46

Let us analyze each one of the techniques you want the AV to protect against: UAC Bypass: Any process in the Windows environment running with the trusted root certificate can turn off the UAC bit of its own process, as well as any process spawned by it. This means that if your malicious code can inject itself into a process running with the trusted cert, it ...


23

One of ISO 27001 requirements is management of access control to company's IT resources. If you just install Ubuntu on your laptop, all the access control will be managed by you directly, instead of your company. So when, for example, your manager will want to fire you, then your IT department won't be able to block your local laptop account in a convenient ...


23

The difference in modern version of Windows is that Autoplay is off by default, but it is still available and can be enabled. However, if you do not know the current Autoplay configuration of a Windows machine, you should check it before inserting a suspect stick.


13

I should start this by saying that no modern A-V is bullet proof and all of them can be bypassed by a determined attacker. So the decision about whether to trust Windows 8's built-in A-V comes down to your priorities and the level of security that you're looking to achieve. There have been some comparative analyses of A-V solutions which reckon that ...


13

The SYSTEM account is a pseudo-account similar, but not identical, to root on Linux. The two primary differences are that (a) the SYSTEM account is a service account, and therefore does not have a user profile, and (b) the Windows permissions model still enforces ACLs such that objects can exist which SYSTEM cannot directly access (though it can still grant ...


13

Windows Credentials Yes, they are stored hashed within files in the c:\Windows\System32\Config\ directory. You will need the SAM and system files. However, a backup of these files may be stored in the Windows repair folder at c:\Windows\Repair\. SAM contains the hashed passwords, however they are encrypted using the boot key within the system file. If ...


13

Graham Hill's answer is absolutely correct in my opinion! I just wanted to add, that there are different ways where usb sticks could harm/infect your computer. Have a look at Bad USB for example.


13

Although you ask specifically about Autoplay, I take your question more generally to be; Can I trust newer operating systems like Windows 8 or 10 to [protect me when I] insert a USB stick? To which I answer, NO, you can not trust any operating system to protect your computer from any USB of unknown origin. You should not plug in any untrusted USB into ...


9

The ISO 27001 is* about documenting what you do, how you do it, and what controls you have in place to audit that things are the way they are supposed to be. That means that the typical laptop installs is very, very standardized with known templates (how you do it). The PCs are likely to be installed in an Active Directory with GPO enforced and monitoring in ...


9

No, the SAK is still Ctrl+Alt+Del, and it never went anywhere. (It never was a technical requirement for logging in, merely a policy decision.) On "consumer" versions of Windows, the SAK (Secure attention key) requirement was disabled for convenience, although can still be enabled via Group Policy, or even via control userpasswords2. Server editions still ...


9

~4 sources that will make you think twice about the security of AV TLS decryption: Antivirus Software Weakens HTTPS Security: Researcher “It seems strange that it turned into something people consider a legitimate security technology. Filtering should happen on the endpoint or not at all. Browsers do a lot these days to make your HTTPS connections more ...


7

KASLR has gotten under heavy critic on the day it was released for Linux, and it has also been defeated on that very day. Spender at grsecurity has written a post about it (along with LWN comments) which I'll only summarize in a simplistic way. I highly encourage reading the original source. Address Space Layout Randomisation was originally applied to ...


7

Security is hard. While I applaud your attempts to use commonly available programs to increase your security, software that wasn't expressly designed for security often does the little things wrong (as you found out). In your case, your rar program makes a local cache of the contents, presumably so it'll run faster - something that most users would be happy ...


6

This is a common issue, and the one thing that you have to keep in mind is that InfoSec serves the company. Your management team runs the company, so their needs are the company's needs. Your job is to educate, educate, educate, not only with technical detail, but with financial impact and risk analysis. But, in the end, it's their call. If they still ...


6

In fact it more works in the opposite direction. To sign in your own PC, you use a password that you instructed your PC to recognize. When you configure your PC to accept a "Microsoft account" you in fact instruct your PC to recognize your Microsoft account password as the "local password" -- and the same password will be used to access Microsoft's servers ...


6

Windows uses a Credential Provider and a SSPI to provide the functionality. The SSPI communicates via web service to the Microsoft endpoints. The endpoints are configured by storing them in a code-signed DLL that gets pushed down via Windows Update. The SSPI will load up the DLL, verify its code signed by Microsoft, and parse out the necessary endpoints. ...


6

While I'd recommend following ekaj's suggestion and trawling your logs to be sure, it sounds very suspicious to me. If you have allowed automated updates, it is possible that this was part of an update script...but usually updates present quite formalised user information. Safest bet is to assume the worst - and wipe it and rebuild. A Powershell running as ...


6

This works as designed, because WinRAR must send a plaintext version of the encrypted file to be processed. It's not a flaw. Lets see why. You have a password protected rar file In this point, all the data are inside the rar, encrypted and protected. Nobody can read them. You open the rar file on WinRAR In this point, all data are still protected, and only ...


5

To access the windows passwords, you'll need both the SAM and SYSTEM file from C:/WINDOWS/SYSTEM32/config On a Linux Distro, like Kali-linux, you can then use the command "bkhive SYSTEM bootkey" to get the bootkey from the system file. Then, use the command "samdump2 SAM bootkey > samdump.txt" to get the hash dump from the SAM file. If you open the file, ...


5

First of all, in such cases stop using the network drive. Deleted files are not immediately lost but just marked as "this space can be reused". If no need of additional space presents itself, a file may be fully recoverable years later. On the other hand, if a new file needs to be created and requires space, the deleted file area might be overwritten after a ...


5

In addition to n00b's answer above, I'd like to point out that autoplay is only disabled by default for removable devices. If you can reprogram the controller (think BadUSB), then you can make a flash drive that tricks the host computer into thinking that the flash drive is really a USB CD drive. There are actually legitimate uses for doing this - for ...


5

If you want to scan HTTPS traffic to find malware, you need to decrypt it. Avast achieves that by installing their own root certificate to locally intercept your web traffic, acting as a man-in-the-middle. (Avast has a blog post explaining their approach.) Is the method they (let's say Avast as an example) use secure? The main emerging security problem ...


5

Looks like a reported bug. Someone blogged about it.


5

I think this computer is connected to domain environment domain controller should be 2008 R2 or higher version. Therefore these ports are needs to open in client side. Sometimes computer might be previously connected to domain and changed to work-group. Read this Article.


4

This depends entirely on your company's policies and standards. ISO 27001 is a system for managing security, but it has few hard requirements for what the policies and standards actually say. I work for an ISO 27001 company that allows technical staff to do self installs of an alternative OS. There are certain technical requirements (company hardware, disk ...


4

It depends on how you copy them. If you do a bitwise copy, aka exactly replicating every single bit from one disk to the other, you are copying over "slack space" which is where the recovery tool will work. If you do a file copy, then the empty space of the disk is ignored, and only the segments of data attached to a file header will copy over. The ...


3

Issue them two laptops: general purpose, and high-security. The general purpose laptop is somewhat like you describe, a balance between security and usability. In fact, your security steps are pretty good, certainly better than average. Hopefully you will keep common viruses off, but you'll never stop an advanced attacker. The high-security laptop is only ...


3

What kind of attack are you trying to protect yourself from? Assuming your only concern is that the data on your lost/stolen laptop will not be readable, then it is OK to carry the recovery key with you. Generally people are very good at securing their wallets, it should be "safe" to keep it on a piece of paper in your wallet. If you're concerned about ...


3

Wear leveling on the SSD will prevent you from completely overwriting existing data, even if the operating system actually tries to put the new file(s) in the same sectors (as the OS sees them) as the old file(s), which is doubtful unless you totally fill the drive each time.


Only top voted, non community-wiki answers of a minimum length are eligible