Back to Information Assurance e-Library Index
| Windows XP: Surviving the First Day - This guide will show how to install Windows XP securely, without being infected by these worms during the patching process. | ||
| Inside Win32 Services, Part I | Don't be the first on the block to own SP2 - by CISSP Ira Winkler; discusses reasons for waiting before installing service pack 2 for Windows XP (SP2 contains a number of new security features). The author recommends waiting a couple of weeks and "watch the dust settle" allowing vendors time to create fixes for compatibility problems. | Infected In Twenty Minutes - According to the author, an unprotected PC running Windows XP will be compromised in twenty minutes on average. In a few months it should be less of an issue because the new PCs will have XP Service Pack 2 already installed so the firewall will be turned on by default. The article also contains links to some good information. |
| Linux Security - Since Linux is becoming more and more popular nowadays. I figured it would be ideal to address the concerns of the Linux community. Since we know that Linux is far more secure than Windows, how might the inception of Linux into the mainstream computing area open security related issues. This website deals alot with Linux/Unix Security. Although Linux/Unix is less vulnerable to attacks, they still exists. The article below talks about security concerns in Linux DNS http://www.math.uwaterloo.ca/mfcf/security/linux_dns.html | Microsoft Launches Government Security Program - Peter Galli (2003) Microsoft, a major antagonist of open source code, WILL be allowing governments around the world to view Windows source code. Their reasoning is because of the new security issues in the world today, that it would better aid governments around the globe. | Security Operations Guide for Windows 2000 Server - Are you looking for ways to lock down Windows 2000 Server and minimize vulnerabilities? Are you looking for best practices on effectively managing patches? Are you looking for guidance on auditing and intrusion detection? If you answered yes to these questions, this resource is for you. |
| Linux, Unix as risky as Windows - CNET Networks, Inc. (2003); "Contrary to popular misperception, Microsoft does not have the worst track record when it comes to security vulnerabilities. Also contrary to popular wisdom, Unix- and Linux-based systems are just as vulnerable to viruses, Trojan horses, and worms," Aberdeen's report states. This is the basis for this article which discusses incidents and advisories (confirmed vulnerabilities) regarding Windows vs open-source software platforms. The Aberdeen study is based on CERT advisories for 2001 and 2002. ( CERT/CC is not to be used as an acronym according to its web site www.cert.org). This article raises an interesting point that Microsoft is changing the rating system for vulnerabilities in response to complaints that far too many "critical" warnings were compelling administrators to patch vulnerabilities even when the critical rating was not warranted by the actual risk. | Securing Operating Systems - by Vijai Gandikota, May 6, 2002; This paper discusses the need for greater operating system security and mandatory access mechanisms. It further discusses the Flask Architecture Implementation of these mechanisms. | Windows XP: Your Definitive Lockdown Guide - Robert J. Shimonski (2002); This is a step by step guide to securing your desktop running Microsoft XP professional. It lays everything out in an easy to read and follow format. |
| Checklist: Create Strong Passwords - (2002); A Microsoft article that discusses the importance of creating strong passwords to help protect indivduals operating system resources. Provides a checklist of do's and don'ts when creating and managing passwords. | Selecting Good Passwords - by David A. Curry; The use of strong passwords is essential for protection of operating system resources. This site discusses the process of selecting good passwords including a rational, why not to use and what to use. | Known NT Exploits - This page attempts to list known NT Exploits used in hacking NT security, and application security related to an NT system. |
| Trustworthy Computing Milestones - LAWRENCE M. WALSH (2003); This article is a list of milestones accomplished by Microsoft duing the last year of their TrustWorthy computing initiative. It shows the things Microsoft is doing to move toword a more secure operating system and build secure software. | HP Threatens Legal Action Against Security Group - By George V. Hulme (2002); This short article goes into some of the current downfall of reporting software vulnerabilities. Here HP has threatened a lawsuit against SnoSoft, for publicizing vulnerabilities in its newly aquired tru64 systems. But more than just releasing the facts the company published the actual exploit code. | Security-Enhanced Linux - This site concerns the release of Security-Enchaced Linux by the National Security Agency of the federal government. It includes FAQ's, background, overview, and a link to download the SE linux. |
