尊敬的 微信汇率:1円 ≈ 0.046239 元 支付宝汇率:1円 ≈ 0.04633元 [退出登录]
SlideShare a Scribd company logo
Current Article Review
1. Locate a current article about Regulations that has been
published within the last 6 months.
2. Provide a Link to the article or attach a copy of the article.
3. Complete the Summary information below and post this to
the discussion board to share your research with your peers.
4. Post the title of your article and the link to our class
discussion Page. Once an article is listed on the discussion page
it cannot be submitted again by another student.
Title of the article
Topic
Author
Publisher
Date of publication
Link to Article
Main idea of the article:
Information presented: List at least five points made by the
author
1.
2.
3.
4.
5.
Response to the article:
Adjust your audio
This is a narrated slide show. Please adjust your audio so you
can hear the lecture.
If you have problems hearing the narration on any slide show
please let me know.
© ITT Educational Services, Inc. All rights reserved.
1
Security Strategies in Windows Platforms and Applications
Chapter 1
Microsoft Windows and the Threat Landscape
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
© ITT Educational Services, Inc. All rights reserved.
2
Learning Objective and Key Concepts
Learning Objective
Explain information security and how it applies to the Microsoft
Windows operating systems.
Key Concepts
Information security
Microsoft Windows and the typical IT infrastructure
Anatomy of Microsoft Windows systems and their application
vulnerabilities
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
3
Where You’ll Find Microsoft Windows
All vertical markets
90% workstation computers
50% server computers
9% mobile devices
1% super computers
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
4
Defense In Depth
The Total Environment
Physical Security
Desktop Security
Server Security
Network Security
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
5
Security Controls
Administrative Controls
Technical Controls (logical)
Physical Controls
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
6
The C-I-A Triad
Confidentiality
Integrity
Availability
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
7
Seven Domains of a Typical IT Infrastructure
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
A Sample IT Infrastructure
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Common Windows Vulnerabilities
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
10
Access Control
Weak passwords
Weak permissions
Infrastructure
No firewall
Software
Unneeded software running
Shared user accounts
No malware protection
Weak security policy
Weak drive encryption
Unpatched software
Weak applications
Common Forms of Attacks in Windows Environments
Common attacks focus on common applications
Internet Explorer – most common Web browser
Internet Information Services (IIS) – most common Web server
Microsoft Office – most common productivity suit
Windows operating system
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Microsoft Windows – the most common workstation operating
system
11
Common Forms of Attacks in Windows Environments
Windows is not the most insecure – just the most popular
Attackers search for:
Known Microsoft Windows vulnerabilities
Probability is that many lazy users are vulnerable
Microsoft’s weakness is due to its popularity
More Microsoft users means there are more vulnerable
computers
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Discovery-Analysis-Remediation Cycle
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Realizing Threats
Steps attackers take to realize threats:
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Although every attacker is unique, attackers often follow a
general sequence of steps when realizing threats against
computers. The general steps start with discovery, then move on
to research, and then on to planning and actually carrying out an
attack. Here are the individual steps:
Search for accessible computers – The first step is to identify
potential victims. Attackers will use various methods to identify
computers that are both accessible and interesting.
Scan computers for running services/applications – The next
step is to scan potential victim computers to find out what
operating system and other software they are running.
Research potential vulnerabilities – The information from the
previous step enables attackers to research vulnerabilities in the
operating system and software the potential victim is running.
Develop attack plan – Based on the results of the research from
the previous step the attacker will develop a plan for attacks
with the highest probability of success.
Carry out the plan – Follow the attack plan and launch the
attacks.
14
Search for accessible computers.
Scan computers for running services/applications.
Research potential vulnerabilities.
Develop attack plan.
Carry out attack.
Protecting from Threats
Steps you can take to protect from threats:
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Knowing generally how attackers work can help protect your
computers from them. You can protect your environment from
threats by deploying controls to foil an attacker’s activities. In
general, the less you allow an attacker to learn about your
environment the more likely that attacker will move on to
another target.
Here are some high-level steps to protect your environment
from threats:
Apply all available security patches – Current software patches
include the latest fixes for known vulnerabilities. Ensuring you
have the latest patches installed can stop an attacker from
exploiting the vulnerability.
Use a firewall to protect and hide computers from external
scans – Since an attacker’s first step is to identify potential
victims, hiding your computers behind a firewall can discourage
an attacker from selecting your computers as victims.
Disable unneeded services/applications – Reduce the number of
services and applications an attacker can see by disabling the
ones you don’t need.
Configure all necessary services and programs to limit access –
Make it difficult for any unauthorized user to access your
computers or resources.
Perform penetration tests to search for unprotected
vulnerabilities – Act like an attacker and attempt to discover
vulnerabilities.
15
Apply all available security patches.
Use a firewall to protect and hide computers from external
scans.
Disable unneeded services and programs.
Configure all necessary services and programs to limit access.
Perform penetration tests to search for unprotected
vulnerabilities.
Key Roles in Windows Security
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
Solid security for Windows computers requires the efforts of
several key team members. Members that contribute to
establishing and maintaining security act in one of several roles.
The key roles in Windows security include:
Management – The authority for developing and carrying out
the security policy comes from management. Without
management’s involvement and approval no action will take
place that leads to secure environments.
IT Security Professional – Security professionals are
responsible for specifying and enforcing the technical aspects
security policy and ensuring necessary security controls are in
place.
Human Resources – The HR department is responsible for all
personnel related qualification, training, and any other controls
that directly contribute to IT security.
Systems Administrator – System administrators handle the
implementation details of deploying and maintaining security
controls to computer systems.
Network Administrators – Network administrators handle the
implementation details of deploying and maintaining security
controls to network devices, software, systems, and
infrastructure.
Information Systems Users – The users of an information
system are responsible for adhering to the organization’s
acceptable use policies and helping keep their environment
secure.
16
Management
Information Technology (IT)
IT Security Professionals
Human Resource (HR)
Information Systems Users
Systems Administrator
Network Administrator
Summary
Features of a Windows system
Common Windows vulnerabilities
Windows users and groups
Use of Microsoft Windows
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
17
Summary
After you have listened to this lecture and read Chapter 1 in
your text
Go to Discussion Board 1.2 and answer the discussion prompt
There is no quiz or lab assignment this week.
Page ‹#›
Security Strategies in Windows Platforms and Applications
© 2015 Jones and Bartlett Learning, LLC, an Ascend Learning
Company
www.jblearning.com
All rights reserved.
18

