Windows^TM Vista Security: Securing Vista Against Malicious Attacks

by Roger A. Grimes; Jesper M. Johansson

• ISBN13: 9780470101551
• ISBN10: 0470101555
• Format: Paperback
• Copyright: 2007-07-01
• Publisher: Wiley

Summary

Written by two veteran Windows security experts-one a Microsoft Security MVP and Foundstone Security Consultant, and the other a former senior member of Microsoft's Security Engineering Team-this essential resource prepares end users and technical administrators to handle various security problems that exist in Windows Vista as well as possible future threats. Offering in-depth coverage of all significant new security technologies in Windows Vista, this book addresses User Account Control, the new Firewall, Internet Explorer 7.0, Windows Defender, Service Hardening, and BitLocker.

Author Biography

Roger A. Grimes, CPA, CISSP, four-time MVP, is a 20-year industry veteran and author of seven books and over 200 articles on Windows security. Currently working for Microsoft as an ACE Team senior security consultant, Roger previously taught Windows and Linux security for Foundstone and is a highly requested industry speaker.

Jesper M. Johansson is currently working on application security and developer security training on large software projects. Prior to his current work he was a senior security strategist at Microsoft Corporation and is a well known authority on Windows operating system security. He holds a Ph.D. in Management Information Systems.

Table of Contents

Foreword	p. xxvii
Acknowledgments	p. xxxi
Introduction	p. xxxiii
Introducing Windows Vista	p. 1
New Security Features	p. 3
Security Development Lifecycle	p. 3
Improved C++ Security	p. 4
Address Space Layout Randomization	p. 5
Data Execution Protection	p. 6
Protected Processes	p. 7
Windows Vista User Experience	p. 7
Host-Based Security	p. 8
Boot Changes	p. 8
Boot Configuration Data	p. 8
System Recovery	p. 10
Startup Repair Tool	p. 11
BitLocker Drive Encryption and TPM	p. 11
Security Defaults	p. 12
Windows Defender	p. 13
Malicious Software Removal Tool	p. 13
Improved Logon Architecture	p. 14
LAN Manager Disabled	p. 14
Better Support for Additional Authentication Methods	p. 14
Session Isolation	p. 16
Service Hardening	p. 17
Enhanced Device Driver Experience	p. 18
User-Mode Driver Framework	p. 19
Portable Media Device Control	p. 19
ReadyBoost Memory	p. 19
User Account Control	p. 20
Secure Desktop	p. 21
Mandatory Integrity Control	p. 22
Improved File, Folder, and Registry Protection	p. 23
NTFS Changes	p. 23
Creator Owners Can Be Prevented from Having Full Control	p. 24
Per Socket Permissions	p. 24
New Built-in Users and Groups	p. 24
File and Registry Virtualization	p. 25
Windows Resource Protection	p. 25
Encryption Enhancements	p. 26
EFS Enhancements	p. 27
RMS-Integrated Client	p. 27
Unix on Windows	p. 28
Improved Patch Management	p. 28
Hot Patching and Restart Manager	p. 28
Improved Event Logs	p. 28
Subscription and Forwarded Events	p. 29
Task Manager	p. 30
Increased Emphasis on Backup	p. 31
Securing E-mail and the Internet	p. 31
Windows Mail	p. 31
Internet Explorer	p. 32
IIS 7	p. 34
Securing Windows Networks	p. 34
Enhanced Network Location Awareness	p. 35
Network Map	p. 35
The Rebuilt TCP/IP Stack with IPv6	p. 36
Routing Compartmentalization	p. 36
Windows Firewall	p. 36
Domain Isolation	p. 36
Improved Wireless Security	p. 37
New Peer-to-Peer Networking	p. 37
SMB 2.0	p. 38
Group Policy	p. 38
64-bit Only Improvements	p. 39
Future Improvements	p. 40
Summary	p. 40
Best Practices	p. 42
How Hackers Attack	p. 43
Malicious Exploitation	p. 43
Eight Exploitation Techniques	p. 43
Logon Credential Guessing/Cracking	p. 44
Password Guessing	p. 44
Buffer Overflow	p. 51
Metasploit Framework	p. 53
OS or Application Vulnerability	p. 54
