1RUNNING HEAD MANAGING HOST BASED SECURITY IN WINDOWS 8.1La.docx

1RUNNING HEAD: MANAGING HOST BASED SECURITY
IN WINDOWS 8.1
Lab Deliverable for Lab 2
a. Procedure to Manage Windows Defender
Operating Environment:
1. Operating System: Windows 8.1 Pro
2. Hardware: A Laptop
3. Software: VMware Horizon Client Installed
Description:
This window configuration project will require the sytem admin
permission so as to access the programs and get to know how it
is commanded to the action it should peform. Also, to use a
virtual box one should have knowledge in how to operate the
virtual box and explore the virtual programs
Notes, Warnings and Restrictions:
1. Windows Defender come with windows 8.1 software and are
found in the control panel.
2. The application is used only when you login your system as
an administarator or have permitted to act as the administrator.
3. For windows defender to run in the system it should be

turned on and no other antivirus should be active
4. Scanning the system with windows defender deletes infected
files. Also ensure you do the required scanning
5. If a different anti virus has been previously deleted, then
windows defender needs to be turned off and to be restarted
Resources (Futher Reading):
Firewalls. (n.d.). Retrieved from
https://technet.microsoft.com/en-us/library/cc700820.aspx
Microsoft Baseline Security Analyzer. (2011). Retrieved from
https://dougvitale.wordpress.com/2011/11/18/microsoft-
baseline-security-analyzer/
CloudFlare. (n.d.). Retrieved from
https://www.winhelp.us/configure-windows-defender-in-
windows-8.html
Procedures:
Windows defender
Window defender protects a computer system against any form
of malware by running in the background of the computer
system and gives notification if any suspicious item is found in
the syatem for the user to take action. It can also be used by a
computer to scan the system if the system has issues e.g
becomes slow, switches off when not commanded to, hanging
among other things. Windows defender should be updated over
time so that it is not outdated and also to improve its
performance.
Windows defender is found in the control panel icon, steps of
opening are
i. Open control panel and select “windows defender”
ii. While you click on windows defender, the following page
appears

a) To update the system click on “update”
b) Real time scanning
c) For the full scan results it will appear in the table as shown
below
d) For quick results check the button just before you click on
scan. Then the results will appear as shown below.
e) To scan removable device, select “setting” and click on
advance
Then check the box just before removing any removable drivers
and click save
b. Procedure to configure Windows Firewall for Windows 8.1

Descriptions:
Windows firewall is a protection application that protects
against suspicious items, It helps in blocking suspicious
programs and even network traffic.
Notes, Warning and Restrictions:
1. Windows firewall is an application that comes with windows
8/8.1 in the control panel list.
2. Windows firewall blocks some programs from running if they
look suspicious or are from an untrusted site.
3. When windows firewall is off, it doesn’t work efficiently.
4. Always check the boxes to ensure you check the right boxes
for what you want to enable and those you want to disable.
5. To protect the computer from viruses and spyware, ensure
windows firewall is turned on
Firewalls - Springer. (n.d.). Retrieved from
http://link.springer.com/referenceworkentry/10.1007%2F978-1-
4419-5906-5_911
How to Start & Use The Windows Firewall with Advanced
Security. (n.d.). Retrieved from
http://www.digitalcitizen.life/gain-additional-control-using-
windows-firewall-advanced-security
Windows Firewall Is Blocking a Program. (n.d.). Retrieved from
https://technet.microsoft.com/en-
us/library/cc766312(v=ws.10).aspx
Procedures:
Windows firewall
1. windows firewall has a policy design that enables the
computer to accept or share data or create traffic with only the
other computers or systems that are authorized. This protects
the system from any intrusion from an outsider. This also helps
the system from virus attacks. Windows firewall also have a

policy termed as domain isolation, with this, traffic is created
and information shared to the computers whose domains are
recognized by the system. Server isolation policy in windows
firewall restricts the server from distributing information to
only certain machines
(a). Steps in configuring windows firewall
i. In the control panel select “windows firewall”
ii. Then click on “Allow an app or feature through windows
firewall”
iii. In this window you choose the apps in the box and check
those you need to communicate with.
(b)
i. In windows firewall settings click “advanced setting”
Advanced setting will display the window below
Choose “windows firewall properties” it will give you options
of blocking or allowing connections.
For any application that you need to block or allow e.g network
then click on outbound