More Related Content

Similar to Current Article Review1. Locate a current article about Regul.docx

Security Testing for Test Professionals
Security Testing for Test ProfessionalsSecurity Testing for Test Professionals
Security Testing for Test Professionals
TechWell
 
Security Testing for Test Professionals
Security Testing for Test ProfessionalsSecurity Testing for Test Professionals
Security Testing for Test Professionals
TechWell
 
CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies
CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies
CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies
MorganLudwig40
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
TechWell
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
TechWell
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
TechWell
 
Vulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdfVulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdf
infosec train
 
Information Technology Security Basics
Information Technology Security BasicsInformation Technology Security Basics
Information Technology Security Basics
Mohan Jadhav
 
Security Testing for Test Professionals
Security Testing for Test ProfessionalsSecurity Testing for Test Professionals
Security Testing for Test Professionals
TechWell
 
Protecting endpoints from targeted attacks
Protecting endpoints from targeted attacksProtecting endpoints from targeted attacks
Protecting endpoints from targeted attacks
AppSense
 
OSB170: What a CISO Wants
OSB170: What a CISO WantsOSB170: What a CISO Wants
OSB170: What a CISO Wants
Ivanti
 
Threat Modeling workshop by Robert Hurlbut
Threat Modeling workshop by Robert HurlbutThreat Modeling workshop by Robert Hurlbut
Threat Modeling workshop by Robert Hurlbut
DevSecCon
 
What the New OWASP Top 10 2013 and Latest X-Force Report Mean for App Sec
What the New OWASP Top 10 2013 and Latest X-Force Report Mean for App SecWhat the New OWASP Top 10 2013 and Latest X-Force Report Mean for App Sec
What the New OWASP Top 10 2013 and Latest X-Force Report Mean for App Sec
IBM Security
 
WSO2CON 2024 - How to Run a Security Program
WSO2CON 2024 - How to Run a Security ProgramWSO2CON 2024 - How to Run a Security Program
WSO2CON 2024 - How to Run a Security Program
WSO2
 
Ethical Hacking Conference 2015- Building Secure Products -a perspective
 Ethical Hacking Conference 2015- Building Secure Products -a perspective Ethical Hacking Conference 2015- Building Secure Products -a perspective
Ethical Hacking Conference 2015- Building Secure Products -a perspective
Dr. Anish Cheriyan (PhD)
 
Security overview 2
Security overview 2Security overview 2
Security overview 2
CMR WORLD TECH
 
Proatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security TeamsProatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security Teams
FireEye, Inc.
 
Experience Sharing on School Pentest Project (Updated)
Experience Sharing on School Pentest Project (Updated)Experience Sharing on School Pentest Project (Updated)
Experience Sharing on School Pentest Project (Updated)
eLearning Consortium 電子學習聯盟
 
Information Security Seminar
Information Security SeminarInformation Security Seminar
Information Security Seminar
Acend Corporate Learning
 
Securing your Windows Network with the Microsoft Security Baselines
Securing your Windows Network with the Microsoft Security BaselinesSecuring your Windows Network with the Microsoft Security Baselines
Securing your Windows Network with the Microsoft Security Baselines
Frank Lesniak
 

Similar to Current Article Review1. Locate a current article about Regul.docx (20)

Security Testing for Test Professionals
Security Testing for Test ProfessionalsSecurity Testing for Test Professionals
Security Testing for Test Professionals
 
