups is that each computer is still defined as a standalone computer. That means users and groups must be defined on multiple computers. In fact, if you want all users to have access on all computers in the workgroup, you have to add the local users on every

computer. On small networks this may seem OK at first, but maintenance can quickly get out of hand. Since all user and group accounts in a workgroup are local accounts, every change to security permissions must be applied to every computer. Administration of workgroups with more than 10 computers can quickly become too difficult to remain viable.

Active Directory
Microsoft offered a solution to local users and groups in the original Windows NT operating system. All Windows operating systems since Windows NT have the ability to share user and group definitions. Many operating systems support a generic capability to share such information, called directory services. This functionality has matured into a core Windows feature, calledActive Directory. Instead of having to define users and groups locally on each computer, Active Directory allows users and groups to be defined once and shared among multiple computers. You get to define the limits of how many computers share users and groups by defining domains. The actual database of shared users and groups is stored on one or more computers designated as domain controllers. There are many more features of Microsoft Active Directory, but its main feature is the ability to define identity andauthorization permission that can be shared among multiple computers within one or more domains. This capability greatly simplifies security administration in larger networks.
Implementing Active Directory requires more hardware for domain controller computers and network devices. It also requires additional administration time and resources to ensure shared information is protected and available in a timely fashion. In fact, securing Active Directory information ensures its integrity, confidentiality, and

availability. An organization that uses Active Directory depends on the security of its information.
The main reason organizations invest in Active Directory resource requirements is not just to make users happy.
While implementing a single sign­on capability is a huge benefit for users in a large organization, the real reason to implement Active Directory is to reduce redundant administrative effort. Securing resources across a network, or multiple networks, requires substantial administrative effort. The amount of redundant controls administrators must keep current opens opportunities for attacks on stale controls. Active Directory automates and centralizes many controls, making the entire environment more secure.
Unlike workgroup environments, a domain user or group definition is defined on the domain controller and its
SID will be the same for all computers in the domain. In the workgroup environment, a user named "Fred" may be defined on each computer, but the SID will be different on each one. Auditing Fred's actions across multiple computers can be more difficult when trying to coordinate multiple SIDs. Active Directory removes the problem of different SIDs on each computer.

Windows Attack Surfaces and Mitigation
Windows, like any operating system, is a collection of services provided to allow users to interact with the physical hardware. Each service provides a specific set of access methods to the hardware and functions that satisfy user requirements. In short, operating system services provide some functionality to users. Each service exposes some part of the computer to external access. Regardless of the care taken to ensure the security of the provided access,

there is a risk when exposing any part of a computer to external access. All computing systems include vulnerabilities—weaknesses that can allow unauthorized access if successfully exploited. The total collection of all possible vulnerabilities that could provide unauthorized access to computer resources is referred to as the attack surface. Another way to define the attack surface is the set of all exposed vulnerabilities.

Multilayered Defense
The discipline of information security is concerned with minimizing the attack surface of any protected resource.
This can be achieved by successfully removing, or substantially reducing, the ability of an attacker to conduct an attack against vulnerability. There are several effective methods to minimize the attack surface. The most secure environments employ a combination of strategies. Most importantly, a solid overall security strategy avoids monolithic solutions. Relying on a single control to protect a resource increases the probability of a successful attack. Always design a defense strategy that is multilayered, which requires multiple controls be compromised to exploit any vulnerability. Such a strategy is often called a defense­in­depth approach to security. Figure 2­
5 shows how a multilayered defense strategy protects resources.
At a high level, the easiest way to reduce the attack surface is to remove functionality. Suppose an attacker wants to exploit Internet Information Services (IIS) Web server vulnerability. The quickest way to deny such an attack is to disable or remove the IIS Web server. Although disabling IIS may be easy it may be unacceptable. What if the server computer in question is a Web server? Disabling IIS in that case is not an option! But in many cases disabling a Web server is perfectly OK. It all depends on the purpose of the server computer and the services it

must provide to be functional. Defining the computer role and configuring the operating system for that role is one of the best ways to reduce the attack surface of any computer.
Proper workstation and server role definition makes it easier during the installation process to only install and enable services that are necessary for a particular computer. By only installing and enabling the necessary services you reduce the operating system's complexity and overall attack surface. Windows Server 2008, (and Windows
Server 2008 R2), include the Server Manager tool that makes it easy to define specific roles for a server. There is even a new installation option available called Server Core that only installs the basic services to support file and print services, Active Directory, and a few other basic server functions. The resulting installation takes up less disk space, consumes less memory, and has a much smaller attack surface due to fewer installed services.

Figure 2­5. Multilayered defense.

Mitigation

Mitigation
If you must install and enable a service, such as the IIS Web server, you must employ measures to protect your system from IIS vulnerabilities. You will learn specific strategies to secure resources throughout the remainder of this book. The strategies you will learn to secure any resource, also called mitigating a risk, fall into two main categories: 1. Remove vulnerabilities
2. Stop attacks from exploiting vulnerabilities
Between the two strategies, the former is the better option. Removing vulnerability by disabling the service or by updating vulnerable software to a more secure version removes the possibility of a successful attack against a specific vulnerability. However, just applying a security patch doesn't guarantee there is no more vulnerability in the service. That's why a multilayered defense is so important. Never rely on a single control or strategy to protect a resource. Always employ multiple levels of controls. Your goal is to make attackers work very hard to exploit resources on protected computers.

