A secure system requires effort from both the system administrators, who maintain certain software settings, and the everyday users, who must cultivate habits such as logging off at the end of the day and memorizing (rather than writing down) their passwords.
Windows NT can display a message box with the caption and text of your choice before a user logs on. Many organizations use this message box to display a warning message that notifies potential users that they can be held legally liable if they attempt to use the computer without having been properly authorized to do so. The absence of such a notice could be construed as an invitation, without restriction, to enter and browse the system.
The logon notice can also be used in settings (such as an information kiosk) where users might require instruction on how to supply a username and password for the appropriate account.
To display a legal notice, use the Registry Editor to create or assign the following Registry key values on the workstation to be protected:
Hive: | HKEY_LOCAL_MACHINE |
Key: | SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon |
Name: | LegalNoticeCaption |
Type: | REG_SZ |
Value: | Whatever you want for the title of the message box |
|
|
Hive: | HKEY_LOCAL_MACHINE |
Key: | SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon |
Name: | LegalNoticeText |
Type: | REG_SZ |
Value: | Whatever you want for the text of the message box |
The changes take effect the next time the computer is started. You might want to update the Emergency Repair Disk to reflect these changes.
Welcome to the XYZ Information Kiosk
Log on using account name Guest and password XYZCorp.
Authorized Users Only
Only individuals currently assigned an account on this computer by XYZCorp may access data on this computer. All information stored on this computer is the property of XYZCorp and is subject to all the protections accorded intellectual property.
With standard security, a user account (username) and password should be required in order to use the computer. You can establish, delete, or disable user accounts with User Manager, which is in the Administrative Tools program group. User Manager also allows you to set password policies and organize user accounts into Groups. The "User Manager" chapter of the Windows NT Workstation or Windows NT Server System Guide provides detailed information on the features available through User Manager, and how to implement them.
Note
Changes to the Windows NT computer user rights policy take effect when the user next logs on.
Use separate accounts for administrative activity and general user activity. Individuals who do administrative work on the computer should each have two user accounts on the system: one for administrative tasks, and one for general activity. To avoid accidental changes to protected resources, the account with the least privilege that can do the task at hand should be used. For example, viruses can do much more damage if activated from an account with Administrator privileges.
It is a good idea to rename the built-in Administrator account to something less obvious. This powerful account is the one account that can never be locked out due to repeated failed logon attempts, and consequently is attractive to hackers who try to break in by repeatedly guessing passwords. By renaming the account, you force hackers to guess the account name as well as the password.
Limited access can be permitted for casual users through the built-in Guest account. If the computer is for public use, the Guest account can be used for public logons. Prohibit Guest from Writing or Deleting any files, directories, or Registry keys (with the possible exception of a directory where information can be left). In a standard security configuration, a computer that allows Guest access can also be used by other users for files that they don't want accessible to the general public. These users can log on with their own user names and access files in directories on which they have set the appropriate permissions. They will want to be especially careful to log off or lock the workstation before they leave it. The Guest account is discussed in the "User Manager" chapter of the Windows NT Workstation or Windows NT Server System Guide.
All users should always press ctrl+alt+del before logging on. Programs designed to collect account passwords can appear as a logon screen that is there waiting for you. By pressing ctrl+alt+del you can foil these programs and get the secure logon screen provided by Windows NT.
Users should either log off or lock the workstation if they will be away from the computer for any length of time. Logging off allows other users to log on (if they know the password to an account); locking the workstation does not. The workstation can be set to lock automatically if it is not used for a set period of time by using any 32-bit screen saver with the Password Protected option. Screen savers and how to set them are discussed in the "Control Panel" chapter of the Windows NT Workstation or Windows NT Server System Guide.
Anyone who knows a username and the associated password can log in as that user. Users should take care to keep their passwords secret. Here are a few tips:
The NTFS file system provides more security features than the FAT system, and should be used whenever security is a concern. The only reason to use FAT is for the boot partition of an ARC-compliant RISC system. A system partition using FAT can be secured in its entirety using the Secure System Partition command on the Partition menu of the Disk Administrator utility.
With NTFS, you can assign a variety of protections to files and directories, specifying which groups or individual accounts can access these resources in which ways. By using the inherited permissions feature and by assigning permissions to groups rather than to individual accounts, you can simplify the chore of maintaining appropriate protections. See the "File Manager" chapter of your Windows NT Workstation or Windows NT Server System Guide for information on assigning file and directory protections. For a discussion of inherited permissions, including how and when they are applied, see Chapter 2, "Windows NT Security Model," in the Windows NT Resource Guide.