Security Testing for Test Professionals
Security Testing for Test ProfessionalsSecurity Testing for Test Professionals
Security Testing for Test Professionals
 
CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies
CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies
CHap 13 and 12winsec3e_ppt_ch12(1).pptxSecurity Strategies
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
 
Security Testing for Testing Professionals
Security Testing for Testing ProfessionalsSecurity Testing for Testing Professionals
Security Testing for Testing Professionals
 
Vulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdfVulnerability Analyst interview Questions.pdf
Vulnerability Analyst interview Questions.pdf
 
Information Technology Security Basics
Information Technology Security BasicsInformation Technology Security Basics
Information Technology Security Basics
 
Security Testing for Test Professionals
Security Testing for Test ProfessionalsSecurity Testing for Test Professionals
Security Testing for Test Professionals
 
Protecting endpoints from targeted attacks
Protecting endpoints from targeted attacksProtecting endpoints from targeted attacks
Protecting endpoints from targeted attacks
 
OSB170: What a CISO Wants
OSB170: What a CISO WantsOSB170: What a CISO Wants
OSB170: What a CISO Wants
 
Threat Modeling workshop by Robert Hurlbut
Threat Modeling workshop by Robert HurlbutThreat Modeling workshop by Robert Hurlbut
Threat Modeling workshop by Robert Hurlbut
 
What the New OWASP Top 10 2013 and Latest X-Force Report Mean for App Sec
What the New OWASP Top 10 2013 and Latest X-Force Report Mean for App SecWhat the New OWASP Top 10 2013 and Latest X-Force Report Mean for App Sec
What the New OWASP Top 10 2013 and Latest X-Force Report Mean for App Sec
 
WSO2CON 2024 - How to Run a Security Program
WSO2CON 2024 - How to Run a Security ProgramWSO2CON 2024 - How to Run a Security Program
WSO2CON 2024 - How to Run a Security Program
 
Ethical Hacking Conference 2015- Building Secure Products -a perspective
 Ethical Hacking Conference 2015- Building Secure Products -a perspective Ethical Hacking Conference 2015- Building Secure Products -a perspective
Ethical Hacking Conference 2015- Building Secure Products -a perspective
 
Security overview 2
Security overview 2Security overview 2
Security overview 2
 
Proatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security TeamsProatively Engaged: Questions Executives Should Ask Their Security Teams
Proatively Engaged: Questions Executives Should Ask Their Security Teams
 
Experience Sharing on School Pentest Project (Updated)
Experience Sharing on School Pentest Project (Updated)Experience Sharing on School Pentest Project (Updated)
Experience Sharing on School Pentest Project (Updated)
 
Information Security Seminar
Information Security SeminarInformation Security Seminar
Information Security Seminar
 
Securing your Windows Network with the Microsoft Security Baselines
Securing your Windows Network with the Microsoft Security BaselinesSecuring your Windows Network with the Microsoft Security Baselines
Securing your Windows Network with the Microsoft Security Baselines
 

More from annettsparrow

Initial Post  (250 words)Read and interpret the short story .docx
Initial Post  (250 words)Read and interpret the short story .docxInitial Post  (250 words)Read and interpret the short story .docx
Initial Post  (250 words)Read and interpret the short story .docx
annettsparrow
 
initial post one paragraph intext citation and reference Require.docx
initial post one paragraph intext citation and reference Require.docxinitial post one paragraph intext citation and reference Require.docx
initial post one paragraph intext citation and reference Require.docx
annettsparrow
 
Initial Post InstructionsTriggers are ethnocentric responses to .docx
Initial Post InstructionsTriggers are ethnocentric responses to .docxInitial Post InstructionsTriggers are ethnocentric responses to .docx
Initial Post InstructionsTriggers are ethnocentric responses to .docx
annettsparrow
 
Initial Post InstructionsFor the initial post,consider thr.docx
Initial Post InstructionsFor the initial post,consider thr.docxInitial Post InstructionsFor the initial post,consider thr.docx
Initial Post InstructionsFor the initial post,consider thr.docx
annettsparrow
 
Initial Post InstructionsFor the initial post, choose and ad.docx
Initial Post InstructionsFor the initial post, choose and ad.docxInitial Post InstructionsFor the initial post, choose and ad.docx
Initial Post InstructionsFor the initial post, choose and ad.docx
annettsparrow
 
Initial Post InstructionsDiscuss the differences and similaritie.docx
Initial Post InstructionsDiscuss the differences and similaritie.docxInitial Post InstructionsDiscuss the differences and similaritie.docx
Initial Post InstructionsDiscuss the differences and similaritie.docx
annettsparrow
 
Initial Post InstructionsAs we jump into the world of Alge.docx
Initial Post InstructionsAs we jump into the world of Alge.docxInitial Post InstructionsAs we jump into the world of Alge.docx
Initial Post InstructionsAs we jump into the world of Alge.docx
annettsparrow
 