Privilege Escalation	p. 54
Information Disclosure	p. 55
Data Malformation	p. 55
Unintended Consequences	p. 56
OS or Application Misconfiguration	p. 56
Eavesdropping/Man-in-the-Middle Attack	p. 57
Denial of Service Attack	p. 57
Client-Side Attack	p. 58
Social Engineering	p. 59
Dedicated Hacker Methodology	p. 60
Automated Malware	p. 62
Computer Virus	p. 62
Computer Worm	p. 62
Trojan Horse Program	p. 62
Bot	p. 63
Spyware	p. 64
Adware	p. 64
Where Windows Malware Hides	p. 65
Why Malicious Hackers Hack	p. 70
Summary	p. 71
Windows Infrastructure	p. 73
Boot Sequence	p. 74
Boot Viruses No Longer a Threat	p. 76
BitLocker Volume Encryption	p. 76
Enabling TPM and BitLocker	p. 80
Post-Boot Startup	p. 87
Applying Security Policy	p. 88
Name Resolution	p. 89
NetBIOS Name Resolution Is Often Required	p. 90
User Profiles	p. 90
Services	p. 92
Services You Need To Understand	p. 94
Svchost	p. 94
RPC	p. 95
SMB/CIFS	p. 97
Computer Browser, Workstation, and Server Service	p. 98
Autorun Programs	p. 99
Registry	p. 101
Registry Structure	p. 101
HKey_Local_Machine Hive	p. 102
HKey_Classes_Root	p. 103
HKey_Current_Users	p. 107
HKey_Users	p. 107
HK_Current Config	p. 107
Logon Authentication	p. 108
Identity	p. 108
Authentication	p. 109
Computer Accounts	p. 109
Password Storage	p. 110
Authentication Protocols	p. 110
SAM Versus Active Directory	p. 112
Cache Credentials	p. 113
Access Control	p. 114
Share Versus NTFS Permissions	p. 115
Impersonation Versus Delegation	p. 115
Integrity Controls	p. 116
Summary	p. 117
Host-Based Security	p. 119
User Account Control	p. 121
Introduction	p. 121
Basics	p. 123
Security Identifiers	p. 124
Security Token	p. 125
The Case for Least Privilege	p. 128
Admins Are Omnipotent	p. 129
User Account Control Is More Than You Think	p. 129
Elevation	p. 130
Non-Admin Elevation	p. 137
Special Topics in Elevation	p. 139
New Privileges to Delegate Common Tasks	p. 140
Application Factoring	p. 143
Virtualization	p. 145
Integrity Labels and Low Rights Apps	p. 146
Special Treatment of Built-in Administrator	p. 146
No More Power Users	p. 147
UAC and Remote Access	p. 148
SMB Access	p. 148
Remote Desktop and Remote Assistance	p. 148
UAC Policy Configuration	p. 150
User Account Control: AdminApproval Mode for the Built-in Administrator Account	p. 150
User Account Control: Behavior of the Elevation Prompt for Administrators in Admin Approval Mode	p. 150
User Account Control: Behavior of the Elevation Prompt for Standard Users	p. 150
User Account Control: Detect Application Installations and Prompt for Elevation	p. 151
User Account Control: Only Elevate Executables that Are Signed and Validated	p. 151
User Account Control: Only Elevate UIAccess Applications that Are Installed in Secure Locations	p. 152
User Account Control: Run All Administrators in Admin Approval Mode	p. 152
User Account Control: Switch to the Secure Desktop when Prompting for Elevation	p. 152
User Account Control: Virtualize File and Registry Write Failures to Per-User Locations	p. 152
Frequently Asked Questions About UAC	p. 153
Why Can't I Access My Files?	p. 153
Why Can't I Delete Stuff If I Elevate Windows Explorer?	p. 154
How Do I Disable UAC?	p. 156
What Happens If I Turn Off UAC?	p. 157
What Access Do Low Processes Have to High Processes?	p. 157
Why Does the Screen Have to Go Black?	p. 158
I Don't Need UAC; Can I Just Enable It for Other Users?	p. 159
What About Remote Access?	p. 160
Why Isn't UAC More Like Sudo?	p. 160
How Do I Audit Elevation?	p. 162
Leveraging User Account Control in Applications	p. 164
Application Manifests	p. 165
Elevating Installers	p. 166
Elevating in Scripts	p. 166
The Elevate Tool	p. 166
Elevated Command Prompt	p. 166
Summary	p. 168
Best Practices	p. 168
Managing Access Control	p. 171
Access Control Terminology	p. 172
