Threats and Countermeasures Guide updated for Windows Vista
It looks like the Threats and Countermeasures guide has been updated for Windows Vista.
This guide is a reference to security settings that provide countermeasures for specific threats against current versions of the Windows® operating systems.
This guide is a companion for two other publications that are available from Microsoft:
Many of the countermeasures that are described in this guide are not intended for specific computer roles in the companion guides, or in some cases for any roles at all. These countermeasures help ensure compatibility, usability, manageability, availability, or performance.
Generally, as security increases, functionality decreases, and vice versa. However, there are exceptions, and some security countermeasures actually help to improve functionality.
Each section begins with a brief explanation of what is in the section, followed by a list of subsection headers, each of which corresponds to a setting or group of settings. Each subsection includes a brief explanation of what the countermeasure does, and includes the following three additional subsections:
- Vulnerability. Explains how an attacker might exploit a feature or its configuration.
- Countermeasure. Explains how to implement the countermeasure.
- Potential impact. Explains the possible negative consequences of countermeasure implementation.
Section Overviews
This guide consists of seven sections that provide a reference to the settings that you should consider while planning the security policy for your organization.
Domain Level Account Policies discusses the Group Policy settings that are applied at the domain level: password policies, account lockout policies, and Kerberos authentication protocol policies. Collectively, these policies are referred to as account policies.
Audit Policy discusses the use of audit policies to monitor and enforce your security measures. It describes the various settings and provides examples of how audit information is modified when the settings are changed.
User Rights discusses the various logon rights and privileges that are provided by the Windows operating systems and provides guidance about which accounts should be assigned these rights.
Security Options discusses the security settings for digital data signatures, Administrator and Guest account names, access to floppy disk and CD-ROM drives, driver installation behavior, and logon prompts.
Event Log discusses how to configure the settings that relate to the various event logs on computers running Windows Server 2003 or Windows Vista.
System Services describes the services that are included withWindows Vista and Windows Server 2003. Many of these services are configured to run by default, but others are not present unless you install specific components.
Software Restriction Policies provides a brief overview of the software restriction policy mechanism used in Windows Vista and Windows Server 2003. It provides links to additional resources about how to design and use software restriction policies.
Additional System Countermeasures describes a number of additional security measures that may need to be applied to your computers. However, these countermeasures cannot be easily applied through Group Policy or other automated means. These countermeasures include securing accounts on member servers, NTFS settings, data and application segmentation, SNMP community name settings, disabling NetBIOS bindings, Terminal Services configuration, Dr. Watson, and IPsec policies. A short overview on Windows Firewall is also provided along with a pointer to more extensive guidance on Windows Firewall that you should review if your organizational security policy includes Windows Firewall settings.
Additional Registry Entries provides information about additional registry entries that should be considered in configuring your overall security policy.
Additional Resources provides links to additional information sources about Windows security subjects from Microsoft that you may find useful.