CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Blind Folio 749

17
Implementing and
Troubleshooting
Security

CERTIFICATION OBJECTIVES

❑ 702: 4.1 Given a scenario, prevent, troubleshoot, and remove viruses and malware

❑ 702: 4.2 Implement security and troubleshoot common issues

✓ Two-Minute Drill

Q&A Self Test

[Link] 749 3/11/10 4:31:40 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

750 CompTIA A+ Certification Study Guide

M aking files and devices available to network users has led to the need for securing
those resources, possibly the most important set of tasks on a network. Implementing
security in this environment involves many different tasks, such as implementing
authentication and data security, taking all necessary steps to prevent the invasion of malicious
software and to discover if malicious software is already on a system. Implementing security for
a wireless network involves a specific set of skills, and you must be prepared to troubleshoot security
problems.

CERTIFICATION OBJECTIVES

■ 702: 4.1 Given a scenario, prevent, troubleshoot, and remove viruses and malware
■ 702: 4.2 Implement security and troubleshoot common issues
The security objectives for the CompTIA A+ Essentials Exams, include security
subobjectives that involve both software and hardware security skills. The most
important thing to understand about computer security is that there are no easy
answers; you must continue to keep up-to-date on the latest identified security
threats and know how to implement several security tasks to fully protect PCs.

Implementing Authentication and Data Security

In Chapter 16, you learned the options for authentication and data security. In this
section, learn how to implement the various methods of authentication and data
security.

Implementing Authentication Security

Windows most often performs authentication for access to a PC by authenticating
a user using a local account or a domain account. However, you can set a password
that must be entered before a PC will launch an operating system—a BIOS password.
In this section, you will look at how these are set. In Chapter 16, you learned about
authentication technologies that go beyond basic interactive logons, such as smart
card readers, key fobs, and biometric logons, and in this chapter, you will see how to
implement these authentication technologies. We also describe how to use the Lock
Computer option in Windows to protect your computer.

[Link] 750 3/11/10 4:31:40 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 751

BIOS Passwords/DriveLock/TPM
As described in Chapter 16, there are three types of BIOS passwords. One type
restricts access to the computer itself; another type restricts access to the BIOS
Setup; and a third, less common type restricts access to hard drives, a feature
called “DriveLock on HP computers.” We will use this term to apply to all such
implementations. As a further enhancement, an embedded TPM chip restricts
access to hard drives, providing more advanced security.

BIOS Passwords for Setup and Startup To set a BIOS password for setup
or startup, check the manual for the motherboard, and then go into the BIOS Setup
program and navigate to the correct setting. The example we discuss here is just one
version from one BIOS maker. Figure 17-1 shows the screen in which you set the
BIOS password. In this case, selecting this option will open a password dialog, in
which you enter the new password. On another screen, you configure the password
requirement for setup and/or startup.

DriveLock Some manufacturers provide a BIOS DriveLock feature in which you

set a password that you must provide at startup. This password is stored on the hard
drive, which means that even if you move the drive to another computer, it will be

FIGURE 17-1

The highlighted
setting will allow
you to set a
password on
BIOS setup.

[Link] 751 3/11/10 4:31:40 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

752 CompTIA A+ Certification Study Guide

inaccessible. With some implementations, if you use the same password for BIOS
startup and DriveLock, you will only need to enter the password once to complete
the start up; otherwise, you will need to enter two passwords.

DriveLock with TPM A more sophisticated DriveLock method is to store

the password in an embedded TPM chip. How TPM DriveLock works depends on
the manufacturer, but it is usually separate from the other BIOS passwords. With
TPM DriveLock enabled, the user must enter a password at bootup that the TPM
chip authenticates against the stored encrypted password. If the passwords match,
TPM allows the bootup to continue. Although TPM DriveLock is not impossible
to break, it is very difficult. If the drive is removed from the computer and
installed into another computer, it will not be accessible unless the encryption
data was transferred from the original TPM chip to the new TPM-enabled
computer.
Enabling TPM for any purpose is more complex than configuring the standard
BIOS settings and can vary somewhat from manufacturer to manufacturer. In general,
you must first establish ownership of the TPM chip by creating an owner password
and a basic user password, and then you can enable TPM security. The opportunity
to do this may occur the first time you log on to a new computer with Windows
preinstalled. After you have established ownership of the TPM, restart the computer
and enter BIOS Setup, providing a preconfigured administrator password to access
the new menu for TPM embedded security.