Fundamentals of Microsoft Windows Security Monitoring and Maintenance

The process of securing a Windows computer system and maintaining a secure system is an iterative process.
There are three main points in a system's lifecycle that serve as milestones for security management. It is important to maintain a secure system when you:
1. Install the operating system or application software
2. Monitor the operation of the computer system
3. Make any configuration changes to the computer system
The first and third milestones are easy events to identify and result from some administrative action. It is important to include security concerns in the installation and modification procedures to avoid introducing unintended vulnerabilities. For example, the procedure to upgrade to a new version of SQL Server should include steps to ensure insecure user accounts or demo procedures are not added to the system environment. It is also desirable to carry out validation tasks after any new installations or configuration changes to ensure system security meets stated goals. The second milestone occurs at intervals specified by security administrators for each system. Monitoring can be as frequent or infrequent as necessary. Typically the monitoring frequency depends on the volatility of the resource and the risk of attacks against the resource.

Security Monitoring
In general, the process of security monitoring involves comparing performance or configuration information to a

stated baseline. Microsoft offers several tools and resources to help create and maintain secure systems. You will learn about each of these tools and resources in later chapters as you use each one. The basic process of security monitoring is to follow these steps:
1. Define security goals
2. Describe secure behavior as a baseline
3. Sample performance information and compare to the baseline
4. Report anomalies
The tools and resources available for Windows operating systems include both suggested baselines and the tools to compare baselines to system configuration and performance information. System configuration information could include user and group definitions, critical resource permissions, and lists of folders. Baseline information could include a list of known vulnerable users, groups, and folders. Any items in the lists of users, groups, or folders that exist in the baseline could indicate vulnerability. Performance information could include Web server log files.
Monitoring such log files could show attacks that have been carried out against your system. Or even better, you could see the evidence of a pre­attack reconnaissance effort. In the case of the latter example, you could use such information to take action to protect your system from an expected future attack.

Identify Vulnerabilities

The idea behind monitoring is to simply consider the current state of a system and identify any existing security vulnerabilities. You are proactively taking a similar approach of what an attacker will do to plan an attack. After identifying vulnerabilities you must decide how to address each one. It sounds simple, and it really is at its core.
However, putting that goal into practice can be difficult. There are many options to address each vulnerability and you have to choose the best option for each situation. And the process isn't a single occurrence of each step.
Security monitoring and responding to the results is a process you'll repeat over and over to keep your systems secure. CHAPTER SUMMARY
Microsoft Windows is a mature family of operating systems that address the needs of many different types of enterprises and users. The wide variety of information managed by Windows systems and the large number of existing systems that run Windows makes the platform an attractive target for attacks. Attackers know that each new Windows release gives security administrators new and improved tools to help secure protected resources and information. They know the only way to stay ahead of the game, and outsmart Windows administrators, is to know the operating system and its attack surface as well as possible. And they know it well.
The best way to defend your systems from attack is to know as much, if not more, about your operating system and its vulnerabilities as attackers know. Think like an attacker. Know where and how they'll likely attempt to compromise your systems. Anticipate their moves and you'll be better prepared to place deterrents in their path.
You have learned the basics of the Windows operating system architecture. In later chapters you'll build on that

knowledge and add the specific details of what attackers are looking for and how to stop them.

KEY CONCEPTS AND TERMS
Access control
Active Directory
Attack surface
Authentication
Authorization
Classification
Clearance
Control
Discretionary access control (DAC)
Exploit
Hardware Abstraction Layer (HAL)

Identification
Kernel
Mandatory access control (MAC)
Microkernel
Multi­factor authentication
Object
Permission
Right
Role based access control (RBAC)
Security identifier (SID)
Subject
Supervisor mode
Two­factor authentication
Type I authentication
Type II authentication

Type III authentication
User mode

CHAPTER 2 ASSESSMENT
1. Which of the following is not a goal of a secure environment?
1. All required information is available to authorized users.
2. No information is available to unauthorized users.
3. All required information is available to unauthorized users.
4. No classified information is available to unauthorized users.
2. Which term describes the central component of an operating system?
1. Kernel
2. Shell
3. Hardware Abstraction Layer

4. Executive
3. What are the two run modes for Windows programs?
1. Supervisor mode and executive mode
2. Kernel mode and supervisor mode
3. User mode and executive mode
4. Kernel mode and user mode
4. Which of the following Windows components resides in memory to provide the core operating system services?
1. Kernel
2. Microkernel
3. Executive
4. Hardware Abstraction Layer
5. What is the name of the process which proves you are who you say you are?

1. Identification
2. Authorization
3. Permission
4. Authentication
6. Which type of authentication is a smart card?
1. Type I
2. Type II
3. Type III
4. Type IV
7. Which access control method relates data classification to user clearance?
1. MAC
2. DAC
3. RBAC

4. LDAC
8. What value uniquely identifies a user or group in Windows?
1. UID
2. SAT
3. SID
4. ACE
9. If the same user is created on three separate Windows computers, which value is the same on all three computers? 1. SID
2. User code
3. Username
4. SAT
10. Which Windows feature allows users and groups to be "shared" among machines?

1. Domain controller
2. Workgroup
3. SID
4. Active Directory
11. What defines the limit of how many computers share users and groups?
1. SID
2. GUID
3. Domain
4. Workgroup
12. Which of the following best describes the term "attack surface"?
1. All possible vulnerabilities in application software that could be exploited
2. All possible vulnerabilities that could be exploited
3. The most likely avenues of attack

4. Known vulnerabilities that have not been patched
13. When possible, what is the best way to mitigate vulnerability in a specific service?
1. Remove the service
2. Disable the service
3. Block access to the service
4. Patch the service
14. When monitoring a Windows system, with what do you compare current system performance to test for security compliance?
1. The previous monitoring results
2. A normal performance scan
3. A stated baseline
4. A defined security goal
15. Why should you immediately test your system for security compliance after making a configuration change?

1. Configuration changes generally increase security
2. Configuration changes generally decrease security
3. Configuration changes may introduce new vulnerabilities
4. Configuration changes may remove existing vulnerabilities