Windows Security Challenge Network Holding Strong—So Far

When you invite the world to try to hack into your Microsoft network, what's the major security challenge you face? In the case of MCP TechMentor's Windows Security Challenge, it might be the security

(Seattle, Wash.) Imagine you've set up a network with Windows 2000 servers and desktops, XP desktops, Exchange, IIS, SQL Server, and ISA Server. You've followed the security guidelines set down by Microsoft, and you've applied service packs and patches that have surfaced since those products were released. Then you invite the world to try to hack into the network. What's the major security challenge you face?

In the case of MCP TechMentor's Windows Security Challenge, it's probably the fact that the security guard protecting the room where the servers are physically located keeps falling asleep.

One speaker said he was tempted to walk into the room and unplug something in order to bring the Web site down.

On day one, attendees heard the highlights of the network hardening effort, as explained by the team that did the work, including Microsoft security consultant Steve Riley, SQL Server consultant Ted Malone, IIS expert Brett Hill, firewall expert Joern Wettern and Active Directory consultant Laura Robinson, and led by MCP Magazine Contributing Editor Roberta Bragg. A diagram of the network is available at seattle/overview.asp#.

The presentations highlighted the same best practices outlined in Microsoft's Security Operations Guide, available online at treeview/default.asp?url=/technet/security/prodtech/ windows/windows2000/staysecure/.

The three-day event is hosted by 101communications and MCP Magazine.

By 6 p.m. on Wednesday the network, the network was activated and hosting a Web site at The Web page shows a simple guest book application. The information filled in by visitors poses a sort of enticement to hackers, who try to access the SQL Server holding the data.

"We're seeing a tremendous amount of attacks but there's nothing really original... It's a lot of script kiddies," said Mark Burnett, an Internet security consultant and author, who installed Snort to log activity for the project. "I haven't seen anything really serious. It goes to show just how effective the basic steps can be."

Malone, the SQL expert on the team, said visitors have tried to break into the SQL application.

"Then they tried to get into IIS. Thousands and thousands of exploits. Gave that up pretty quickly." He said the team has seen a lot of SQL injection-oriented errors, in which hackers attempt to exploit an aspect of SQL by tricking the application into running commands entered through data fields. Malone showed in his session how to prevent SQL injection problems; the fix: changing single apostrophes in the SQL code to dual apostrophes.

The question the challenge is attempting to answer, said Bragg, program chair for the event, was, "Can a small business protect against the threats that are out there?" Her conclusion: "It is not that hard. It takes time. It takes commitment."

But there's a bigger issue at stake, she said. "It's not about securing your world; it's about securing the world." That, she said, requires a different mindset.

The network will remain live until the end of Thursday.

About the Author

Dian L. Schaffhauser is a freelance writer based in Northern California.


comments powered by Disqus

Subscribe on YouTube