Manage Vulnerabilities Using Microsoft Baseline Security
Analyzer (MBSA)
Descriptions:
MBSA is a microsoft application product that can access the
state of security in a computer system. It checks for security
updates. It is also designed to give guidance on the security
state of a system
Notes, Warning and Restrictions:
1. MBSA is operated only when one has administrator rights to
access the computer system.
2. MBSA is installed differently to the system for additional
security for the computer syatem.
3. Scanning in MBSA updates works only with connected
network.
4. MBSA does not scan or report on missing non-security
updates in a system.
5. If MBSA fails to open from the command prompt or the run
application, you can still look for it in installed programs and
open the program
How To: Use the Microsoft Baseline Security Analyzer. (n.d.).
Retrieved from https://msdn.microsoft.com/en-
us/library/ff647642.aspx
Rountree, D. (2010). Security for Microsoft Windows System
Administrators: Introduction to key information security
concepts. Rockland, MA: Syngress.
Security for Microsoft Windows System Administrators -

ScienceDirect. (n.d.). Retrieved from
http://www.sciencedirect.com/science/book/9781597495943
Procedures:Manage Vulnerabilities Using Microsoft Baseline
Security Analyzer (MBSA)
1. MBSA is an application supported by windows that helps in
managing the security state in a system against
recommendations of Microsoft. This application can easily
detect misconfiguration security and missing security updates in
Windows.
(Click Win+R) and type MBSAcli.exe command in the box
This opens MBSA application
While you Click on “scan a computer” the following box will
appear in which you will check the boxes of what you want to
scan
Then click on “start scan” of which it will display result after
scanning
To see the results after scan then in the first page still select
It will then display results as shown below
Security assessment:
Incomplete Scan (Could not complete one or more requested
checks.)
Computer name:
UMUC-CLOUDSP16-CSIA-017
IP address:
10.5.2.103
Security report name:
UMUC-CLOUD - SP16-CSIA-017 (1-22-2016 11-38 PM)
Scan date:
1/22/2016 11:38 PM

Catalog synchronization date:
Security update catalog:
Microsoft Update
Security Updates
Score
Issue
Result
Lab Deliverable for Lab nYour NameDate
Title: Creating, Using, Removing System Restore Points for
Windows 8.1Operating Environment:
2. Hardware
3. SoftwareDescription:
Notes, Warnings, & Restrictions:Resources (Further
Reading):Procedures:
[First Section Heading & Brief Intro / Explanation]
[Step-by-Step]
[Second Section Heading & Brief Intro / Explanation]
[Step-by-Step]
[Last Section Heading & Brief Intro / Explanation]
[Step-by-Step]
Title:Operating Environment:
1. Hardware

[Step-by-Step]
[Step-by-Step]
[Step-by-Step]
Title:Operating Environment:
1. Hardware
[Step-by-Step]
[Step-by-Step]
[Step-by-Step]
1
2
Sample Procedure for CISA 310: Cybersecurity processes &
technologies
Step-by-Step Procedure for Media Sanitization

Lab 0 Part 0
Valorie J. King
6/25/2015
Title: Media Sanitization
1. Operating System: Linux (Paladin version 3.0 boot USB or
DVD/CD)
2. Firmware: BIOS which allows boot from removable media
3. Hardware:
a. Compatible workstation or laptop
b. Boot Device: DVD, CD-ROM, or USB port
c. Boot Media containing Paladin
Description:
This system administration procedure provides instructions for
using Paladin to sanitize media prior to reuse or disposal. This
operation results in media which are forensically sterile. The
“forensically sterile” state is achieved by using the following
approved procedure to overwrite the media with a pattern of
0x00 in every byte.
Notes, Warnings, & Restrictions:
1. The Paladin tool is distributed free of charge by Sumuri,
LLC. See the vendor’s website
http://sumuri.com/products/paladin/ for additional details about
the product. You must register before you can download the
software distribution. Instructions for creating bootable media
from the software distribution package are available from the
vendor’s Website.