Initial Post InstructionsFor the initial post, respond to one .docx
Initial Post InstructionsFor the initial post, respond to one .docxInitial Post InstructionsFor the initial post, respond to one .docx
Initial Post InstructionsFor the initial post, respond to one .docx
annettsparrow
 
Initial Post InstructionsAgenda setting can be a difficult t.docx
Initial Post InstructionsAgenda setting can be a difficult t.docxInitial Post InstructionsAgenda setting can be a difficult t.docx
Initial Post InstructionsAgenda setting can be a difficult t.docx
annettsparrow
 
Initial Post Identify all the components of a cell. Describe the fu.docx
Initial Post Identify all the components of a cell. Describe the fu.docxInitial Post Identify all the components of a cell. Describe the fu.docx
Initial Post Identify all the components of a cell. Describe the fu.docx
annettsparrow
 
Initial Discussion Board Post Compare and contrast life for col.docx
Initial Discussion Board Post Compare and contrast life for col.docxInitial Discussion Board Post Compare and contrast life for col.docx
Initial Discussion Board Post Compare and contrast life for col.docx
annettsparrow
 
Infrastructure SecurityChapter 10Principles of Compute.docx
Infrastructure SecurityChapter 10Principles of Compute.docxInfrastructure SecurityChapter 10Principles of Compute.docx
Infrastructure SecurityChapter 10Principles of Compute.docx
annettsparrow
 
Inital post please respond for the above post question one page with.docx
Inital post please respond for the above post question one page with.docxInital post please respond for the above post question one page with.docx
Inital post please respond for the above post question one page with.docx
annettsparrow
 
Infornnation Technologyin Hunnan ResourceAnEmpirical .docx
Infornnation Technologyin Hunnan ResourceAnEmpirical .docxInfornnation Technologyin Hunnan ResourceAnEmpirical .docx
Infornnation Technologyin Hunnan ResourceAnEmpirical .docx
annettsparrow
 
INFORMED CONSENT LETTER Page 1 of 2 SELF CONSENT .docx
INFORMED CONSENT LETTER  Page 1 of 2 SELF CONSENT .docxINFORMED CONSENT LETTER  Page 1 of 2 SELF CONSENT .docx
INFORMED CONSENT LETTER Page 1 of 2 SELF CONSENT .docx
annettsparrow
 
INFORMATIONGOVERNANCEFounded in 1807, John W.docx
INFORMATIONGOVERNANCEFounded in 1807, John W.docxINFORMATIONGOVERNANCEFounded in 1807, John W.docx
INFORMATIONGOVERNANCEFounded in 1807, John W.docx
annettsparrow
 
Informative Presentation Delivery OutlineI. HeaderSpeec.docx
Informative Presentation Delivery OutlineI.  HeaderSpeec.docxInformative Presentation Delivery OutlineI.  HeaderSpeec.docx
Informative Presentation Delivery OutlineI. HeaderSpeec.docx
annettsparrow
 
Informed Consent FormBy the due date assigned, submit the Inform.docx
Informed Consent FormBy the due date assigned, submit the Inform.docxInformed Consent FormBy the due date assigned, submit the Inform.docx
Informed Consent FormBy the due date assigned, submit the Inform.docx
annettsparrow
 
INFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docx
INFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docxINFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docx
INFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docx
annettsparrow
 
Information Technology Capstone ProjectIn this course, learners .docx
Information Technology Capstone ProjectIn this course, learners .docxInformation Technology Capstone ProjectIn this course, learners .docx
Information Technology Capstone ProjectIn this course, learners .docx
annettsparrow
 

More from annettsparrow (20)

Initial Post  (250 words)Read and interpret the short story .docx
Initial Post  (250 words)Read and interpret the short story .docxInitial Post  (250 words)Read and interpret the short story .docx
Initial Post  (250 words)Read and interpret the short story .docx
 
initial post one paragraph intext citation and reference Require.docx
initial post one paragraph intext citation and reference Require.docxinitial post one paragraph intext citation and reference Require.docx
initial post one paragraph intext citation and reference Require.docx
 
Initial Post InstructionsTriggers are ethnocentric responses to .docx
Initial Post InstructionsTriggers are ethnocentric responses to .docxInitial Post InstructionsTriggers are ethnocentric responses to .docx
Initial Post InstructionsTriggers are ethnocentric responses to .docx
 
Initial Post InstructionsFor the initial post,consider thr.docx
Initial Post InstructionsFor the initial post,consider thr.docxInitial Post InstructionsFor the initial post,consider thr.docx
Initial Post InstructionsFor the initial post,consider thr.docx
 
Initial Post InstructionsFor the initial post, choose and ad.docx
Initial Post InstructionsFor the initial post, choose and ad.docxInitial Post InstructionsFor the initial post, choose and ad.docx
Initial Post InstructionsFor the initial post, choose and ad.docx
 
Initial Post InstructionsDiscuss the differences and similaritie.docx
Initial Post InstructionsDiscuss the differences and similaritie.docxInitial Post InstructionsDiscuss the differences and similaritie.docx
Initial Post InstructionsDiscuss the differences and similaritie.docx
 
