Understanding Operating System Security

Understanding Operating System Security

Understand user authentication

Scenario #1 - Understand User Authentication

Jim Hance is a security administrator for Coho Winery. A variety of security threats have occurred over the past few months and management is more than a little concerned. They cannot afford to have the system jeopardized; their customers expect a reliable and secure site. Jim is reviewing the security policies for Coho Winery to determine where the company may need stronger policies or at least to update the existing policies and security measures. His first task is determining the company’s strengths as it relates to user authentication

Hint

Reducing the number of times a user has to authenticate can reduce the possibilities of his or her credentials being captured. 

Multiple Choice

Jim knows that stronger passwords are a critical element in the security plan. What characteristics make up a strong password?

• contains 7+ characters; does not contain the user name, real name, or company name

• contains sequential numbers embedded within the company name

• contains the user’s last name and email address

Multiple Choice

What protocol can be used to secure workstation and computer authentication across the network?

• TCP/IP

• Kerberos

• Lightweight Directory Access Protocol

Multiple Choice

What strategy can Jim implement to reduce the number of times a user would have to authenticate to access a particular resource?

• two-factor authentication

• digital certificates

• Single Sign-on (SSO)

Answers/Explination

• 1. A strong password: a. contains 7+ characters; does not contain the user name, real name, or company name

• 2. To secure workstation and computer authentication across the network, Jim can use: b. Kerberos

• 3. To reduce the number of times a user would have to authenticate to access a particular resource, Jim can implement: c. Single Sign-on (SSO)

Essential details

• Authentication is the process of obtaining identification credentials such as name and password from a user and validating those credentials against some authority

• Kerberos authenticates the identity of users attempting to log on to a network and encrypts their communications through secret-key cryptography.

Essential Details cont'

• Lightweight directory access protocol (LDAP) is a network protocol designed to work on TCP/IP stacks to extract information from a hierarchical directory such as X.500.

• Remote authentication dial-in user service (RADIUS) is an Internet protocol in which an authentication server provides authorization and authentication information to a network server to which a user is attempting to link.

Scenario #2 - Understand User Authentication

The Graphic Design Institute (GDI) has more than 30,000 students. The security of the students’ personal information, including financial data, address, family contacts, special health needs, and grades, is the top priority of the network administrative team. However, over the past few months student data has been compromised on several occasions. Personal data has shown up on a social networking site, much to the embarrassment of the network team.

Scenario #2 cont'

GDI officers have asked the network administrator, Todd Rowe, to implement stronger authentication measures for the students, as well as eliminate IT staff from logging on with elevated privileges. Todd has several options, but is aware of the need to keep the processes fairly easy for the helpdesk staff.

Hint

Biometric identification is extremely secure; however, the devices to support biometrics are cost-prohibitive.

Multiple Choice

Todd wants to implement two-factor authentications. What can he use?

• smart card and user password

• two passwords

• two user IDs with two passwords

Multiple Choice

What service can the GDI staff use instead of signing in with elevate privileges?

• Remote Desktop

• Secondary Logon-Run As

• User Manager for Domains

Multiple Choice

What is a disadvantage of using biometric identification?

• the user must have hands

• cost is prohibitive for many organizations

• a retina scan can be faked

Answers

• 1. To implement two-factor authentications, Todd can use: a. smart card and user password

• 2. Instead of signing in with elevated privileges, the staff can use: b. Secondary Logon-Run As

• 3. A disadvantage of biometric identification is: b. cost is prohibitive for many organizations

Essential Details

• A certificate is an electronic credential that authenticates a user on the Internet and intranets

• Public key infrastructure (PKI) is an asymmetric scheme that uses a pair of keys for encryption: the public key encrypts data, and a corresponding secret key decrypts it.

• 
  

Essential Details cont'

• The Run As command allows a user to run specific tools and programs with different permissions than the user’s current logon provides.

• Steps to change your password: • Press and select Change Password

• Steps to use Secondary Logon or Run As. . . • Right-click the application icon and select Run As Administrator

Scenario #3 - Understand Permissions

Fabrikam, Inc. has recently under gone a basic reorganization and a variety of corporate changes. Shawn Richardson is the network administrator at Fabrikam and has been assigned the task of aligning the company servers with the new organizational reality. As a fi rst step, Shawn has completed a security audit of the company’s Microsoft® Windows Server® 2008 R2 fi le servers and has determined that folder and share security needs to be revised based on corporate reorganization. Shawn must present his plan to management and give directions to his team members to complete the project.

Hint

Inheritance allows the propagation for rights or permissions from a parent object to a child object. This feature can be blocked or removed.

Multiple Choice

Shawn has noticed that some shares on the file system are not secured. What is the default permission setting when a share is created?

• everyone with Read permission

• administrators with the Full Control permission

• everybody with the Full Control permission

Multiple Choice

Why should Shawn enforce User Account Control (UAC) across the domain?

• so that he can control the user accounts

• to help prevent unauthorized changes to computers on the domain

• to allow the users to authenticate with the administrator password to perform an administrative task

Multiple Choice

What feature (also available with Active Directory® objects) will make Shawn’s job easier when reassigning permissions by not having to assign permissions to every parent and child folder?

• batch files

• inheritance

• staff people

Answers

• 1. When a share is created, the default permission is: a. everyone with Read permission

• 2. Shawn should enforce User Account Control (UAC) across the domain because: b. it will help prevent unauthorized changes to computers on the domain

• 3. Shawn’s job can be made easier when reassigning permissions by using: b. inheritance

Essential Details

• Permissions include Full control, Modify, Read & Execute, List folder Contents, Read, and Write and can be applied to both folder and file objects. Permissions can also be applied to Active Directory objects.

• Inheritance is the concept of permissions that are propagated to an object from a parent object. Inheritance is found in both file system permissions and Active Directory permissions. It does not apply to share permissions.

• 
  

Essential Details cont'

• New Technology File System (NTFS), FAT, and FAT32. The primary difference between NTFS and FAT file systems is the ability apply security to the file system. You can grant or deny various permissions on NTFS. NTFS also supports the ability to encrypt data.

• Share and NTFS permissions are applied based on how the resource is accessed. Share permissions are effective when the resource is being accessed through the network whereas NTFS permissions are effective all the time. When share and NTFS permissions are applying to the same resource, the most restrictive permission wins.