2. All imaging media checked out from inventory or supply
cabinets must be verified as forensically sterile before use as
target media for a forensic imaging process. To verify that
media is forensically sterile, you should perform steps 7 – 9 in
the Sterilization Procedure (as shown earlier in this document).
3. This procedure will remove all information (“wipe”) from the
selected hard disk, solid state drive, or other writable computer
storage media (“device”).
4. Verify that the correct device has been selected prior to
starting the “wipe” operation. Selecting the wrong device or
drive may result in corruption of the system hard drive for the
workstation or laptop on which Paladin is running.
5. This procedure will remove all partitioning and/or formatting
information from the hard drive or removable media. This
information must be restored using the appropriate partitioning
and/or formatting utility prior to the media being used.
Resources:
Kissel, R., Regenscheid, A., Scholl, M., & Stine, K. (2014).
Guidelines for media sanitization (NIST SP 800-88, revision 1).
Retrieved from
http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.8
00-88r1.pdf
Sumuri, LLC. (2015). Paladin. Retrieved from
http://sumuri.com/products/paladin/
Procedures:
Boot & Launch Paladin
In this section, you will launch the Paladin Toolbox after
booting the local computer using the Paladin Boot Media. This
media can be either USB or Live CD/DVD. You may need to
change the BIOS or UEFI options in order to boot from USB.
1. Boot a laptop or workstation using a Sumuri Paladin version
3.0 Live CD/DVD or boot USB.
2. Choose your Language Option (English is the default)
3. Boot Paladin (default choice) by pressing Enter

4. Click OK to accept the usage agreement
5. Launch the Paladin Toolbox application
6. Paladin Toolbox at Startup
Forensic Sterilization of Physical Devices / Media
In this section, you will forensically sterilize a physical device
(USB or hard drive) using the “Wipe” function in Paladin. After
the wipe operation has completed, you will verify that the
device is forensically sterile using DCFLDD (to check for
zeroes in all bytes of the device).
1. Physically connect the drive or media to be sterilized (Note:
You do not need to put a hardware write-blocking device into
the data path since Paladin has a software write-block installed
in the operating system’s control files.)
2. Click on the WIPE tab at the top of the Paladin window
3. Using the drop down box, select the drive to be wiped. Note
the drive designation as displayed by Paladin, e.g. /dev/sdc.
4. Click WIPE to start the wiping process.
5. You can switch to the TASKS tab to monitor the progress of
the WIPE operation from within Paladin. There should also be a
pop-up window which provides task progress.
6. After the wipe has completed, launch a terminal window
7. Type the following command to verify the wipe: sudo dcfldd
pattern=00 vf=drivedesignator
For our example, the drive designator was /dev/sdc
The command to verify the wipe is: sudo dcfldd pattern=00
vf=/dev/sdc

8. If the command output is “match” then your media has been
properly wiped and is now forensically sterile. If you receive
any other output, your media has not been properly wiped.
Restart this procedure at step 4.
9. If the media is to be reused, label it appropriately and then
store in an approved storage container. For installed hard
drives, affix the label to the outside of the drive enclosure.
Lab #3: Implementing Access Controls
Purpose: To develop and verify system administration
procedures which implement access controls for a Windows 8.1
system.
Objectives
1. Develop system administration procedures to manage account
policies for a Windows 8.1 system
2. Develop system administration procedures to manage local
user accounts and local user groups in a Windows 8.1 system
3. Develop system administration procedures to manage a
“drop-box” using discretionary access controls for resources in
a Windows 8.1 system
Overview
Access controls are an important part of identity &
authorization management business processes. There are three
primary types of access controls which are used for desktop
computing: mandatory access controls, discretionary access
controls, and role-based access controls.
· Mandatory access controls are built into and managed by the
operating system. The two types of Windows user accounts,
administrator and standard user, are examples of mandatory
access controls.
· Discretionary access controls are provided by operating