Initial Post InstructionsAs we jump into the world of Alge.docx
Initial Post InstructionsAs we jump into the world of Alge.docxInitial Post InstructionsAs we jump into the world of Alge.docx
Initial Post InstructionsAs we jump into the world of Alge.docx
 
Initial Post InstructionsFor the initial post, respond to one .docx
Initial Post InstructionsFor the initial post, respond to one .docxInitial Post InstructionsFor the initial post, respond to one .docx
Initial Post InstructionsFor the initial post, respond to one .docx
 
Initial Post InstructionsAgenda setting can be a difficult t.docx
Initial Post InstructionsAgenda setting can be a difficult t.docxInitial Post InstructionsAgenda setting can be a difficult t.docx
Initial Post InstructionsAgenda setting can be a difficult t.docx
 
Initial Post Identify all the components of a cell. Describe the fu.docx
Initial Post Identify all the components of a cell. Describe the fu.docxInitial Post Identify all the components of a cell. Describe the fu.docx
Initial Post Identify all the components of a cell. Describe the fu.docx
 
Initial Discussion Board Post Compare and contrast life for col.docx
Initial Discussion Board Post Compare and contrast life for col.docxInitial Discussion Board Post Compare and contrast life for col.docx
Initial Discussion Board Post Compare and contrast life for col.docx
 
Infrastructure SecurityChapter 10Principles of Compute.docx
Infrastructure SecurityChapter 10Principles of Compute.docxInfrastructure SecurityChapter 10Principles of Compute.docx
Infrastructure SecurityChapter 10Principles of Compute.docx
 
Inital post please respond for the above post question one page with.docx
Inital post please respond for the above post question one page with.docxInital post please respond for the above post question one page with.docx
Inital post please respond for the above post question one page with.docx
 
Infornnation Technologyin Hunnan ResourceAnEmpirical .docx
Infornnation Technologyin Hunnan ResourceAnEmpirical .docxInfornnation Technologyin Hunnan ResourceAnEmpirical .docx
Infornnation Technologyin Hunnan ResourceAnEmpirical .docx
 
INFORMED CONSENT LETTER Page 1 of 2 SELF CONSENT .docx
INFORMED CONSENT LETTER  Page 1 of 2 SELF CONSENT .docxINFORMED CONSENT LETTER  Page 1 of 2 SELF CONSENT .docx
INFORMED CONSENT LETTER Page 1 of 2 SELF CONSENT .docx
 
INFORMATIONGOVERNANCEFounded in 1807, John W.docx
INFORMATIONGOVERNANCEFounded in 1807, John W.docxINFORMATIONGOVERNANCEFounded in 1807, John W.docx
INFORMATIONGOVERNANCEFounded in 1807, John W.docx
 
Informative Presentation Delivery OutlineI. HeaderSpeec.docx
Informative Presentation Delivery OutlineI.  HeaderSpeec.docxInformative Presentation Delivery OutlineI.  HeaderSpeec.docx
Informative Presentation Delivery OutlineI. HeaderSpeec.docx
 
Informed Consent FormBy the due date assigned, submit the Inform.docx
Informed Consent FormBy the due date assigned, submit the Inform.docxInformed Consent FormBy the due date assigned, submit the Inform.docx
Informed Consent FormBy the due date assigned, submit the Inform.docx
 
INFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docx
INFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docxINFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docx
INFORMATION THAT SHOULD GO INTO PROCESS RECORDING FOR MICRO WORK.docx
 
Information Technology Capstone ProjectIn this course, learners .docx
Information Technology Capstone ProjectIn this course, learners .docxInformation Technology Capstone ProjectIn this course, learners .docx
Information Technology Capstone ProjectIn this course, learners .docx
 

Recently uploaded

Contiguity Of Various Message Forms - Rupam Chandra.pptx
Contiguity Of Various Message Forms - Rupam Chandra.pptxContiguity Of Various Message Forms - Rupam Chandra.pptx
Contiguity Of Various Message Forms - Rupam Chandra.pptx
Kalna College
 
220711130083 SUBHASHREE RAKSHIT Internet resources for social science
220711130083 SUBHASHREE RAKSHIT  Internet resources for social science220711130083 SUBHASHREE RAKSHIT  Internet resources for social science
220711130083 SUBHASHREE RAKSHIT Internet resources for social science
Kalna College
 
220711130100 udita Chakraborty Aims and objectives of national policy on inf...
220711130100 udita Chakraborty  Aims and objectives of national policy on inf...220711130100 udita Chakraborty  Aims and objectives of national policy on inf...
220711130100 udita Chakraborty Aims and objectives of national policy on inf...
Kalna College
 
INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION
INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION
INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION
ShwetaGawande8
 
A Free 200-Page eBook ~ Brain and Mind Exercise.pptx
A Free 200-Page eBook ~ Brain and Mind Exercise.pptxA Free 200-Page eBook ~ Brain and Mind Exercise.pptx
A Free 200-Page eBook ~ Brain and Mind Exercise.pptx
OH TEIK BIN
 
