CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.5  Security Baselines            9  3.5.1  OS/NOS Hardening

Some Areas to Look At When Hardening an OS 1 2 3.5.1.2  Updates

Windows/NTFS

Windows NTFS-based file systems typically provide the following permissions, accessed by right clicking to open a file’s Properties menu and then selecting the Security tab:

• Read – Read files, list the names of files in directories, read attributes and permissions, synchronize.
  
  
• Write – Create and write files, create folders, write attributes, read permissions, synchronize.
  
  
• Modify – Same as “Read and Execute”, plus create and write files, create folders, write attributes, delete.
  
  
• Read and Execute – Same as “Read” permissions, plus allow users to run program files and travel through directories to reach lower level files.
  
  
• List Folder Contents – Same as “Read and Execute”.
  
  
• Full Control – allows all of the above, plus delete subfolders and files, change permissions, and take ownership.

Each of these permissions can be granted to a user or group that the OS knows about. Be cautious about granting Full Control, since that gives the user “the keys to the kingdom” as far as that file is concerned. In reality, these permissions are just a convenient way of specifying useful groups of finer-grained permissions. The full list of permissions can be accessed via the “Advanced” tab.

UNIX/Linux file systems typically provide the following permissions, which you can specify separately for the owner of the file, users who are in the “group” that is assigned to the file, and everyone else (a.k.a. “other” in UNIX speak):

• Read – allow users to read files, and list the names of files in directories.
  
  
• Write – allow users to write and rewrite files, and create and delete files in directories.
  
  
• Execute – allow users to run program (script and binary) files, and travel through directories to reach lower level files.

As you can see, the UNIX permissions model is considerably less complex than the Windows model, at the cost of some feature richness, such as being able to assign different permissions to different groups of users.

Some Areas to Look At When Hardening an OS 1 2 3.5.1.2  Updates