system components (e.g. the file system) and can be managed by
system administrators and resource owners.
· Role-based access controls can be implemented under
Windows 8 using the “user group” discretionary access control.
Each “role” is assigned to a specific user group (one and only
one “role” per group).
For this lab, you will write and test step-by-step procedures
which can be used to implement access controls using local user
accounts, i.e. accounts which only exist on the local workstation
or laptop. You will not create or manage domain accounts.
Your step-by-step system administration procedures will be
used to perform the following tasks:
· Manage local user account policies (including implementing
policy-based password restrictions)
· Create and manage local user accounts (both standard user and
administrators)
· Create and manage local groups (to implement role-based
access controls)
· Create and manage a “drop-box” folder (using group
membership and resource permissions to implement role-based
access controls)
Your procedures should use the following tools:
· Group Policy Management Console (GPMC)
· PC Settings
· User Accounts (access from Control Panel)
· Windows File Explorer
Deliverables
(a) Step-by-Step Local Computer Account Policies Management
System Administration Procedure
(b) Step-by-Step LocalUser Accounts & Groups Management
System Administration Procedure
(c) Step-by-Step Drop-Box Management System Administration
Procedure

Submit your deliverables in a SINGLE FILE in MS Word
format (.docx or .doc file types) using the corresponding
assignment folder entry (in LEO). (Use the Deliverable
Template file from Course Resources > Sample Files > CSIA
310 Lab Deliverable Template.docx.) Every deliverable must
use the format shown below. (Replace [Section Name] with the
heading for the section, e.g. Local Computer Account Policies).
Title:
1. Hardware
2. Software
Description:
Notes, Warnings, & Restrictions:
Resources (Further Reading):
1.
2.
3.
Procedures:
[Section Name]
Brief Introduction Paragraph
1.
2.
3.
[Section Name]
Brief Introduction Paragraph
1.
2.
3.

InstructionsPart (a): Managing Local Computer Account
Policies
1. Investigate the use of Group Policy Management Console
(access using icon on Desktop or via Microsoft Management
Console). This tool is usedto manage account policies for the
local workstation. The group of settings that must be managed
are found under: Local Computer PolicyComputer
ConfigurationWindows SettingsSecurity SettingsAccount
Policies
2. Identify appropriate sources of information (e.g. Windows
Help, Microsoft Technet, etc.) for instructions for setting
account policies for Windows 8/8.1. Using those sources,
research the procedures required to perform the following tasks:
a. Set or change Password Policy (enumerate the individual
settings in your procedure, e.g. minimum password age)
b. Set or change Account Lockout Policy (enumerate the
individual settings in your procedure)
3. Develop a step-by-step systems administration procedure to
manage the local account policies for passwords and account
lockout.
4. Test your draft procedures using the virtual machine
provided in the online lab environment or using a locally
installed Virtual Machine (VM) running Microsoft Windows 8.1
Professional. As you run your tests, collect screen snapshots to
illustrate key steps in your procedures. Part (b): Managing
Local User Accounts and Local Groups
1. Investigate the use of the Windows 8.1 PC Settings tool (PC
Settings > Accounts > Other Accounts) to create and manage
local user accounts
2. Investigate the use of the Windows 8.1 User Accounts tool
(Control Panel > Administrative Tools > User Accounts) to
create and manage local user accounts
3. Identify appropriate sources of information about both tools

(e.g. Windows Help, Microsoft Technet, etc.) with particular
focus upon the steps required to create and manage local User
Accounts for Windows 8/8.1.
4. Develop step-by-step procedures to create and manage local
user accounts using the Accounts menu in the PC Settings tool
(Access from the Windows Start Screen). Your procedures
should accomplish the following:
a. Create a standard local user account (do not use Microsoft
Account for sign-in)
b. Change account type (add or remove administrator access)
5. Develop step-by-step procedures which use the Control Panel
User Accounts tool to perform the following tasks:
a. Create a standard account (for a local user)
b. Create an administrator account (privileged access for a local
user)
c. Modify a local user account
i. Change Password
ii. Change Account Type (add or remove administrator access)
iii. Change Account Settings (disable, must-change password,
etc.)
d. Delete a local user account
e. Turn On/Off “Guest” account
Later in this lab, you will need several local user test accounts.
The required accounts are:
a. Instructor01
b. TA01
c. Student01
d. Student02
You may wish to use these accounts as your examples for
creating and managing Local User Accounts. (Instructor01 can
be your administrator account for step #5.)
6. Investigate the use of the lusrmgr.exe utility to create and
manage local Groups. This tool can be accessed via Control
Panel > User Accounts (switch to the Advanced tab then click