Brand Guideline of Bashundhara A4 Paper - 2024
Brand Guideline of Bashundhara A4 Paper - 2024Brand Guideline of Bashundhara A4 Paper - 2024
Brand Guideline of Bashundhara A4 Paper - 2024
khabri85
 
The Science of Learning: implications for modern teaching
The Science of Learning: implications for modern teachingThe Science of Learning: implications for modern teaching
The Science of Learning: implications for modern teaching
Derek Wenmoth
 
How to stay relevant as a cyber professional: Skills, trends and career paths...
How to stay relevant as a cyber professional: Skills, trends and career paths...How to stay relevant as a cyber professional: Skills, trends and career paths...
How to stay relevant as a cyber professional: Skills, trends and career paths...
Infosec
 
bryophytes.pptx bsc botany honours second semester
bryophytes.pptx bsc botany honours  second semesterbryophytes.pptx bsc botany honours  second semester
bryophytes.pptx bsc botany honours second semester
Sarojini38
 
Creative Restart 2024: Mike Martin - Finding a way around “no”
Creative Restart 2024: Mike Martin - Finding a way around “no”Creative Restart 2024: Mike Martin - Finding a way around “no”
Creative Restart 2024: Mike Martin - Finding a way around “no”
Taste
 
Observational Learning
Observational Learning Observational Learning
Observational Learning
sanamushtaq922
 
CIS 4200-02 Group 1 Final Project Report (1).pdf
CIS 4200-02 Group 1 Final Project Report (1).pdfCIS 4200-02 Group 1 Final Project Report (1).pdf
CIS 4200-02 Group 1 Final Project Report (1).pdf
blueshagoo1
 
How to Setup Default Value for a Field in Odoo 17
How to Setup Default Value for a Field in Odoo 17How to Setup Default Value for a Field in Odoo 17
How to Setup Default Value for a Field in Odoo 17
Celine George
 
220711130097 Tulip Samanta Concept of Information and Communication Technology
220711130097 Tulip Samanta Concept of Information and Communication Technology220711130097 Tulip Samanta Concept of Information and Communication Technology
220711130097 Tulip Samanta Concept of Information and Communication Technology
Kalna College
 
220711130082 Srabanti Bag Internet Resources For Natural Science
220711130082 Srabanti Bag Internet Resources For Natural Science220711130082 Srabanti Bag Internet Resources For Natural Science
220711130082 Srabanti Bag Internet Resources For Natural Science
Kalna College
 
Accounting for Restricted Grants When and How To Record Properly
Accounting for Restricted Grants  When and How To Record ProperlyAccounting for Restricted Grants  When and How To Record Properly
Accounting for Restricted Grants When and How To Record Properly
TechSoup
 
How to Create a Stage or a Pipeline in Odoo 17 CRM
How to Create a Stage or a Pipeline in Odoo 17 CRMHow to Create a Stage or a Pipeline in Odoo 17 CRM
How to Create a Stage or a Pipeline in Odoo 17 CRM
Celine George
 
Diversity Quiz Finals by Quiz Club, IIT Kanpur
Diversity Quiz Finals by Quiz Club, IIT KanpurDiversity Quiz Finals by Quiz Club, IIT Kanpur
Diversity Quiz Finals by Quiz Club, IIT Kanpur
Quiz Club IIT Kanpur
 
Project- Comparison among Chhattisgarh and kerala.pptx
Project- Comparison among Chhattisgarh and kerala.pptxProject- Comparison among Chhattisgarh and kerala.pptx
Project- Comparison among Chhattisgarh and kerala.pptx
jeevankraghuraman
 
The basics of sentences session 8pptx.pptx
The basics of sentences session 8pptx.pptxThe basics of sentences session 8pptx.pptx
The basics of sentences session 8pptx.pptx
heathfieldcps1
 

Recently uploaded (20)

Contiguity Of Various Message Forms - Rupam Chandra.pptx
Contiguity Of Various Message Forms - Rupam Chandra.pptxContiguity Of Various Message Forms - Rupam Chandra.pptx
Contiguity Of Various Message Forms - Rupam Chandra.pptx
 
220711130083 SUBHASHREE RAKSHIT Internet resources for social science
220711130083 SUBHASHREE RAKSHIT  Internet resources for social science220711130083 SUBHASHREE RAKSHIT  Internet resources for social science
220711130083 SUBHASHREE RAKSHIT Internet resources for social science
 
220711130100 udita Chakraborty Aims and objectives of national policy on inf...
220711130100 udita Chakraborty  Aims and objectives of national policy on inf...220711130100 udita Chakraborty  Aims and objectives of national policy on inf...
220711130100 udita Chakraborty Aims and objectives of national policy on inf...
 
INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION
INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION
INTRODUCTION TO HOSPITALS & AND ITS ORGANIZATION
 
A Free 200-Page eBook ~ Brain and Mind Exercise.pptx
A Free 200-Page eBook ~ Brain and Mind Exercise.pptxA Free 200-Page eBook ~ Brain and Mind Exercise.pptx
A Free 200-Page eBook ~ Brain and Mind Exercise.pptx
 
Brand Guideline of Bashundhara A4 Paper - 2024
Brand Guideline of Bashundhara A4 Paper - 2024Brand Guideline of Bashundhara A4 Paper - 2024
Brand Guideline of Bashundhara A4 Paper - 2024
 
The Science of Learning: implications for modern teaching
The Science of Learning: implications for modern teachingThe Science of Learning: implications for modern teaching
The Science of Learning: implications for modern teaching
 
How to stay relevant as a cyber professional: Skills, trends and career paths...
How to stay relevant as a cyber professional: Skills, trends and career paths...How to stay relevant as a cyber professional: Skills, trends and career paths...
How to stay relevant as a cyber professional: Skills, trends and career paths...
 
bryophytes.pptx bsc botany honours second semester
bryophytes.pptx bsc botany honours  second semesterbryophytes.pptx bsc botany honours  second semester
bryophytes.pptx bsc botany honours second semester
 
Creative Restart 2024: Mike Martin - Finding a way around “no”
Creative Restart 2024: Mike Martin - Finding a way around “no”Creative Restart 2024: Mike Martin - Finding a way around “no”
Creative Restart 2024: Mike Martin - Finding a way around “no”
 
Observational Learning
Observational Learning Observational Learning
Observational Learning
 
CIS 4200-02 Group 1 Final Project Report (1).pdf
CIS 4200-02 Group 1 Final Project Report (1).pdfCIS 4200-02 Group 1 Final Project Report (1).pdf
CIS 4200-02 Group 1 Final Project Report (1).pdf
 
How to Setup Default Value for a Field in Odoo 17
How to Setup Default Value for a Field in Odoo 17How to Setup Default Value for a Field in Odoo 17
How to Setup Default Value for a Field in Odoo 17
 
220711130097 Tulip Samanta Concept of Information and Communication Technology
220711130097 Tulip Samanta Concept of Information and Communication Technology220711130097 Tulip Samanta Concept of Information and Communication Technology
220711130097 Tulip Samanta Concept of Information and Communication Technology
 
220711130082 Srabanti Bag Internet Resources For Natural Science
220711130082 Srabanti Bag Internet Resources For Natural Science220711130082 Srabanti Bag Internet Resources For Natural Science
220711130082 Srabanti Bag Internet Resources For Natural Science
 
Accounting for Restricted Grants When and How To Record Properly
Accounting for Restricted Grants  When and How To Record ProperlyAccounting for Restricted Grants  When and How To Record Properly
Accounting for Restricted Grants When and How To Record Properly
 
How to Create a Stage or a Pipeline in Odoo 17 CRM
How to Create a Stage or a Pipeline in Odoo 17 CRMHow to Create a Stage or a Pipeline in Odoo 17 CRM
How to Create a Stage or a Pipeline in Odoo 17 CRM
 
Diversity Quiz Finals by Quiz Club, IIT Kanpur
Diversity Quiz Finals by Quiz Club, IIT KanpurDiversity Quiz Finals by Quiz Club, IIT Kanpur
Diversity Quiz Finals by Quiz Club, IIT Kanpur
 
Project- Comparison among Chhattisgarh and kerala.pptx
Project- Comparison among Chhattisgarh and kerala.pptxProject- Comparison among Chhattisgarh and kerala.pptx
Project- Comparison among Chhattisgarh and kerala.pptx
 
The basics of sentences session 8pptx.pptx
The basics of sentences session 8pptx.pptxThe basics of sentences session 8pptx.pptx
The basics of sentences session 8pptx.pptx
 

