Windows Anti-Virus etc. Security. Best Practice?

[Gongalong]

Hi folks,

 

As per my recent posts, we've had a virus outbreak that has potentially wrecked a lot of PCs, and could cause a lot of downtime on our network.

 

With zero day attacks being common, and other forms of security almost being more important than anti-virus, what do other schools do in terms of best practice?

 

For example, I have increased the number of file screens on our servers to prevent executable files from being in places where they are not needed. This would have probably helped a lot with our current outbreak, which was in part converting PDFs to EXEs (40,000 files were affected). Albeit we have to balance this with students who are programming – they are allowed EXE files, but only with a specific prefix.

 

Do other schools prevent use of USB memory sticks? We don’t currently.

 

What else do you do? Any suggestions/ideas welcomed!

 

TIA

[Arthur]

A few things off the top of my head.

 

• Keep Windows, Office, your anti-virus software and third-party applications up-to-date (especially those from Adobe and Oracle!!!). If you use SCCM to deploy Windows and applications, there are third-party products like Shavlik Patch and PatchMyPC to help keep the latter updated automatically. Ninite Pro might be a cheaper alternative however.
   
   
  
• Don't forget to patch your servers. The recent Kerberos vulnerability fixed by KB3011780 is a great example of why you should do this.
   
   
  
• Install Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) on PCs to help protect against zero-day attacks. Use the included ADMX to configure. Read the documentation to see the caveat about BitLocker if that's used.
   
   
  
• Uninstall Java, Flash Player and Silverlight if they are not used by any applications on your network or websites. Internet Explorer (in Windows 8.x) and Chrome include their own Flash Player plugins which get updated when the browsers are, so you may be able to get rid of Adobe's version of the plug-in.
   
   
  
• All users should have standard user accounts (without exception) and mandatory/super mandatory profiles where possible. If you need to run a program or script with administrator privileges use as separate account for that as and when required.
   
   
  
• Ensure that standard users don't have write access to folders within %PATH%.
   
   
  
• Setup AppLocker so that the only executables that are allowed to run are located within the Program Files and Windows folders.
   
   
  
• Prevent executables from running from home directories, the AppData folders within user profiles, temp folders, USB flash drives, external HDD and optical discs using AppLocker.
   
   
  
• Prevent executables from being saved to files shares and home directories using FSRM.
   
   
  
• Ensure that permissions are setup correctly on shared folders etc. and make them as restrictive as possible.
   
   
  
• Restrict the use of the Registry Editor, Command Prompt, CScript/WScript and PowerShell to those that need them.
   
   
  
• Run Windows services on servers under Managed Service Accounts. Active Directory will take care of automatically changing the passwords used by these accounts for you.
   
   
  
• Avoid using the same local admin password on multiple computers. AdmPwd can help with that.
   
   
  
• NEVER browse the Internet using a domain admin account or on servers.
   
   
  
• Do not browse the Internet with Firefox since it doesn't sandbox web content.
   
   
  
• Enable UAC if it is disabled.
   
   
  
• If your PCs aren't too old, install Windows in UEFI mode so that there isn't a Master Boot Record to infect. Enable Secure Boot on Windows 8.x PCs.
   
   
  
• Block all ActiveX controls in Internet Explorer and plug-ins in Chrome except those whitelisted through Group Policy.
   
   
  
• Block adverts via your proxy server and/or browsers using an extension like µBlock for Chrome or Tracking Protection Lists in Internet Explorer. This should prevent PCs getting infected by malvertising.
   
   
  
• Prevent users from bypassing the Safe Browsing warning page in Chrome.
   
   
  
• Scan executable file types on your proxy and block ccTLDs such as .cn, .ru and .cc (along with their associated IP ranges). Some gTLDs used by malware could also be blocked.
   
   
  
• Enable HTTPS inspection on your proxy so that it can filter encrypted connections.
   
   
  
• Enable Internet Explorer's Enhanced Protected Mode if it won't cause compatibility issues with third-party add-ons.
   
   
  
• Enable Protected Mode in Adobe Reader if that's installed?
   
   
  
• Don't store passwords in Excel files.
   
  www.buzzfeed.com/charliewarzel/it-gets-worse-the-newest-sony-data-breach-exposes-thousands
  

Edited December 13, 2014 by Arthur

[gaz350b]

Prevent downloading exe files on your web filter. Except from white listed accounts or websites

Have a mechanism for patching machines quickly which includes flash, Java and all web browsers.

Remove all admin account use for day to day use.

Have a seperate account for it admins which they only use to do admin tasks.

 

Review your anti virus, make sure it's updating promptly on all machines.this should be you final line of defence.

 

Review permissions on shares. Does everyone really need r/w to every folder?

 

 

Edit: what the above said

Edited December 13, 2014 by gaz350b

[computer_expert]

Turn off autoplay/autorun if it isn't already off

[Arthur]

This might be of interest...

 

How to mitigate 85% of threats with only four strategies « SecureList

 

Through comprehensive, detailed analysis of local attacks and threats, the Australian Signals Directorate (ASD) has found that at least 85 per cent of the targeted cyber-intrusions it responds to could be mitigated by four basic strategies. Three of them are related to specialized security solutions. Kaspersky Lab products include technological solutions to cover these first three major strategies:

 

• Use application whitelisting to help prevent malicious software and unapproved programs from running
  
• Patch applications such as Java, PDF viewers, Flash, web browsers and Microsoft Office
  
• Patch operating system vulnerabilities
  
• Restrict administrative privileges to operating systems and applications, based on user duties.
  

 

http://vgy.me/2JLSlH.jpg