Windows Security Challenge Network Holding Strong

Windows Security Challenge Network Holding Strong—So Far

When you invite the world to try to hack into your Microsoft network, what's the major security challenge you face? In the case of MCP TechMentor's Windows Security Challenge, it might be the security

By Dian Schaffhauser
07/11/2002

(Seattle, Wash.) Imagine you've set up a network with Windows 2000 servers and desktops, XP desktops, Exchange, IIS, SQL Server, and ISA Server. You've followed the security guidelines set down by Microsoft, and you've applied service packs and patches that have surfaced since those products were released. Then you invite the world to try to hack into the network. What's the major security challenge you face?

In the case of MCP TechMentor's Windows Security Challenge, it's probably the fact that the security guard protecting the room where the servers are physically located keeps falling asleep.

One speaker said he was tempted to walk into the room and unplug something in order to bring the Web site down.

On day one, attendees heard the highlights of the network hardening effort, as explained by the team that did the work, including Microsoft security consultant Steve Riley, SQL Server consultant Ted Malone, IIS expert Brett Hill, firewall expert Joern Wettern and Active Directory consultant Laura Robinson, and led by MCP Magazine Contributing Editor Roberta Bragg. A diagram of the network is available at http://www.techmentorsummit.com/ seattle/overview.asp#.

The presentations highlighted the same best practices outlined in Microsoft's Security Operations Guide, available online at http://www.microsoft.com/technet/ treeview/default.asp?url=/technet/security/prodtech/ windows/windows2000/staysecure/.

The three-day event is hosted by 101communications and MCP Magazine.

By 6 p.m. on Wednesday the network, the network was activated and hosting a Web site at http://www.windowssecuritychallenge.com. The Web page shows a simple guest book application. The information filled in by visitors poses a sort of enticement to hackers, who try to access the SQL Server holding the data.

"We're seeing a tremendous amount of attacks but there's nothing really original... It's a lot of script kiddies," said Mark Burnett, an Internet security consultant and author, who installed Snort to log activity for the project. "I haven't seen anything really serious. It goes to show just how effective the basic steps can be."

Malone, the SQL expert on the team, said visitors have tried to break into the SQL application.

"Then they tried to get into IIS. Thousands and thousands of exploits. Gave that up pretty quickly." He said the team has seen a lot of SQL injection-oriented errors, in which hackers attempt to exploit an aspect of SQL by tricking the application into running commands entered through data fields. Malone showed in his session how to prevent SQL injection problems; the fix: changing single apostrophes in the SQL code to dual apostrophes.

The question the challenge is attempting to answer, said Bragg, program chair for the event, was, "Can a small business protect against the threats that are out there?" Her conclusion: "It is not that hard. It takes time. It takes commitment."

But there's a bigger issue at stake, she said. "It's not about securing your world; it's about securing the world." That, she said, requires a different mindset.

The network will remain live until the end of Thursday.

About the Author

Dian L. Schaffhauser is a freelance writer based in Northern California.

Featured

What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.
Microsoft Graph 'Activity Logs' Feature Goes Live

Microsoft announced the general availability of the "activity logs" capability in Microsoft Graph, giving administrators more options to track user activity and identify patterns of potential misuse.
Fallout from Microsoft's 'Midnight Blizzard' Saga Hits Feds

When the Russian attack group Midnight Blizzard successfully breached Microsoft corporate e-mail accounts late last year, it apparently managed to steal U.S. government agency e-mails, too.