2.6 – Security Best Practices - Security Best Practices

• To prevent unauthorized data viewing, data encryption can be used
• Full Disk Encryption (FDE) encrypts everything on a drive
• FDE is also known as encrypting data at rest
• Individual files/folders can be encrypted instead of the whole drive
• NTFS on Windows allows choosing specific items for encryption
• Encrypting USB drives is useful due to their small size and ease of loss
• Managing decryption keys is vital along with encrypting data
• Losing the decryption key results in permanent data access loss
• Active Directory environments can store keys for Microsoft NTFS and BitLocker
• Storing keys in Active Directory allows restoration from backup if the system has an issue
• Use strong passwords that are difficult to guess or brute force
• Password complexity is also known as entropy, which measures unpredictability
• Avoid single words or obvious passwords
• Mix uppercase, lowercase, and special characters
• A strong password is considered 8 characters or longer
• Use a phrase or series of words
• Passwords expire after a set time, usually 30-90 days
• Systems remember previous passwords to prevent reuse
• Critical systems may require more frequent password changes
• Password reset processes need clear verification steps
• Default usernames and passwords exist for switches, routers, and other devices
• Change default passwords during setup for security
• Attackers often try default credentials first
• UEFI BIOS has administrator and user passwords
• Administrator passwords are required to make changes to the BIOS
• User passwords stop the boot process until entered
• Require passwords, never allow blank passwords, and disable auto-login
• Operating systems should automatically lock the screen when a user is away
• Windows 10 and 11 have lock screen settings under personalization
• Configure screen lock for automatic activation after inactivity
• Use locking hardware for laptops, tablets, etc., to secure them to a fixed point
• Sensitive information is categorized as Personally Identifiable Information (PII)
• PII includes names, addresses, phone numbers, Social Security numbers, etc.
• Be aware of surroundings when working with PII in public
• Use a privacy filter in public areas to prevent screen viewing

User Rights

• Once authenticated, users get rights and permissions to access resources
• Assign specific rights and permissions based on job function, not administrator access
• Assign users to groups with associated permissions
• Limit network access during specific hours (e.g., midnight to 4:00 AM)
• Disable accounts not needing interactive login
• Disable unnecessary or guest accounts

Account Restrictions

• Some accounts are created by default or with application installations
• Mark service accounts as never needing interactive login to prevent login at a username prompt
• Ensure operating systems do not have default settings in authentication options
• Limit password attempts to prevent brute force attacks
• The security policy in Windows is called Interactive logon: Machine account lockout threshold
• Use automatic screen locking after inactivity
• There is a security policy for this called Interactive logon: Machine inactivity limit
• AutoRun (Windows Vista and earlier) automatically ran files from removable media
• AutoRun was removed in Windows 7 and later due to security concerns
• AutoPlay in Windows allows choosing actions for removable drive insertion
• AutoPlay options include configuring storage settings, taking no action, opening File Explorer, or asking each time
• Disable AutoPlay and AutoRun to prevent accidental execution of unexpected files from removable drives