Securable Object	p. 172
Access Control List	p. 173
Security Descriptor	p. 173
Access Control List Entry	p. 174
ACL Representations	p. 174
Inheritance	p. 174
How an Access Control List Is Used	p. 175
Major Access Control List Changes in Vista	p. 178
Least Privilege	p. 179
New and Modified Users and Groups	p. 179
Administrator - Disabled By Default	p. 180
Power Users Permissions Removed	p. 180
Trusted Installer	p. 181
Help and Support Accounts Removed	p. 181
New Network Location SIDs	p. 181
OWNER_RIGHT and Owner Rights	p. 182
Default ACLs	p. 183
Trusted Installer	p. 184
Deny ACEs	p. 184
Default Permissions	p. 186
Share Security	p. 189
Changes to Token	p. 189
Integrity Levels	p. 190
Tools to Manage Access Control Lists	p. 190
Cacls and Icacls	p. 191
Save ACLs	p. 191
Restore ACLs	p. 192
Substitute SIDs	p. 193
Change Owner	p. 194
Find All Aces Granted to a Particular User	p. 195
Resetting ACLs	p. 195
Grant/Deny/Remove	p. 195
Set Integrity Level	p. 196
ACL UI	p. 197
Other Tools	p. 199
Registry ACLs	p. 199
Summary	p. 201
Best Practices	p. 201
Application Security	p. 203
Client Security	p. 203
Service Hardening	p. 204
Service SID	p. 204
Services Running with Less Privilege	p. 205
Reduction of Privileges in Services	p. 205
Write Restricted Tokens	p. 207
Firewall Policies Restricting Services	p. 207
Named Pipes Hardening	p. 207
Windows Resource Protection	p. 209
Session 0 Isolation	p. 210
Sessions	p. 210
Window Stations	p. 211
Desktops	p. 211
Why Session Isolation Is Needed	p. 211
How Session 0 Isolation Works	p. 212
Reducing the Footprint	p. 213
No Longer Installed by Default	p. 214
Gone Altogether	p. 214
Added Instead	p. 215
It Should Have Been Gone	p. 215
Restart Manager	p. 216
ActiveX Installer Service	p. 218
Antivirus	p. 220
Desktop Optimization Pack	p. 221
Summary	p. 222
Best Practices	p. 222
Vista Client Protection	p. 225
Popularity of Client-Side Attacks	p. 225
Malicious Software Removal Tool	p. 226
Security Center	p. 230
Windows Defender	p. 231
Windows Live OneCare	p. 238
Microsoft Forefront Client Security	p. 239
Should Microsoft Be in the Anti-Malware Business?	p. 239
Summary	p. 241
Best Practices	p. 241
Securing Internet and E-mail Access	p. 243
Securing Internet Explorer	p. 245
Should You Use Another Browser?	p. 245
New IE 7.0 Security Features	p. 248
Protected Mode	p. 248
New Low Integrity Folders and Registry Keys	p. 250
IE Compatibility Shims	p. 251
Protected Mode's Impact on Malware and Hackers	p. 253
Anti-Phishing Filter	p. 254
Add-on Management	p. 256
Improved ActiveX Control Handling	p. 257
Improved Digital Certificate Handling and Encryption	p. 257
Improved URL Handling Protections	p. 258
CardSpace	p. 259
Internet Explorer Security Settings	p. 260
Security Zones	p. 260
Local Computer Zone	p. 260
Internet Site Zone	p. 261
Local Intranet Zone	p. 262
Trusted Sites Zone	p. 263
Restricted Sites Zone	p. 263
Zone Security Settings	p. 264
.NET Framework - Loose XAML	p. 264
.NET Framework - XAML Browser Applications	p. 264
.NET Framework - XPS Documents	p. 264
.NET Framework-Reliant Components - Run Components Not Signed with Authenticode	p. 265
.NET Framework-Reliant Components - Run Components Signed with Authenticode	p. 265
ActiveX Controls and Plug-Ins - Allow Previously Unused ActiveX Controls to Run Without Prompting	p. 265
ActiveX Controls and Plug-Ins - Allow Scriptlets	p. 266
ActiveX Controls and Plug-Ins - Automatic Prompting for ActiveX Controls	p. 266
ActiveX Controls and Plug-Ins - Binary and Script Behaviors	p. 266
ActiveX Controls and Plug-Ins - Display Video and Animation on a Web Page That Does Not Use External Media Player	p. 267
ActiveX Controls and Plug-Ins - Download Signed ActiveX Controls	p. 267
ActiveX Controls and Plug-Ins - Download Unsigned ActiveX Controls	p. 267
ActiveX Controls and Plug-Ins - Initialize and Script ActiveX Controls Not Marked as Safe for Scripting	p. 267
ActiveX Controls and Plug-Ins - Run ActiveX Controls and Plug-Ins	p. 268
ActiveX Controls and Plug-Ins - Script ActiveX Controls Marked Safe for Scripting	p. 268
Downloads - Automatic Prompting for File Downloads	p. 268
Downloads - File Download	p. 269
Downloads - Font Download	p. 270
Enable .Net Framework Setup	p. 270
Java VM-Java Permissions	p. 270
Miscellaneous - Access Data Sources Across Domains	p. 270
Miscellaneous - Allow META REFRESH	p. 270
Miscellaneous - Allow Scripting of Internet Explorer Web Browser Control	p. 270
Miscellaneous - Allow Script-Initiated Windows Without Size or Position Constraints	p. 271
Miscellaneous - Allow Web Pages to Use Restricted Protocols for Active Content	p. 271
Miscellaneous - Allow Websites to Open Windows Without Address or Status Bars	p. 271
Miscellaneous - Display Mixed Content	p. 271
Miscellaneous - Don't Prompt for Client Certificate Selection When No Certificates or Only One Certificate Exists	p. 272
Miscellaneous - Drag and Drop or Copy and Paste Files	p. 272
Miscellaneous - Include Local Directory Path When Uploading Files to a Server	p. 273
Miscellaneous - Installation of Desktop Items	p. 273
Miscellaneous - Launching Applications and Unsafe Files	p. 273
Miscellaneous - Launching Programs and Files in an Iframe	p. 273
Miscellaneous - Navigate Sub-Frames Across Different Domains	p. 273
Miscellaneous - Open Files Based on Content, Not File Extension	p. 274
Miscellaneous - Software Channel Permissions	p. 274
Miscellaneous - Submit Non-Encrypted Form Data	p. 274
Miscellaneous - Use Phishing Filter	p. 274
Miscellaneous - Use Pop-Up Blocker	p. 275
Miscellaneous - Userdata Persistence	p. 275
Miscellaneous - Web Sites in Less Privileged Web Content Zone Can Navigate into This Zone	p. 275
Scripting - Active Scripting	p. 275
Scripting - Allow Programmatic Clipboard Access	p. 275
Scripting - Allow Status Bar Updates Via Script	p. 276
Scripting - Allow Websites to Prompt for Information Using Scripted Window	p. 276
Scripting - Scripting of Java Applets	p. 277
User Authentication	p. 277
IE Advanced Settings	p. 282
Browsing - Disable Script Debugging (Internet Explorer or Other)	p. 282
Browsing - Display a Notification About Every Script Error	p. 282
Browsing - Enable Third-Party Extensions	p. 282
Browsing - Use Inline Autocomplete	p. 282
International - Send UTF-8 URLS	p. 283
Java (or Java-Sun) - Use JRE x.x for [left angle bracket]applet[right angle bracket]	p. 283
Security - Allow Active Content from CDs to Run on My Computer	p. 283
Security - Allow Active Content to Run in Files on My Computer	p. 283
Security - Allow Software to Run or Install Even If the Signature Is Invalid	p. 283
Security - Check for Publisher's Certificate Revocation	p. 283
Security - Check for Server Certificate Revocation	p. 284
Security - Check for Signatures on Downloaded Programs	p. 284
Security - Do Not Save Encrypted Pages to Disk	p. 284
Security - Empty Temporary Internet Files Folder When Browser Is Closed	p. 284
Enable Memory Protection to Help Mitigate Online Attacks	p. 285
Security - Enable Integrated Windows Authentication	p. 285
Security - Phishing Filter Settings	p. 286
Security - Use SSL 2.0, SSL 3.0, TLS 1.0	p. 286
Security - Warn About Invalid Site Certificates	p. 287
Security - Warn If Changing Between Secure and Not Secure Mode	p. 287
Security - Warn If Forms Submittal Is Being Redirected	p. 287
Other Browser Recommendations	p. 288
Don't Browse Untrusted Web Sites	p. 288
Keep IE Patches Updated	p. 289
Will Internet Explorer 7 Be Hacked A Lot?	p. 289
Summary	p. 290
Best Practices	p. 290
Introducing IIS 7	p. 293
Web Server Threats	p. 293
Application Vulnerabilities	p. 294
OS Vulnerabilities	p. 295
Back-End Database Issues	p. 295
Protocol Vulnerabilities	p. 295
Buffer Overflows	p. 296
Directory Traversal Attacks	p. 296
Sniffing Attacks	p. 297
Denial of Service	p. 298
Password Guessing Attacks	p. 299
Introduction to IIS	p. 299
New IIS Features	p. 300
Installing IIS 7	p. 301
IIS Components	p. 302
IIS Protocol Listeners	p. 307
HTTP.SYS	p. 308
Net.TCP	p. 308
Net.Pipe	p. 308
Net.P2P	p. 308
Net.MSMQ	p. 309
Worker Processes, Application Pools, and Identities	p. 309
Worker Processes	p. 309
Application Pools	p. 309
Application Pool Identities	p. 311
IUSR and IIS_USRS	p. 314
IIS Administration	p. 315
Feature Delegation	p. 316
IIS Authentication	p. 318
Anonymous Authentication	p. 320
ASP.NET Impersonation	p. 320
Basic Authentication	p. 322
Digest Authentication	p. 322
Forms Authentication	p. 322
Windows Authentication	p. 322
Client Side Mapping	p. 323
Web Server Access Control Permissions	p. 326
IIS Handler Permissions	p. 326
NTFS Permissions	p. 332
Defending IIS	p. 332
Step Summary	p. 333
Configuring Network/Perimeter Security	p. 333
Ensuring Physical Security	p. 334
Installing Updated Hardware Drivers	p. 334
Installing an Operating System	p. 334
Configuring a Host Firewall	p. 335
Configuring Remote Administration	p. 335
Installing IIS in a Minimal Configuration	p. 336
Installing Patches	p. 336
Hardening the Operating System	p. 337
Configuring and Tightening IIS	p. 339
Installing Additional IIS Features	p. 340
IIS 7 Modules	p. 340
Minimizing Web Components Even Further	p. 342
Feature Delegation	p. 342
Strengthening NTFS Permissions	p. 342
Configuring Request Filtering	p. 343
Securing Web Sites	p. 344
Hardening NTFS Permissions	p. 344
Web Site IP Settings	p. 346
Application Pool Changes	p. 346
Cleaning and Testing	p. 347
Installing and Securing Applications	p. 347
Conducting Penetration Tests	p. 347
Deploying to Production	p. 347
Monitoring Log Files	p. 348
Summary	p. 348
Protecting E-mail	p. 351
E-mail Threats	p. 351
Malicious File Attachments	p. 351
File Extension Tricks	p. 380
Embedded Content	p. 381
Embedded Links	p. 382
Leaked Passwords	p. 383
Other Miscellaneous E-mail Threats	p. 383
Introducing Windows Mail	p. 384
Phishing Detection	p. 385
Improved Junk Mail Detection	p. 386
Sender White Lists and Black Lists	p. 387
Top-Level Domain Blocking	p. 387
Simplified E-mail Storage	p. 390
E-mail Defenses	p. 390
Convert All E-mail to Plain-text	p. 391
Execute All HTML Content in the Restricted Zone	p. 393
Disable Automatic Downloading of HTML Content	p. 394
Filter Out Dangerous File Attachments	p. 395
Install Anti-Malware Software	p. 398
Disable Plain-Text Passwords	p. 398
Summary	p. 398
Best Practices	p. 399
Securing Windows Networks	p. 401
Managing Windows Firewall	p. 403
New Features	p. 405
Windows Filtering Platform	p. 405
IPv6	p. 406
Integration with IPsec	p. 407
Stealth	p. 408
Boot Time Filtering	p. 409
Strict Source Mapping	p. 410
Service Hardening and the Firewall	p. 411
IPv6	p. 412
Outbound Filtering	p. 412
How Much Security Can Outbound Filtering Provide?	p. 413
Firewall Management	p. 417
Firewall Profiles	p. 417
Management Interfaces	p. 419
Windows Firewall Control Panel	p. 419
Security Center	p. 421
Windows Firewall with Advanced Security	p. 422
Group Policy Editor	p. 422
Netsh	p. 423
Application Programming Interfaces	p. 424
Rule Types	p. 426
Directional Rules	p. 427
Connection Security Rules	p. 427
When to Use Which Rules	p. 428
Rule Precedence	p. 428
Firewall Scenarios	p. 429
Restricting Access Based on End-Point	p. 429
Blocking Outbound SMB in Public Profile	p. 436
Allowing Management Traffic via VPN	p. 437
Managing Firewall in a Mixed or Down-Level Environment	p. 438
RPC	p. 442
Summary	p. 443
Best Practices	p. 444
Server and Domain Isolation	p. 445
Server and Domain Isolation Overview	p. 445
Domain Isolation	p. 446
Server Isolation	p. 447
Forget About the Perimeter	p. 448
Network Threat Modeling	p. 450
Changes in Windows Vista Affecting SDI	p. 451
AuthIP	p. 451
Client-to-DC IPsec	p. 451
Authentication with Multiple Credentials	p. 451
Improved Negotiation Flow	p. 452
Vastly Improved Configuration User Interface	p. 453
Domain Isolation Rules	p. 454
Server Isolation Rules	p. 457
Summary	p. 458
Best Practices	p. 459
Wireless Security	p. 461
Wi-Fi Terminology and Technologies	p. 461
Wi-Fi Standards	p. 462
Infrastructure versus Ad-Hoc Mode	p. 462
Wi-Fi Standards	p. 463
Wi-Fi Security Standards	p. 464
Wired Equivalent Privacy	p. 465
Wi-Fi Protected Access/802.11i	p. 466
Wireless Threats	p. 471
Eavesdropping	p. 472
Unauthorized Access	p. 474
Bypassing of Traditional Defenses	p. 474
Malware Injection	p. 474
Denial of Service Attacks	p. 475
New Wireless Improvements in Vista	p. 476
Securing Wireless Networks	p. 477
802.11 Legacy Wireless Security Recommendations	p. 477
Changing Access Point's Default SSID	p. 478
Enabling MAC Filtering	p. 478
Disabling DHCP on the Access Point	p. 478
Requiring User Authentication Passwords	p. 479
Turning Off SSID Broadcasting	p. 479
Changing an Access Point's Default Administrator Password	p. 480
WEP	p. 480
VPN Protocols	p. 481
Using WPA	p. 481
Using WPA2/802.11i	p. 481
Summary	p. 482
Best Practices	p. 482
Group Policy and Best Practices	p. 483
Using Group Policy	p. 485
New Group Policy Features	p. 486
Multiple Local Group Policies	p. 486
Group Policy Precedence	p. 489
Using MLGPOs in a Domain Environment	p. 491
Difference between Local GPOs and Domain GPOs	p. 491
New Administrative Template Format	p. 492
Template Embedding	p. 493
Migrating to ADMX	p. 493
Client-Side Pulling and Network Location Awareness	p. 493
Updated Group Policy Features	p. 494
Group Policy Management Console v. 2.0	p. 494
Internet Explorer Management Without IEAK	p. 495
Group Policy Application Factored from Winlogon	p. 496
Group Policy Logging Moved to System Event Log	p. 497
New or Updated Group Policy Settings	p. 498
New Security Options	p. 498
Security Options with Modified Defaults	p. 498
Removed Security Options	p. 504
New Administrative Template Settings	p. 504
Settings That Require Reboot or Logon	p. 510
Windows Vista Security Guide	p. 510
Do You Need the Vista Security Guide?	p. 511
What Is Good in the Vista Security Guide	p. 511
What Could Have Been Better in the Vista Security Guide	p. 511
Importance of the Guide	p. 513
Active Directory Schema Updates	p. 514
Managing Group Policy in a Mixed Environment	p. 514
Rollout Strategy	p. 515
Logon Scripts Fail Because of UAC	p. 516
Using Group Policy in a NAP Environment	p. 516
Summary	p. 517
Best Practices	p. 518
Thinking about Security	p. 519
It Still Comes Down to Risk Management	p. 520
Jesper's Position	p. 520
Roger's Position	p. 520
Enterprise Risk Management	p. 521
The Three-Step Approach to Security	p. 523
Keep 'em Off the Box	p. 524
Keep 'em from Running	p. 524
Keep 'em from Communicating	p. 525
Thinking Differently about Security	p. 526
The Top 2 (+ or -1, or so) Client Security Hacks	p. 526
Jesper's Thoughts	p. 526
Roger's Thoughts	p. 528
Anti-Malware Is Not a Panacea	p. 530
Jesper's Thoughts	p. 530
Roger's Thoughts	p. 532
Tweaking It	p. 532
Security Tweaks You Should Make	p. 533
Turn on DEP for Internet Explorer	p. 536
Security Tweaks You Shouldn't Make	p. 536
Agreeing to Disagree	p. 539
Jesper's Position	p. 541
Roger's Position	p. 545
Wetware	p. 546
Summary	p. 547
Best Practices	p. 547
Building a Windows PE Boot Disk	p. 549
Building a WinPE Bootable USB Flash Drive	p. 549
Downloading WAIK	p. 550
Building the WinPE Image	p. 550
References	p. 555
Index	p. 561
Table of Contents provided by Ingram. All Rights Reserved.