Current Article Review1. Locate a current article about Regul.docx

  • 1. Current Article Review 1. Locate a current article about Regulations that has been published within the last 6 months. 2. Provide a Link to the article or attach a copy of the article. 3. Complete the Summary information below and post this to the discussion board to share your research with your peers. 4. Post the title of your article and the link to our class discussion Page. Once an article is listed on the discussion page it cannot be submitted again by another student. Title of the article Topic Author Publisher Date of publication Link to Article Main idea of the article: Information presented: List at least five points made by the author 1. 2.
  • 2. 3. 4. 5. Response to the article: Adjust your audio This is a narrated slide show. Please adjust your audio so you can hear the lecture. If you have problems hearing the narration on any slide show please let me know. © ITT Educational Services, Inc. All rights reserved. 1 Security Strategies in Windows Platforms and Applications Chapter 1 Microsoft Windows and the Threat Landscape
  • 3. © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. © ITT Educational Services, Inc. All rights reserved. 2 Learning Objective and Key Concepts Learning Objective Explain information security and how it applies to the Microsoft Windows operating systems. Key Concepts Information security Microsoft Windows and the typical IT infrastructure Anatomy of Microsoft Windows systems and their application vulnerabilities Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 3 Where You’ll Find Microsoft Windows All vertical markets
  • 4. 90% workstation computers 50% server computers 9% mobile devices 1% super computers Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 4 Defense In Depth The Total Environment Physical Security Desktop Security Server Security Network Security Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved.
  • 5. 5 Security Controls Administrative Controls Technical Controls (logical) Physical Controls Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 6 The C-I-A Triad Confidentiality Integrity Availability Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com
  • 6. All rights reserved. 7 Seven Domains of a Typical IT Infrastructure Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. A Sample IT Infrastructure Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Common Windows Vulnerabilities Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com
  • 7. All rights reserved. 10 Access Control Weak passwords Weak permissions Infrastructure No firewall Software Unneeded software running Shared user accounts No malware protection Weak security policy
  • 8. Weak drive encryption Unpatched software Weak applications Common Forms of Attacks in Windows Environments Common attacks focus on common applications Internet Explorer – most common Web browser Internet Information Services (IIS) – most common Web server Microsoft Office – most common productivity suit Windows operating system Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Microsoft Windows – the most common workstation operating system 11 Common Forms of Attacks in Windows Environments Windows is not the most insecure – just the most popular Attackers search for: Known Microsoft Windows vulnerabilities Probability is that many lazy users are vulnerable
  • 9. Microsoft’s weakness is due to its popularity More Microsoft users means there are more vulnerable computers Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Discovery-Analysis-Remediation Cycle Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Realizing Threats Steps attackers take to realize threats: Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Although every attacker is unique, attackers often follow a
  • 10. general sequence of steps when realizing threats against computers. The general steps start with discovery, then move on to research, and then on to planning and actually carrying out an attack. Here are the individual steps: Search for accessible computers – The first step is to identify potential victims. Attackers will use various methods to identify computers that are both accessible and interesting. Scan computers for running services/applications – The next step is to scan potential victim computers to find out what operating system and other software they are running. Research potential vulnerabilities – The information from the previous step enables attackers to research vulnerabilities in the operating system and software the potential victim is running. Develop attack plan – Based on the results of the research from the previous step the attacker will develop a plan for attacks with the highest probability of success. Carry out the plan – Follow the attack plan and launch the attacks. 14 Search for accessible computers. Scan computers for running services/applications. Research potential vulnerabilities. Develop attack plan. Carry out attack.
  • 11. Protecting from Threats Steps you can take to protect from threats: Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. Knowing generally how attackers work can help protect your computers from them. You can protect your environment from threats by deploying controls to foil an attacker’s activities. In general, the less you allow an attacker to learn about your environment the more likely that attacker will move on to another target. Here are some high-level steps to protect your environment from threats: Apply all available security patches – Current software patches include the latest fixes for known vulnerabilities. Ensuring you have the latest patches installed can stop an attacker from exploiting the vulnerability. Use a firewall to protect and hide computers from external scans – Since an attacker’s first step is to identify potential victims, hiding your computers behind a firewall can discourage an attacker from selecting your computers as victims. Disable unneeded services/applications – Reduce the number of services and applications an attacker can see by disabling the ones you don’t need. Configure all necessary services and programs to limit access –
  • 12. Make it difficult for any unauthorized user to access your computers or resources. Perform penetration tests to search for unprotected vulnerabilities – Act like an attacker and attempt to discover vulnerabilities. 15 Apply all available security patches. Use a firewall to protect and hide computers from external scans. Disable unneeded services and programs. Configure all necessary services and programs to limit access. Perform penetration tests to search for unprotected vulnerabilities. Key Roles in Windows Security Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved.
  • 13. Solid security for Windows computers requires the efforts of several key team members. Members that contribute to establishing and maintaining security act in one of several roles. The key roles in Windows security include: Management – The authority for developing and carrying out the security policy comes from management. Without management’s involvement and approval no action will take place that leads to secure environments. IT Security Professional – Security professionals are responsible for specifying and enforcing the technical aspects security policy and ensuring necessary security controls are in place. Human Resources – The HR department is responsible for all personnel related qualification, training, and any other controls that directly contribute to IT security. Systems Administrator – System administrators handle the implementation details of deploying and maintaining security controls to computer systems. Network Administrators – Network administrators handle the implementation details of deploying and maintaining security controls to network devices, software, systems, and infrastructure. Information Systems Users – The users of an information system are responsible for adhering to the organization’s acceptable use policies and helping keep their environment secure. 16 Management Information Technology (IT)
  • 14. IT Security Professionals Human Resource (HR) Information Systems Users Systems Administrator Network Administrator Summary Features of a Windows system Common Windows vulnerabilities Windows users and groups Use of Microsoft Windows Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 17
  • 15. Summary After you have listened to this lecture and read Chapter 1 in your text Go to Discussion Board 1.2 and answer the discussion prompt There is no quiz or lab assignment this week. Page ‹#› Security Strategies in Windows Platforms and Applications © 2015 Jones and Bartlett Learning, LLC, an Ascend Learning Company www.jblearning.com All rights reserved. 18
  翻译: