The 10 most common Windows security vulnerabilities
Most Windows networks, including yours, have a number of security holes. Fortunately, though, many of these holes can be filled quickly and easily before they pose a major threat to your business-critical data. In this tip, learn what security expert Kevin Beaver feels are the 10 most common and correctable Windows security vulnerabilities.
We all know that Windows-based systems have plenty of potential security risks. But are your systems vulnerable? Likely so. Any given network is chock full of Windows vulnerabilities. It's a law of nature and a side effect of doing business using networked computers. But with the thousands of Windows vulnerabilities in the wild, what do you really need to focus your efforts on? Well, let me share with you the Windows-based weaknesses I'm seeing most often in my work -- things that can get you in a bind if you ignore them.
Here's my top 10 list:
- File and share permissions that give up everything to everyone -- This is easily the biggest vulnerability I'm seeing with Windows systems regardless of the type of system or Windows version. Users who create shares to make their local files available across the network are typically the culprits. Sometimes it's careless admins; other times they're honest mistakes. Unfortunately, all too often the "Everyone group" is given full access to every file on the system. Then, all it takes is for an insider to search for sensitive keywords stored in .pdf, .xls, .doc and other file formats using a text search tool such as Effective File Search or FileLocator Pro. Odds are -- nearly 100% of the time -- the attacker will come across sensitive information (SSNs, credit card numbers, you name it) that they shouldn't have access to. Best case scenario, this is an identity theft in the making. Worst case, this becomes a serious breach that makes the headlines.
- Lack of malware protection -- I know, I know, it's really basic but I'm seeing it more now than ever. I've seen antivirus and antispyware software both disabled and not installed at all with no one being aware of the problem.
- Lack of personal firewall protection -- This is another basic security control that's still not enabled on many Windows systems. Even the basic (and free) Windows Firewall can prevent connections to the IPC$ and ADMIN$ shares that are often open and providing information and access that they shouldn't be divulging. Personal firewalls can also block malware infiltrations, wireless intrusions and more. I can't think of a good reason not to use a personal firewall on all workstations and most servers.
- Weak or nonexistent drive encryption -- The drive encryption marketing machine is working its magic, but I'm still seeing the majority of organizations (large and small) not using encryption. I'm of the belief that whole-disk encryption is the only way to go. If a laptop or desktop machine is lost or stolen, the only way to prevent someone from cracking the Windows password and gaining full access to the hard drive is to encrypt everything using reasonable passphrases. Relying on Windows Encrypted File System (EFS) or other file/directory/volume-level encryption puts too much security control in the hands of users and is a breach waiting to happen.
- No minimum security standards -- Users with wireless networks, especially, need to follow secure company policies at their homes, like requiring SSL for Outlook Web Access, a PPTP VPN connection for remote network connectivity or WPA-PSK with a strong passphrase to help ensure everything is safe and sound. This can be tough to enforce without a workstation-based wireless IDS/IPS (typically a component of an enterprise wireless management system) or a well-configured Network Access Control (NAC) system. Nevertheless, make it your policy and enforce it wherever possible.
- Missing patches in Windows as well as third-party software, such as VNC, RealPlayer and others -- This is a big problem that often gets overlooked. I'm not saying you should try to find these types of holes just to claim that patches are missing. Using Metasploit or its commercial alternatives CANVAS and CORE IMPACT, many missing patches can actually be exploited by a rogue insider or outsider who's gotten into your network via other means. Full remote access anyone?
- Weak Windows security policy settings -- Some examples of this include audit logging that is not being enabled for failed events; no password-protected screensavers; not requiring Ctrl+Alt+Del for login; not requiring password complexity; and displaying the last user name that logged in. Polices to control these issues are easy to implement locally on each Windows system for smaller Windows shops not running Active Directory. It's even easier for larger enterprises via Active Directory Group Policy.
- Unaccounted for systems running unknown, and unmanaged, services such as IIS and SQL Server Express -- These are often legacy Windows systems that aren't within the scope of enterprise security and compliance. Sometimes, they're not even supported by third-party security management apps so they get pushed aside. These systems (typically Windows 98, NT and 2000) are often unhardened and unpatched and are waiting to be exploited. Inevitably there's going to be some random training or test system that everyone forgot about. But such a system is all it takes for someone with ill intent to get onto your network and do bad things.
- Weak or nonexistent passwords -- I can't tell you how many systems (especially Windows laptops) I see that do not have a password assigned to the Administrator account or the default user's password is the same as the user name. The password problem has been around since the dawn of time, so there's no excuse for this one.
- Windows Mobile and other mobile device weaknesses -- In today's mobile world, I'd be remiss to not at least mention the vulnerabilities associated with Windows Mobile and similar mobile devices. Some mobile-specific issues are essential to have on your radar. In a tip called Windows mobile security: Get it locked down, I outline several things to consider.
In order to find these vulnerabilities, you're going to need good tools, including port scanners and system enumeration tools, such as SuperScan or, ideally, vulnerability scanners that do it in one fell swoop, such as QualysGuard. An easy-to-use network analyzer such as OmniPeek or CommView is a must, and so is a good hex editor. Last, but certainly not least, you'll have to use your own expertise to manually analyze your systems to check for weaknesses. It's easy to verify whether malware protection is installed but not so simple to determine just how weak file permissions, missing Group Policies and the like can be exploited.
Now that you know what to focus on, you can start finding out what's what. The bottom line is to know what's on your systems and what can be done with your systems. This is the recipe for a secure Windows environment.
ABOUT THE AUTHOR:
Kevin Beaver is an information security consultant, keynote speaker, and expert witness with Atlanta-based Principle Logic LLC, where he specializes in performing independent security assessments. Beaver has authored/co-authored several books on information security including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley). He's also the creator of the Security On Wheels information security audio books and a blog providing security learning for IT professionals on the go. He can be reached at [email protected].