Smart Card Readers

Before using smart cards, a special device called a smart card reader must be
connected to the computer where the smart card will be used. Setup will require
the device itself and the drivers and other software for the device. Further, you
must install a special service called Certificate Services on the domain controllers
for the Windows domain.
Once you have installed the reader and configured the domain controllers
to support Certificate Services, users can log on to the computer. Inserting the
card into the reader has the same effect as pressing the CTRL-ALT-DELETE key
combination, which is normally required on a Windows computer logging onto
a domain. Either action constitutes a secure attention sequence (SAS) that clears
memory of certain types of viruses that may be lurking and waiting to capture
a username and password. Smart cards are a very secure and tamper-resistant
method of authentication.

[Link] 752 3/11/10 4:31:40 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 753

Key Fobs
Recall that to use the typical key fob, a user first enters a PIN into the key fob, and
then the key fob generates a string of characters that the user must use to log on to the
network. Installing support for a key fob involves installing an agent that runs on the
local computer and a service on the active directory domain controllers. The agent
acts as a front end to the authentication process, passing encrypted authentication
information to the domain controller that responded to the authentication request.
On the domain controller, the service decrypts
the password and provides the password and
the user name to the Active Directory security
components for authentication. If the password
Be sure you understand
and user name match a domain user account, the
the differences between key fobs and
user is allowed access to the resources that she
smart cards.
has been granted permissions and rights to.

Biometrics
While in theory you can use many types of biometrics for computer login, the
most popular and least expensive are fingerprint scanners (also called fingertip
scanners). In fact, some laptops and Tablet PCs have a fingerprint scanner built in
or packaged with the PC. These built-in devices are the size of a USB port, with a
slender scanning slot. External fingerprint scanners are available as PC Card devices,
in which the scanner protrudes from the PC Card slot. USB devices, available
from several vendors, are approximately the size of a CompactFlash card and have
a small, flat sensor pad you touch your finger to. Both the built-in and external
devices require drivers and software to integrate with the computer’s security system,
including Windows domain controllers, if your computer is a member of a Windows
domain.
Follow the manufacturer’s instructions for installing the software and hardware.
After installing the software, configure it to recognize your fingerprint and associate
it with your user account. To do this, you will need to provide a user name and
password. If your computer is a member of a workgroup, you will need to provide
either the computer name or the workgroup name. If your computer is a member of a
domain, you must provide the domain name and your user name and password in the
domain. When the configuration utility is ready to scan your fingertip and associate
it with your user account, it will prompt you. To do this, swipe your finger across
the scanner’s sensor. You can scan one or more fingers and use any one of them for
login. In most cases, the scanner’s associated software will also save passwords for
applications and Websites and associate them with your profile.

[Link] 753 3/11/10 4:31:41 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

754 CompTIA A+ Certification Study Guide

Lock Computer
Before leaving your computer unattended, simply press CTRL-ALT-DELETE to open the
Windows Security dialog box and click Lock Computer. That’s it. Your desktop will
disappear, and the Computer Locked dialog box will appear on the screen. Then,
when you return, simply press CTRL-ALT-DELETE to open the Unlock Computer dialog
box, shown here. Enter the password for your account, and you will return to the
desktop exactly as you left it.

If you did not sign in to Windows through the Windows Security dialog box, pressing
CTRL-ALT-DELETE brings up the Task Manager. Then, from the Task Manager menu bar,
select Shut Down | Lock Computer. Finally, a keyboard shortcut works no matter how
you logged on. If your keyboard has the WinKey (also called the Windows Key), a key
with a Windows logo, located between the CTRL and ALT key, press and hold this key
while pressing the “l” key (that is, the L key, but it only works in lowercase).

Implementing Data Security

In Chapter 16, you learned about the support built into NTFS for permissions and
encryption, as well as BitLocker, a drive encryption feature built into the Ultimate
or Enterprise versions of Windows Vista and Windows 7. Here, you will learn how to
apply NTFS permissions and encryption and how to permanently remove data from
hard drives.

