Front cover - IBM Redbooks

The Administrator account has the privileges to do anything to the Windows
system. Malicious hackers will search out workstations connected to the Internet
where the Administrator account has no password, or a trivial password. Once
the account has been compromised the hacker can take complete control of the
workstation.
Therefore, there are two choices: one is to keep the Administrator account in
place, the other is get rid of it (though not entirely). Let’s take the time to cover
both.
1. If the Administrator account is kept as is, it should have a non-trivial password
that's difficult to guess. Some guidelines for this are:
– It should have a minimum of 8 characters. (It should be considered as a
passphrase and thus, could have many more characters than that.)
– It should have at least 3 different character types (alphabetic, numeric
and, if possible, punctuation characters).
– It should be as random as possible and variations on dictionary entries
should be avoided.
2. A potentially more effective approach is to create an alternate administrative
account, with a different name, which would be used for all administrative
tasks and would have all the privileges of the Administrator account. As well,
delete the original Administrator account and create a dummy Administrator
account with no privileges. As intruders try to compromise this account, they
will be logged in the audit logs.
Installing and maintaining anti-virus protection
It is important to ensure the workstation’s configuration is clean, that no files
have been compromised during the normal course of utilization, and that if any
files are introduced into the system, they do no damage.
This is why it is crucial to have an anti-virus tool installed, which can perform
periodic scans of the file system and the memory to spot virus, trojans, and
worms that might have found a place there. Just as IT systems need continuous
monitoring and improvements to keep them up to date, the anti-virus file is no
different. For this security tool to be effective, it must include the most recent
virus definitions. To maintain these virus definitions, the file containing them
should be updated on a weekly basis.
Most organizations have a licence for Norton Anti-Virus (NAV), McAffee’s
VirusScan, or other anti-virus tool that covers all workstations. There is no
reason why it shouldn’t be used on all machines. Anti-Virus protection is a first
line of defense for Windows workstations.
Chapter 9. Server hardening 381