In particular, make sure that users know that if they move rather than copy a file to a different directory on the same volume, it continues to have the protections it had before it was moved. If they copy the file, it inherits the protections (either more or less restrictive) from the directory it is copied to.
For example, a user might copy a sensitive document to a directory that is accessible to people who should not be allowed to read the document, thinking that the protections assigned to the document in its old location would still apply. In this case the protections should be set on the document as soon as it is copied, or else it should be first moved to the new directory, then copied back to the original directory.
On the other hand, if a file that was created in a protected directory is being placed in a shared directory so that other users can read it, it should be copied to the new directory, or if it is moved to the new directory the protections on the file should be promptly changed so that other users can read the file.
When permissions are changed on a file or directory, the new permissions apply any time the file or directory is subsequently opened. Users who already have the file or directory open when you change the permissions are still allowed access according to the permissions that were in effect when they opened the file or directory.
Regular backups protect your data from hardware failures and honest mistakes, as well as from viruses and other malicious mischief. The Windows NT Backup utility is described in the "Backup" chapter of the Windows NT Workstation or Windows NT Server System Guide.
Obviously, files must be read to be backed up, and they must be written to be restored. Backup privileges should be limited to Administrators and Backup operators — people to whom you are comfortable giving read and write access on all files.
All the initialization and configuration information used by Windows NT is stored in the Registry. Normally, the keys in the Registry are changed indirectly, through the administrative tools such as the Control Panel. This method is recommended. The Registry can also be altered directly, with the Registry Editor; some keys can be altered in no other way.
The Registry Editor should be used only by individuals who thoroughly understand the tool, the Registry itself, and the effects of changes to various keys in the Registry. Mistakes made in the Registry Editor could render part or all of the system unusable.
The Backup utility included with Windows NT allows you to back up the Registry as well as files and directories.
Auditing can inform you of actions that could pose a security risk and also identify the user accounts from which audited actions were taken. Auditing is discussed in the "User Manager" and "Event Viewer" chapters of the Windows NT Workstation or Windows NT Server System Guide and in Chapter 2, "Windows NT Security Model," of the Windows NT Resource Guide.
Note that auditing only tells you what user accounts were used for the audited events. If passwords are adequately protected, this in turn indicates which user attempted the audited events. However, if a password has been stolen or if actions were taken while a user was logged on but away from the computer, the action could have been initiated by someone other than the person to whom the user account is assigned.
When you establish an audit policy you'll need to weigh the cost (in disk space and CPU cycles) of the various auditing options against the advantages of these options. You'll want to at least audit failed logon attempts, attempts to access sensitive data, and changes to security settings. Here are some common security threats and the type of auditing that can help track them:
Threat | Action |
Hacker-type break-in using random passwords | Enable failure auditing for logon and logoff events. |
Break-in using stolen password | Enable success auditing for logon and logoff events. The log entries will not distinguish between the real users and the phony ones. What you are looking for here is unusual activity on user accounts, such as logons at odd hours or on days when you would not expect any activity. |
Misuse of administrative privileges by authorized users | Enable success auditing for use of user rights; for user and group management, for security policy changes; and for restart, shutdown, and system events. (Note: Because of the high volume of events that would be recorded, Windows NT does not normally audit the use of the Backup Files And Directories and the Restore Files And Directories rights. Appendix D, "Security In a Software Development Environment," explains how to enable auditing of the use of these rights.) |
Virus outbreak | Enable success and failure write access auditing for program files such as files with .EXE and .DLL extensions. Enable success and failure process tracking auditing. Run suspect programs and examine the security log for unexpected attempts to modify program files or creation of unexpected processes. Note that these auditing settings generate a large number of event records during routine system use. You should use them only when you are actively monitoring the system log. |
Improper access to sensitive files | Enable success and failure auditing for file- and object-access events, and then use File Manager to enable success and failure auditing of read and write access by suspect users or groups for sensitive files. |
Improper access to printers | Enable success and failure auditing for file- and object-access events, and then use Print Manager to enable success and failure auditing of print access by suspect users or groups for the printers. |
For step-by-step procedures for using User Manager to set up your system's audit policy, see the "User Manager" chapter in the Windows NT Workstation or Windows NT Server System Guide.