| Possible Password Flaw Found in Windows XP - by Ryan B. Patrick (2003); A flaw in Windows XP will allow an unauthorized to boot from the cd and using the recovery console take over the machine as Administrator. visitors can then access files from the hard drive and copy to any removable media. The atricle recommends changing the bios in the PC so it won't boot from a cd or floppy. | GNOSIS: A Prototype Operating System for the 1990's - by Bill Frantz, Norm Hardy, Jay Jonekait, Charlie Landau; Gnosis is a new operating system written to correct some of the problems that exist in traditional operating systems such as VMS. Some of the features of Gnosis, which stands for "the Great New Operating System In The Sky," include firewalls, which provides protection between parts of an application as well as between applications, domains, which are surrounded by firewalls, and capabilities, the tokens of authority. Owning a capability gives a domain the right to do something. | EROS: A Principle-Driven Operating System from the Ground Up - Jonathon S. Sharpiro(2002); The author states that the use of capabilities and transparent persistence distinguishes EROS from most other operating systems. EROS applications are structured as protected, capability-connected components. Capabilities are kernel protected, as are the objects they designate. Any application that executes hostile code, such as a virus, cannot harm the system as a whole or other users under the EROS system. |
| The Amoeba Distributed Operating System - by Andrew S. Tanenbaum & Gregory J. Sharp; Ameoba is a general purpose distributed operating system. A key goal of Ameoba was transparency. One of the two fundamental concepts built into Ameoba was capabilities. When an object is created, the server constructs a 128-bit value called a capability and returns it to the caller. Capabilities are protected cryptographically to prevent tampering. All objects in the system are named and protected using this one simple transparent scheme. | Protection and Security - (2002); This is a class overview on the topic of operating system protection and security. It lists three aspects to operating system security as being authentication, authorization determination, and access enforcement. It also covers access lists, capabilities, and solutions to protecting your system. | A Comparison of the Security of Windows NT and UNIX - Hans Hedbom1, Stefan Lindskog1, Stefan Axelsson and Erland Jonsson (1999);This operating system security comparison of NT and UNIX covers topics such as user identification, access control, authentication, and auditing. Some vulnerabilities of the two operating systems are also listed. The conclusion gave a slight advantage to NT. |
| Security Expert Gives Operating Systems Poor Security Grade - by Robert McMillan; An interesting article that states that operating system design is fundamental to good security. It states that neither windows or linux meet this criteria. It also discusses what role open source software plays in security. | Systems and Systems-Related Topics - Great site for OS security information. Includes checklists for securing various operating systems. | Evolution of OS security- Tutorial on Operating System evolution. |
| Hackers test OS security - (2001); An article about hacker contests to prove that Operating Systems are secure. | Security Guide for Windows - Information on securing the Windows Operating System | General OS Security Site - (2001); This site gives links to security information for numerous operating systems. |
| Tips for Securing Windows 2000 Server - Microsoft Press (2002); This site provides numerous tips on how to better secure the Windows 2000 operating system. The main topics discussed include: Installing the latest security patches, securing the Administrator account, disabling unnecessary services and accounts and using builtin auditing features. | Password Security Guidelines - This document introduces the basic concepts of network authentication. In particular, it focuses on the use of user-IDs and passwords to verify the identity of users. Various strategies for selecting strong, hard-to-guess passwords are then discussed. | Security Analysis of the Palm Operating System and its Weaknesses Against Malicious Code Threats - by Kingpin and Mudge; PDAs (Personal Digital Assistants) are found virtually everywhere in computing environments, but are notoriously insecure. The Palm Operating System devices have a huge market share, despite not being marketed as a secure system. This paper provides detail into specific weaknesses of the Palm OS, several scenarios, and mitigation. |
| Open BSD Security - (2003); Open BSD's project team has put together this page of security issues, advisories, and fixes for the Open BSD project. The page gets a bit heavy-handed in promoting the security fix turnaround time and total disclosure involved in Open Source BSD, but it's still a great resource for those running OpenBSD or considering running it. | Debian GNU/Linux Security - (2003); Security information page for the Debian project. Includes Debian security advisories, status of the various security holes being reviewed, and links to many other Debian project pages. | Cisco Product Security Advisories and Notices - (2003); Security page for Cisco and its products. Contains advisories, information on Cisco's security, and how to report security issues. |
| HP security - 2003; HP-UX is a widely used operating system. This page is the gateway for security information about HP-UX and other HP products. | Trustworthy Yet? - by Lawrence M. Walsh (2003); This article deals with Microsoft's Trustworthy Computing initiative. After releasing XP in 2001, claiming it as the most secure Windows kernel ever, hackers had cracked the OS's antitheft protections within weeks. To show its commitment to security microsoft claims to have suspended development of Windows Server 2003 to do a security review, finding numerous design flaws and security problems. In order to maintain its market share, and stop customers from looking for alternatives, Microsoft looks to be making a real effort to tighten security on it's OS and applications. | Security Startup Hardens Windows Shells - by Scot Petersen (2003); ImmuneEngine is a new product just announced by BBX Technologies Inc. to add an extra layer of security to the Windows system kernels. It is supposed to identify any unaurhorized executables and prevent their execution or shut them down if they are running. It cannot be unloaded or the talk killed even with root privilege. It requires to people to turn off. |
| Optimising operating system security - This article discusses the aspects involved in securing an operating system. | Administering Operating System (OS) Security - This article discusses the recommended practices for OS security. | Windows 2000 Security Technical Overview - (2000); This file discusses the major elements of a Windows 2000 operating system. |
| Unix System Security Checklist - This checklist provides a partial listing of the actions that need to take place to improve security on your Unix system. | CERT Coordination Center Generic Security Information - (1993); The article discusses the security of the operating system Unix and offers specific places to look for suspicious files if it is believed that a machine's security may be compromised. The information in the article can be used in two ways: 1) To help sites that have, or may have, experienced a break-in and 2) To help assess the security of sites that have not experienced a break-in. The information in the article can be used to prevent several types of break-ins. | Unchecked Buffer in Windows Redirector - The article is discusses a security vulnerability that exists in the Windows Redirector of the Windows XP operating system that could allow a local user to elevate their security privileges by exploiting an unchecked buffer. A security vulnerability exists in the implementation of the Windows Redirector on Windows XP because an unchecked buffer is used to receive parameter information. By providing malformed data to the Windows Redirector, an attacker could cause the system to fail, or if the data was crafted in a particular way, could run code of the attacker’s choice. |
| UNIX Computer Security Checklist - 1995; The Australian Computer Emergency Response Team has developed a checklist which assists in removing common and known security vulnerabilities under the UNIX Operating System. It is based around recently discovered security vulnerabilities and other checklists which are readily available. | Windows Security Overview - Simon Clausen; The article offers an overview of Windows security and covers several pages and aspects of Windows operating system security. The article discusses the protection of files, virus scanners, and firewalls. The main focus of the article answers the question of how to make an insecure operating less prone to security problems. | An Architectural Overview of UNIX Network Security - Robert B. Reinhardt (1993); The article presents the concept of the operating system UNIX's network security architecture based on the Internet connectivity model and Firewall approach to implementing security. The article defines several layers of a firewall which depict the layers of vulnerability. The article also provides some subjective comments on some of the most widely known tools and methods available to protect UNIX networks today as well as a brief discussion of the threat and the risk. |
| UNIX Security - Of all the security-related incidents that have occurred over the years, more have involved UNIX systems than any other type of operating system. Although UNIX releases have generally improved in security capability over the years, UNIX is in many respects still the most difficult operating system to secure. Many programs and services that run in the UNIX environment traditionally have had numerous security-related bugs which have led to root-level compromise. | Errata: Security Alerts, Bugfixes, and Enhancements - links to Redhat Linux security alers and bugfixes | Operating Systems Security Issues - by Neil Johnson (2002); Good site with links for practically all operating systems, Linus and Unix as well, and issues as they relate to security of the OS. |
| Keep operating systems and applications software up to date - (2001); The whys and hows of keeping your operating system up to date. There are also good links to vulnerabilities and fixes among others. | Microsoft Forms Academic Advisory Board - Dennis Fisher (2003); Microsoft has enlisted 14 professors from Universities around the world to serve as advisors for their Trustworthy Computing program. | LoveGate worm carries nasty payload - ZDnet (2003); This article is worth reading, a new virus is spreading in Taiwan, Australia, France, and Japan; the LoveGate worm with a Trojan, it's also known as Supnot. I put this article under this category because once the Trojan is active, port 10168 is opened and your PC can be accessed from others. |
| Security Software - a website that offers several different programs that will help improve the security of systems running the UNIX Operating System. | NT Security - Frequently Asked Questions version 0.41 - This is an excellent website for anyone running NT. It is very detailed and provides links to other sites regarding NT related topics. It answers questions regarding general security issues, host security, file systems, network security, user security and much more. | Improve Windows Servers Security - This is a MS TechNet page with many links to security issues and tools to assist in reviewing system security. It addresses multiple operating systems as well as IIS issues. |
| Detecting Server Compromises - Jay Beale (2003); The author answers the question asked by a reader: How can I determine if my Linux server has been hacked? How can I be sure that I haven't been hacked? So if any of you work with Linux this would be an interesting article to read. It may provide insight. | A Bit About Security - Marcus Berglund (1998); This is another good article to read if you are dealing with Linux or Unix, especially if you are trying to secure a system. Marcus explains a several security issues that you may encounter when working with Linux/Unix. | The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments - Peter A. Loscocco, Stephen D. Smalley, Patrick A. Muckelbauer, Ruth C. Taylor, S. Jeff Turner, John F. Farrell (1998); This paper was authored in 1998 and reflects much of the content we have been discussing regarding operating system security. It considers that in any system that supports mandatory security, some applications require special privileges in the mandatory policy in order to perform some security-relevant function. Such applications are frequently called trusted applications because they are trusted to correctly perform some security-related function and because they are trusted to not misuse privileges required in order to perform that function. |
| Windows Security Check List - Auburn University (2002); This site provides a link to a checklist for Windows XP operating system. Also provides additional links regarding general security issues. | A FreeBSD 4.7-RELEASE Operating System Security Checklist - (2003); This document is intended to be a working checklist of security settings implemented on FreeBSD servers version 4.7-RELEASE. It is not intended to be final document, but rather a working, regularly updated tool. (My knowledge is very limited regarding BSD but I know individuals in this class have a love of this product and a disdain for Windows.) | Microsoft: SSL flaw is in operating system, not Web browser- By John Fontana, Network World, AUGUST 15, 2002; This article points out that what was originally thought to be a problem with SSL in the Internet Explorer web browser actually is a problem with the Windows OS software. It is in the crypto of the operating system that exposes confidential information during transmission. Once again, showing vulnerabilities in program code. |
| Microsoft plans new security system in future Windows - By Sam Costello and Peter Sayer June 24, 2002; Microsoft wants to change the fundamental architecture of the PC by adding new security hardware to future release of Windows. | The Memory Management Reference (2001); Various information on memory management for programmers. | File Protection - An article about the unix user file groups. |
| Macintosh Security Simplified - 2002; Different articles relating to security in the MacOS. | Users tout open source security - Phil Hochmuth (2003); A fluff article on Linux security. It's main virtue is an indication of an emerging use of Linux on corporate and commercial servers. | Skeptic View on Unix Security - Nikolai Bezroukov; This article, although UNIX specific, should be required reading for all aspiring sysadmins. This reviews the general attitude that sysadmins ought to have, and identifies specific, real world stragegies for dealing with free-floating security concerns, i.e., how to approach securing a system that only potentially faces attack. An interesting quote -"In the real world, an eight-character mixed alphanumeric password is no more secure than a simple four-character password. Comment: a thought provoking article, I also agree that ultra strong password policies backfire." |
| Challenges in Operating System and Network Security Literature Survey for CPSC 538F - Tim Wellhausen (1999); Site that describes Challenges in Operating System and Network Security | Security Comparison of Mobile OSes - Camillo Särs (2002); This site suggests guidelines that should be followed when it comes to mobile operating system security. | Microsoft Solution for Securing Windows 2000 Server - 2003; Security Operations Guide for Windows 2000 Server, as published my Microsoft |
| 'Rewiring' file-sharing networks may stop attacks | Linux OS hardening - 51 Page Presentation by ThaiCERT | |
| Linux Security | PDA OS Security | Study: Linux' Security Problems Outstrip Microsoft's |
| Security Portal: An overview of OS security features | BSD/OS Security | Windows NT Security |
| Security in IMB z/OS | Mac OS Security | OS security Measures : Linux vs BSD |
| Mac - OS 9 Security | Integralis OS Security | Apple OS Security |
| Open Vulnerability Assessment Language (OVAL) | Unix Security | Unix Security List |
| Unix Password Security - Power Point presentation on the password file in unix | Unix Incompatibility Notes: Password Checking - Jan Wolter(2002); Website about accessing the unix password file | This is a website dedicated to helping folks recover lost or forgotten passwords. It includes cracks for many applications and application modules. It provides many free demos that allow you to crack passwords for various document and spreadsheet files. |
| Dark Tip: Cain & Abel: All-in-one application captures and cracks almost any network password - application demoed on The Screen Savers which airs on TechTV. This product features included a network password sniffer and capability to poison the ARP cache. | ||
Back to Information Assurance e-Library Index
Click here to return to Wayne's World's homepage:
