The last exercise in this module will focus on typical system configuration errors.
You can unwittingly install a malicious program cloaked as a legitimate tool a Trojan horse.
You can fall prey to an automated attack that exploits known vulnerabilities or a lack of regular system
or software updates.
You can also run malware without realizing it.
The malware is hiding in your system through the use of root kids.
That's all true but many problems arise as a result of system misconfiguration.
One of the problems is using an administrator account on a daily basis.
You don't need administrator permissions to read your mailbox or browse the Internet.
Another problem is logging on to domain administrator accounts on a workstation a log on entails the
caching and saving of credentials on the workstations and then the computer's disks.
Users have direct daily access to these machines which are protected with weaker security mechanisms
than servers or administrator computers.
Another problem is also assuming that the default system configuration provides the highest security.
This is not true.
The default configuration is simply the most universal settings.
It is set to run on the largest number of computers with the largest number of installed programs
this configuration is needed neither the most efficient nor the most secure since detecting this type
of errors could be complicated.
Microsoft released a utility called Microsoft baseline security analyzer.
Let's take a closer look at the program.
And BSA is a simple tool that can be used to evaluate system configuration on one or multiple computers.
It can serve to for example check the security state of all computers in the network.
This presentation will analyze a local computer program will check if there are issues with an overuse
of administrator privileges.
For example whether there are too many administrative accounts and BSA will also check if the administrator
accounts are protected with passwords of a sufficient strength.
It will then check for typical vulnerabilities in popular Microsoft services like I as web server and
as you well it will also see if the system and all Microsoft applications are updated.
You can run a scan in the meantime
and BSA connects to a Windows update server.
This could be a local Windows Server or an Internet service next to a digitally signed list of available
applications is downloaded.
The program will compare the list against your computer state and installation of an update is locked
into the event log into the registry.
That's why the software is able to verify at any time if your system lacks a particular update that
has not been revoked.
Since the downloaded file is digitally signed you can be sure that it includes all updates that have
been officially released.
After the scan is completed you can view a report that assesses the configuration of the computer you're
working on.
The generated report first shows the most critical problems you can change the setting of course in
our case it turns out that both software and operating systems are outdated.
Two important updates are missing for software while the operating system lacks 20 updates.
You can also always learn more what you can or should install.
If for some reason you don't know how to do this you can learn this also from the tool
the mentioned vulnerabilities are Martis critical another critical vulnerability that directly bears
on the system security is that 2 of 5 accounts that are created on the system have easy to crack passwords
or have no passwords.
The next vulnerabilities are less critical.
The program can inform us for example that automatic updating is disabled or that passwords don't expire
in either review descriptions for all issues.
Each time they're reported You will also find step by step instructions for solving the problem.
The next part of the report shows information on computer configuration.
There are no problems here especially given that both S and S Cuil don't operate on this computer and
that the Internet Explorer configuration has not been changed.
Microsoft baseline security analyzer is easy to use tool that can quickly find typical administrative
vulnerabilities and tell you how they can be eliminated.
This last case study ends the module this part of the course showed malware threats and the ways for
dealing with the problems.
Thank you.