A family of graphical operating systems produced by Microsoft. Windows includes both server and destop operating systems. Early versions relied on MS-DOS while current versions have evolved from Windows NT. Please do not use this tag for X, but use [x-windows] instead.
8
votes
2answers
3k views
Checklist on building an Offline Root & Intermediate Certificate Authority (CA)
Microsoft allows a CA to use Cryptography Next Generation (CNG) and advises of incompatibility issues for clients that do not support this suite.
Here is an image of the default cryptography settings ...
10
votes
3answers
2k views
How can I prevent someone from accessing a Windows XP system via boot disk?
Apparently a computer system protected by a a login password, e.g. Windows XP, can be easily hacked by someone with physical access to it using methods like this one:
...
6
votes
1answer
2k views
How can I enumerate all the saved RSA keys in the Microsoft CSP?
I have an application that is creating several keys and storing them in various stores (in this case the Machine store).
How can I enumerate all the keys on a given Windows system?
...
7
votes
4answers
338 views
Unknown malware, how to report it and whom to report it to?
I'm a professional Windows system administrator, but I've been caught off-guard (or maybe some malware writer has been very clever) and I caught some unknown malware on my home computer (Windows 7 x64 ...
13
votes
4answers
1k views
Windows hardening
Can anyone point me at some good resources on Windows hardening? From 2003 upwards.
4
votes
2answers
284 views
What features do you look for in an Enterprise Log Management solution?
This question is for IT Pros, and people who manage a company's infrastructure. Developers should see this related answer for tools geared for them.
What are your requirements for such a Event Log ...
4
votes
3answers
278 views
Security of login-data saved in browsers
Most browsers provide an option to save login-data for later use.
Suppose a Windows workstation is located in a well-protected corporate LAN and only a well-defined set of application can be launched ...
13
votes
2answers
7k views
How does the Windows “Secure Desktop” mode work?
Can anyone explain (or provide a link to a simple explanation) of what the Windows "Secure Desktop" mode is and how it works?
I just heard about it in the KeePass documentation (KeePass - Enter ...
11
votes
3answers
696 views
Starting with sandbox development
I am looking for some security related project in which I can contribute and also learn something. Since I am new with this stuff It will be better if that project is less complex and digestible for a ...
5
votes
8answers
2k views
Linux or Windows- the security issue [duplicate]
Possible Duplicate:
Open Source vs Closed Source Systems
Almost anyone who has grown up on Windows must have had the notion (that I had) of Linux being more secure than Windows- one of ...
7
votes
2answers
291 views
How can I restrict what an application can do with my computer?
Often when I install applications on my computer, I realize that I need to trust the application because it can do what ever it want with my computer, e.g. accessing files, listen to my keyboard, ...
24
votes
1answer
965 views
What's the risk if I accidently type my password into a username field (Windows logon)?
I'm used to logging into my personal Mac which is a password-only field (like waking from sleep mode). Sometimes I have to use a Windows network on which I have an account, but of course I have to ...
7
votes
2answers
349 views
How can IA-5(1)(b) be enforced on Windows systems?
Note: I've also posted a question for this issue on non-Windows systems.
In NIST SP 800-53 Rev. 3, IA-5 is the control addressing "Authenticator Management". The requirements in this control include ...
3
votes
2answers
180 views
A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
We have to design and construct a system that signs files with sensible data, like evidences/proofs. The sign process is simple, basically calculate MD5 of the file content and encrypt the MD5 result ...
2
votes
3answers
219 views
Dealing with untrusted administrators in a Windows domain
I'm providing consultation to a company, where they have domain-joined Windows workstations. One basic requirement is that they don't want anyone (including the an administrator) to be able to login ...
1
vote
1answer
266 views
What encryption is possible for ReadyBoost?
ReadyBoost is a technology to assist getting Windows Vista or 7 to load faster on memory-constrained PC's.
Since a USB stick can be easily removed, what security options are available for this ...
17
votes
6answers
450 views
How to deal with a person who gets easily fooled by internet and mail scams?
alternative title: How to deal with a person who has gotten paranoid and doesn't want to go online anymore?
A person, who has over the years been scammed many times, by bad spam/fraud emails, and ...
19
votes
8answers
19k views
Can I determine if my computer has a key logger installed?
A friend of mine just started a job at a security sensitive company. They've provided him with a laptop with Windows XP Professional installed. He's heard a rumor from other employees that the laptops ...
15
votes
3answers
908 views
Why aren't applications sandboxed in Windows?
Sandboxing seem to be a way to restrict what an application can do. Today, I don't have much control of what my applications do with my computer. It feels more secure to use JavaScript based web ...
8
votes
5answers
5k views
How secure is NTFS encryption?
How secure is the data in a encrypted NTFS folder on Windows (XP, 7)?
(The encryption option under file|folder -> properties -> advanced -> encrypt.)
If the user uses a decent password, can this ...
8
votes
3answers
802 views
How can I mitigate the threat that DPAPick poses to my DPAPI protected data?
The Windows Data Protection API (DPAPI) is the suggested method for storing secrets on Windows systems (such as database passwords required by ASP.Net applications).
DPAPick was presented at BlackHat ...
3
votes
3answers
745 views
what is the best keylogger for security uses?
Today we were robbed. A thief come to our home at night and stole some stuff including my brother's laptop.
I think that the right thing to do is to download a keylogger on my PC, just in case...
I ...
2
votes
2answers
2k views
Automating PGP encryption? (Windows)
Let's say I have daily files that need to be encrypted using PGP (and then emailed) and I want to automate this task. I would be using Windows PowerShell to manipulate the files (examine date/times ...
11
votes
3answers
2k views
Three-Factor Authentication for Windows
This HowToGeek article...
http://www.howtogeek.com/67556/how-to-unlock-your-pc-by-being-nearby-with-a-bluetooth-phone/
...got me thinking.
Is there any software (or combination of software) that ...
9
votes
3answers
499 views
How can TOCTTOU vulnerabilities within the Windows OS be mitigated?
What are some ways to mitigate the time-of-check-to-time-of-use issues that apply to Windows permissions?
Example:
End-user is added to the local Administrators group in order to install software, ...
8
votes
3answers
858 views
Am I protected from USB autorun malware on Windows 7?
As far as I know, the autorun.inf problem (the possibility of automatically executing code when a USB stick is plugged in) was solved through Windows Updates for XP, and on 7 it is no longer possible ...
8
votes
5answers
2k views
How can I decrypt data with Java, without hard-coding the key?
I hope this is not a chicken-egg problem or reinventing the wheel but here goes.
I have a Java application that needs to access a password protected file (actually during the application startup).
The ...
6
votes
7answers
2k views
Physical computer security, how to disable USB ports when the computer is 'locked'?
Lets say my PC & server is in an environment where a theoretical attacker has physical access to the machine while I'm not there. Now the data is encrypted on the hard drive with TrueCrypt. ...
5
votes
4answers
517 views
Is disabling auto-run enough to protect against malicious code from removable media automatically infecting a machine?
If I block auto-run on a windows machine, is this enough to protect it from malicious code (assuming I don't run any files manually)?
Or are there known vulnerabilities that may cause infection?
4
votes
3answers
615 views
Windows Honeypot user account for tracking laptop
I've been wanting to create a dummy "Honeypot" user account on my Windows 7 laptop in case of theft.
My question is: Has anyone come across useful resources and tips for doing this? Is there a way ...
10
votes
3answers
324 views
What security requirements do you have for Domain Administrators?
With regard to managing a Windows network, what security polices and processes do you use? For example
Do you require/support Smart Card
Authentication?
Restrict logins
from a particular ...
5
votes
1answer
1k views
How do I apply a security baseline to Windows 2008 R2?
I've setup a Windows 2008 R2 server with an Active Directory Domain Services role. I would like to apply the Specialized Security – Limited Functionality (SSLF) security baseline to it, but am unsure ...
4
votes
1answer
462 views
AIA/CRL locations for Offline Root
I've read the answer to the following "Checklist on building an Offline Root & Intermediate Certificate Authority (CA)" and I have one questions based on the system I am trying building
It's an ...
4
votes
2answers
138 views
Is using a “Red” and a “Green” browser to balance LOB requirements and security a good approach?