on the Advanced button).
7. Identify appropriate sources of information (e.g. Windows
Help, Microsoft Technet, etc.) for instructions for implementing
local groups under Windows 8/8.1. Using those sources,
research the procedures required to perform the following tasks:
a. Create user groups which correspond to roles within an
organization (e.g. instructors, students, managers, employees)
b. Assign individual user accounts to one or more groups.
8. Develop a systems administration procedure for Group
Management which can be used to perform the following tasks:
a. Create the following roles using named groups
i. Instructors
ii. Teaching Assistants (TA)
iii. CSIA310_Students
b. Assign a role to one or more users
i. Assign users to a group during group creation
ii. Assign a user to an existing group
c. Remove a role from a user (delete user account from group)
d. Use the following usernames and groups for your examples.
(Create the users if you have not done so previously.)
Username
Assigned to Group
Instructor01
Instructors
TA01
Teaching Assistants(TA)
Student01
CSIA310_Students
Student02
CSIA310_Students
9. Test your draft procedures using the virtual machine provided
in the online lab environment or using a locally installed Virtual
Machine (VM) running Microsoft Windows 8.1 Professional. As
you run your tests, collect screen snapshots to illustrate key
steps in your procedures.

10. Incorporate your screen snapshots for key steps into the
draft procedures. Each snapshot should be placed UNDER
(after) the step to which it applies. Captions are not required.
11. Make any additional changes required to address issues
found during testing of the step-by-step procedures.Part (c):
Creating & Managing a Drop-Box – An Example of
Discretionary Access Controls
1. A drop-box is a folder which is write-only for some users
(e.g. students) and read-only for other users (e.g. graders).
Under Windows 8/8.1, one method for accomplishing this goal
is to define user groups corresponding to roles and then
assigning / restricting access to resources for specific groups.
The figure below shows an example of permission settings for a
drop-box that has three assigned roles: instructors, teaching
assistants (TA), and students (CSIA310_Students). The
instructor role is granted full access. This means that the
instructor can grant access, remove access, take ownership, etc.
The TA role has limited permissions which only permit the user
to read files submitted to the drop-box. The permissions granted
to the CSIA310_Students role are even more limited – creating
and writing files.
2. Now that you have an idea of what a drop-box is and how it
works, investigate the use of Windows Explorer to implement a
drop-box. Begin by researching how to set advanced “sharing”
and/or “access” permissions (discretionary access controls)
under Windows 8/8.1. For this lab, you should focus on the
capabilities provided via the right-click menu (for a folder):
a. Right click on folder > Properties > Security tab > Edit
b. Right click on folder > Properties > Security tab > Advanced
Settings
3. Investigate the view function for permissions. From the
“Advanced Security Settings” pop-up, click on one of the
“principals” and then click View. Switch between the “basic
permissions” and “advanced permissions” views.
4. Next, you should explore how to view (list) effective access
for specific local user account. This will be needed to verify

