A ridiculous simple and short listing of "keywords" you might consider for Hardening Windows.

Date : 21/12/2013
Version: 0.3
By: Albert van der Sel
Remarks: It's a ridiculous simple listing of keypoints you might consider in Hardening Windows.


Most points below are consisent with recommendations from others. However, you might be sceptical on a few, and some are difficult to realize.
Indeed, not everything applies to all situations. And hardening involves a lot of planning and effort.


Listing 1. More applicable for Servers in business environments:
  1. Spent effort to limit the "exposed surface area" like for example:
    - minimize on exposed shares
    - minimize on running services
    - minimize on local accounts
    - check those completely silly registry entries like "Run"/"RunOnce" and "startup folders" and many more. See specialized articles (refs follow).
    - apply reasonable Policies and reasonable GPO's.
    - install only those "features" and "roles" that are neccessary.
    - limit rdp/mstsc
    - limit protocols, only permit what is needed.
    - apply Share and NTFS permissions at all times.
    - check scheduled tasks etc.. for scripts with clear passwords, or too simple passwords, and accounts that run them.
    - do not install MS office, MS development tools etc.. on Servers. They are hardly ever updated with MS security patches.
    - do not install third party development tools, BI tools etc.. on Servers (unless absolutely neccessary). They are never updated with MS security patches.

  2. Find a "reasonable" way to audit specific events, like for example "invalid logons", "group changes", "act as part of the OS", and that sort of events.
  3. Use x64 systems as much as possible, instead of x86. More effort has been put in securing x64 compared to x86 32 bit.
    If you are sceptical about that, do web search on the subject.
  4. If possible, always choose to EFI based boot instead of MBR/VBR.
  5. Try to replace XP/Win2K3 as soon as possible to x64 Win7/Win2K8/Win2K12 using EFI. Win8 is quite secure, but a bit "strange" in some ways.
  6. See section 2.4: Try using DEP and ASLR as much as possible.
  7. Put on the Firewall on, on all systems. Restrict Inbound Rules as much as possible (quite a lot of work, usually)
  8. Put some effort on studying "enummeration" and limit all "output" as much as possible. If you do not know what it is: study it.
  9. Never disclose IP's, network names etc... outside the IT department.
  10. Use switch rules to allow only certain MAC's (netcard addresses) on ports, or use a higher level Network appliance.
  11. Use a logical ring model: "outer" clients might access the Internet, but the "inner" Internal Servers never.
  12. Regularly, scan the network for e.g. open ports (e.g. using nmap).
  13. Try to "ban/limit" external/internal people running around with USB, DVD's, portable diskdrives (if that is practical... which sometimes is not)
  14. Try to apply "Role based" security, if possible. Or take a look at that subject.
  15. (in relation to the above) Apply "The principle of Least Privilege". Or take a look at that subject.
  16. For Clients: IE is a "not so great": It's leaking all the time. Minimize on add-ons etc... Or consider a safer browser.
  17. Insist on a good "version control" of OS'ses, and applications.
  18. Take a look at "MS Security Baseline Advisor". It might come up with some good points to check.
  19. COM/COM+/DCOM is difficult, and uses an almost incomprehensible security settings. If you must use it, and if you are not sure.., get advice.
  20. Some apps use config files, xml files etc... with clear text passwords ! Demand a better solution.
  21. For home PC's: use a regular account for daily work, AND NEVER AN ADMIN account !!!.
  22. For home PC's: study stuff called "Drive-by Install".
  23. (also in relation to the above) Do not disable or weaken UAC.
  24. Trivial: Put AV software on all Servers and Clients, and make sure that a appropriate update mechanism is in place.
  25. Check with DBA's if measures are taken to prevent SQL injection. And if master accounts are secure (sys, system, sa, sysdamin etc..)
  26. Check with DBA's if accounts accessing remote resources (dblink, linked server, heterogeneous services, queues etc..) are secured.
  27. Survey with "Technical Application managers" how authentication of applications takes place. Usually service accounts are used, and not user accounts.
    28. Try to investigate the permissions and strenght of password policies.
  28. Websites are sometimes notorious for clear text user/password in "config.xml" files, or similar files. Check it out.
  29. Sometimes Active Directory (ldap) based systems, exchange data with non AD systems (not using LDAP). In such cases, often configured "account/password" are used
    30. for authentication. Maybe even in clear text. Try to determine the strenght of such setups.
Note: what is called "EFI" in upper listing, should be understood to be the "EFI implementation on x64 systems with Windows".


Listing 2. Simple rules applicable for Home PC's:
  1. Use a regular account for daily work, AND NEVER AN ADMIN account. If you do work as an Admin, you REALLY make it much more EASY for Malware.
  2. Your regular account (normal account) must have a complex password, like for example using a few Capital letters,
    one or more numbers, maybe special characters like "!", a minimum lenght of 9, and still easy to remember for you. E.g.: "1LoveB33r!"
  3. Do not disable or weaken UAC (User Access Control). If you disable it, you REALLY make it much more EASY for Malware.
  4. Make sure Automatic Updates is "on", or update regularly. Vulnerabilities that were discoverd, MUST be patched.
  5. Keep the Firewall ON. If you disable it, you make it much more EASY for Malware.
  6. Have AV software installed, and keep it up to date.
  7. Treat any truly unknown USB media, or DVD etc.. with some healthy suspicion.
  8. Occasionally, you might receive mails from criminals. It's really quite easy to see that they are fake. Get rid of it.
  9. Be carefull of letting websites "check your machine" and all that. It might simply activate malware.
  10. XP, even with SP3 + recent updates, is too weak and too old. Step over to Win7 x64, or Win8x.
  11. Keep the original media safe. If you don't have it, get or create a bootable DVD for your OS.
  12. Make a "system state backup" once in a while.
  13. Backup your data frequently (e.g. to usb disk, another PC etc..).
  14. If you are interrested: do a web search on DEP, ASLR, EFI boot, UAC, Trusted Installer. These are all features that enhance security.
    Let them work for you as much as possible.
  15. Surf anywhere you want, but "certain catagories of sites"..., well.., they are simply somewhat more risky...