I currently work in a manufacturing company with round about 5000 computers and 6000 employees.
We use a lot of web based line of business applications (all internal, non over the Internet) in order ...
3
votes
1answer
221 views
How do I use Windows 7 virtualization features to prevent transitive trust of admin credentials?
I am exploring using VMs to separate my administrative actions from standard user actions in Windows 7. The goal is to limit my risk and exposure when using "RunAs" to open an application or file ...
2
votes
2answers
378 views
how to identify p2p on network
Im trying to work out if the traffic in the below image is P2P file sharing?
If you notice the source ports are all random but the time 17.24 from c.port 58338 runs for a good length maybe about 400 ...
2
votes
6answers
183 views
What are possible approaches and arguments for securing corporate IT systems with most computers being portable?
I was employed as the only system administrator by a company where half of computers are portable ones being taken away for work at home, business trips, visits to clients, etc. having access to ...
6
votes
3answers
257 views
Man-in-the-middle Blue coat proxy ssl or what?
I have just discovered that my workplace have enabled some new feature in the blue coat network proxy. It seems like all https certificates in chrome on windows is being issued by this internal ...
6
votes
5answers
255 views
Windows 2003 Enterprise infected by Conficker; post-infection problems continue
I used various tools to remove Conficker, and I pretty much succeeded, but I've had recurring problems afterward.
It won't update anymore (with the following error message: 0x800706B5)
I tried ...
5
votes
2answers
804 views
Breaking out of a strict linux sandbox running virtually under windows: do the linux-sandbox access control policies even matter?
I am developing an application which will run untrusted code. I have been designing it for linux, thinking that I can just run it in a virtual machine on windows when the need arises. The linux ...
4
votes
5answers
2k views
Preferred UAC configuration in Enterprises that use Login scripts to map drives
In Windows 7, Vista and newer OS's, UAC will prevent logon scripts from mapping hard drives so that the following logon script code won't work:
Dim WshNetwork
Set WshNetwork = ...
3
votes
3answers
248 views
How to effectively (and reasonably) secure Windows in corporate environment.
A member on my staff recently had their work computer compromised while on their home network. The following is the information regarding their computer
Windows XP SP3 - fully patched at the time of ...
3
votes
2answers
107 views
Reading keystrokes of other applications
Is it possible for other application running in the OS to read the keystrokes that my application uses?
What about mouse events and window handles?
Is there any security wall that the OS uses to ...
2
votes
3answers
199 views
Identify a process that uploads data
I am using the tool "Internet Traffic Agent" to monitor my in- and outbound traffic. It shows me clearly that over a period of approx. an hour, some process on my machine is uploading data, about ...
2
votes
1answer
154 views
How should I audit and monitor shared TCP ports in Windows?
Windows has a feature called .NET TCP Port Sharing which allows different .NET applications to share the same TCP/IP port.
I would like to monitor the source and destination connections of each ...
2
votes
1answer
539 views
“Extended Protection” primer and implementation guide to prevent MITM
Extended Protection (link) (link) is a feature in Windows 7 and Windows 2008 R2 that prevents certain MITM attacks.
Does anyone have a primer (or explanation in plain English) what this feature is, ...
1
vote
2answers
164 views
Single File Encryption in a Windows Environment
Would it be correct to assume that encrypting a single file in a Windows environment, for example a simple text file containing login credentials for a variety of accounts, is inherently insecure?
It ...
1
vote
3answers
3k views
Multiple running instances of rundll32.exe
I've noticed that in the Task Manager of Windows 7, I have multiple running instances (2) of rundll32.exe. Does this necessarily means that my machine is infected by a malware as noted here: ...
1
vote
1answer
161 views
About performance of Smart card for performing 3DES in a MD5 hash
Another question related to previous, unanswered A SW system constructed with Microsoft CNG can be FIPS 140-2 Level 2 Compliant?
Another alternative is to store the keys in a Smart card permanently ...
1
vote
1answer
901 views
What are the OIDs (KU and EKU) necessary for Smart Card Authentication in Windows?
MSFT smart card authentication is listed in PKINIT RFC 4556 however I don't see any OIDs listed.
Based on this and this KB article the EKU section of the certificate should contain "Client ...
