Improving Web Application Security: Threats and - CGISecurity

450 Part IV: Securing Your Network, Host, and ApplicationRestrict Remote Administration of the RegistryThe Winreg key determines whether registry keys are available for remote access. Bydefault, this key is configured to prevent users from remotely viewing most keys in theregistry, and only highly privileged users can modify it. On Windows 2000, remoteregistry access is restricted by default to members of the Administrators and Backupoperators group. Administrators have full control and backup operators have readonlyaccess.The associated permissions at the following registry location determine who canremotely access the registry.HKLM\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winregTo view the permissions for this registry key, run Regedt32.exe, navigate to the key,and choose Permissions from the Security menu.Note Some services require remote access to the registry. Refer to Microsoft Knowledge Basearticle 153183, “How to Restrict Access to the Registry from a Remote Computer,” to see if yoursituation demands limited remote registry access.Secure the SAM (Stand-alone Servers Only)Stand-alone servers store account names and one-way (non-reversible) passwordhashes (LMHash) in the local Security Account Manager (SAM) database. The SAM ispart of the registry. Typically, only members of the Administrators group have accessto the account information.Although the passwords are not actually stored in the SAM and password hashes arenot reversible, if an attacker obtains a copy of the SAM database, the attacker can usebrute force password techniques to obtain valid user names and passwords.Restrict LMHash storage in the SAM by creating the key (not value) NoLMHash inthe registry as follows:HKLM\System\CurrentControlSet\Control\LSA\NoLMHashFor more information, see Microsoft Knowledge Base article 299656, “New RegistryKey to Remove LM Hashes from Active Directory and Security Account Manager.”