that you have permissions set appropriately and that
permissions granted to other groups do not interfere with
permissions you wish to set for your “role” groups.
5. Identify appropriate additional sources of information (e.g.
Windows Help, Microsoft Technet, etc.) for instructions for
configuring resource permissions under Windows 8/8.1.
6. Develop a systems administration procedure for Windows
Update to accomplish the following:
a. Create a folder named Assignments
b. Change the owner of Assignments (use “Instructor01” as your
example)
c. Remove access for all groups except Administrators and
Owners (use check effective access to verify).
d. Give a named group “Full Control” (use the “Instructors”
group as your example)
e. Give a named group “Read&Execute” access (use the “TA”
group as your example)
f. Give a named group “Write” access ( use the
“CSIA310_Students” group)
g. Verify effective access for each of the named groups
7. Test your draft procedures using the virtual machine provided
in the online lab environment or using a locally installed Virtual
Machine (VM) running Microsoft Windows 8.1 Professional. As
you run your tests, collect screen snapshots to illustrate key
steps in your procedures.
8. Incorporate your screen snapshots for key steps into the draft
procedures. Each snapshot should be placed UNDER (after) the
step to which it applies. Captions are not required.
9. Make any additional changes required to address issues found
during testing of the step-by-step procedures.Finalize Your
Procedures
1. Using the grading rubric as a guide, refine your step-by-step
procedures. Your final products should be suitable for inclusion
in an organization’s Systems Administrator’s Handbook.
Remember that you are preparing multiple separate procedures.
2. As appropriate, cite your sources using footnotes or another

appropriate citation style.
3. Use the resources section to provide information about
recommended readings and any sources that you cite. Use a
standard bibliographic format (you may wish to use APA since
this is required in other CSIA courses). Information about
sources and recommended readings, including in-text citations,
should be formatted consistently and professionally.
4. At a minimum, each systems administration or system
management procedure document must include the following
sections:
a. Title
b. Operating Environment
c. Description
d. Notes, Warnings, & Restrictions
e. Resources (format as Bibliography or Reference list)
f. Procedures
Additional Requirements for this Lab
1. Your step-by-step procedures should tell the reader where to
find and how to launch the systems administration tools or
applications used to change security configuration settings.
2. You must address each required configuration change
separately and include enough detail that your reader will
understand how to perform the required steps to implement each
change.
3. Use screen snapshots to cue the reader to important steps or
provide information required to complete check points for
proper completion of a step or set of steps (e.g. including a
snapshot which shows the “after” state for a group of security
settings).
4. Make sure that your snapshots will enhance the reader’s
understanding of the procedure and required configuration
changes. Too many snapshots or illustrations can make a
procedure difficult to use.
5. All snapshots must be created by you for this lab using screen
captures showing how you personally performed (tested) the

systems administration procedure as written by you. You may
not copy and paste images from help pages, manuals, or the
Internet.
6. Images (screen snapshots) should be cropped and sized
appropriately.
7. A screen snapshot belonging to a specific procedure step does
not require a caption.
8. Your procedures must be submitted to Turn It In for
originality checking. You are encouraged to consult existing
configuration instructions, guidance, and procedures for both
content and format. Your work must be substantially your own,
however, which means you should paraphrase whenever
possible. Credit the sources of information used via footnotes
and in your “Resources” section.
9. Make sure that the sources you cite or recommend (additional
reading) are authoritative and are the best ones available.
10. Your Operating Environment section should identify the
hardware, operating system, and/or software applications to
which the procedure applies. For this lab, your procedures will
apply to:
a. Hardware: Laptop or Desktop Computers
b. Operating System: Windows 8.1 Professional
11. The Notes, Warnings, & Restrictions section should include
important information that is not found elsewhere in the
procedures document. For example, this section could include
information about alternatives to the selected security
configuration settings. Or, this section could include
information about related security procedures or policies. This
section should also include important information about harm or
risk that could occur if the procedure is not correctly followed
or implemented. If there are no such warnings then this section
should so state.

1RUNNING HEAD MANAGING HOST BASED SECURITY IN WINDOWS 8.1La.docx

1RUNNING HEAD MANAGING HOST BASED SECURITY IN WINDOWS 8.1La.docx

Recommended

Recommended

More Related Content

Similar to 1RUNNING HEAD MANAGING HOST BASED SECURITY IN WINDOWS 8.1La.docx

Similar to 1RUNNING HEAD MANAGING HOST BASED SECURITY IN WINDOWS 8.1La.docx (20)

More from eugeniadean34240

More from eugeniadean34240 (20)

Recently uploaded

Recently uploaded (20)

1RUNNING HEAD MANAGING HOST BASED SECURITY IN WINDOWS 8.1La.docx