Improving Web Application Security: Threats and - CGISecurity

Chapter 22: Deployment Review 651RegistryReview the security of your registry configuration with the following questions:●Have you restricted remote registry administration?Use Regedt32.exe to review the ACL on the WinReg registry key, which controlswhether or not the registry can be remotely accessed.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurePipeServers\winregBy default in Windows 2000, remote registry access is restricted to members ofthe Administrators and Backup operators group. For maximum security, restrictall remote access to the registry by using an empty Discretionary Access ControlList (DACL).Note Some services require remote access to the registry. See Microsoft Knowledge Basearticle 153183, “How to Restrict Access to the Registry from a Remote Computer,” to see if yourscenario demands limited remote registry access.●Have you secured the SAM?This only applies to stand-alone servers. Check that you have restricted LMHashstorage in the Security Account Manager (SAM) database by creating the key(not value) NoLMHash in the registry as follows:HKLM\System\CurrentControlSet\Control\LSA\NoLMHashAuditing and LoggingReview your use of Windows auditing with the following questions.● Do you log all failed logon attempts?Use the Local Security Policy tool to check that you have enabled the auditing offailed logon attempts.● Do you log all failed actions across the file system?Use the Local Security Policy tool to check that you have enabled object accessauditing. Then check that auditing has been enabled across the file system.