NTFS and Share Permissions

The last line of defense for securing data on a Windows computer is NTFS file
and folder permissions. NTFS permissions apply to both the local user sitting at

[Link] 754 3/11/10 4:31:41 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 755

the computer, as well as to someone accessing a file or folder over a network. Set
NTFS permissions at the most restrictive level that will allow users to accomplish
their work. When preparing to share a folder with network users, first create the
folder, set the appropriate NTFS permissions, and then create the share. Finally,
set the share permissions.
A shared folder is a folder that is available to network users. Share permissions
only apply to network users. Therefore, a network user is affected by both share and
NTFS permissions, but local users are only affected by NTFS permissions.

Applying NTFS Permissions In Chapter 16, you learned how to open the
Permissions dialog box for a folder, which is similar to opening the Permissions
dialog box for a file. From this dialog box, you can assign permission to a file or
folder. The standard folder permissions are

Full Control List Folder Contents

Modify Read
Read and Execute Write

The standard file permissions are

Full Control Read

Modify Write
Read and Execute

When folder permissions and the permissions on the files within the folder are
combined, the least restrictive permissions apply. But we also need to address the
issue of the permission propagation throughout the folder hierarchy, also called
inheritance. When you create a new folder or file, it inherits the permissions of the
parent folder, unless you choose to block propagation of permissions to child objects.
When you view permissions on a file or folder, the permissions inherited from the
parent will be grayed out, and you will not be able to modify those permissions at the
child (inherited) level. You can assign new permissions, but you cannot alter inherited
permissions unless you modify them in the folder in which they originated. You can
block inheritance on a folder or file to which you wish to assign different (usually more
restrictive) permissions. Further, you can bypass inheritance with the Allow and Deny
permissions for a file or folder. For instance, if you explicitly Allow one of the standard
permissions, such as Full Control, the user will have full control to the file or folder,
even if inheritance would have given the user a lesser permission. If you explicitly

[Link] 755 3/11/10 4:31:41 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

756 CompTIA A+ Certification Study Guide

Deny a permission, the user will be denied a permission, even if it was granted to the
user at a higher level in the folder hierarchy or through membership in a group. When
a conflict occurs, Deny overrides Allow, and Deny creates the one exception to the
rule that when NTFS folder and file permissions, including all inherited permissions,
are combined, the least restrictive permission applies.

Shares and Permissions Although called file sharing, a file share must point to
a file folder, not to a single file. To create a file share on your PC, browse to a folder
you wish to share, right-click that folder, and select Properties. Click the Sharing tab
in the folder’s Properties dialog. In Windows 2000/XP, select Share This Folder and
complete the rest of the settings. In Windows Vista/7, from the Sharing tab, click the
Advanced Sharing button, and then select Share This folder, as shown in this example
in which we share the SalesReports folder. A share has three permissions—Full
Control, Change, and Read—and each permission has an explicit Allow or Deny
permission level. The default permissions on a share give the Read permissions to the
Everyone group. If you wish to change the default permission, click the Permissions
button to access the Permissions dialog for the share, as shown in Figure 17-2.

[Link] 756 3/11/10 4:31:42 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 757

FIGURE 17-2

The default
permission
on a shared
folder gives
the Everyone
group the Read
permission.

Now, consider what happens when a user connects to files through a share. First,
the NTFS file and folder permissions (inherited and otherwise) are combined with
the resulting least-restrictive permission applying at the NTFS level, and then the
resulting effective NTFS permission is combined with the share-level permission,
and the most restrictive permission is applied.
Because you are depending on the NTFS permissions to provide file security
to a shared folder, and you know that when NTFS and share permissions are
combined, the most restrictive apply, it follows that the default Everyone Read
Only permissions on a share will be both too permissive (“everyone” can read the
contents) and yet too restrictive if you wish to allow network users to modify files
in the shared folder. Exercise 17-1 walks through the steps to modify the share
permissions in Windows Vista/7, so only the users or groups you wish to give access
to have the Full Control permission, and the Everyone group is completely removed
from the share. Modifying the permission actually simplifies your administrative
tasks by allowing you to assign the specific permission at the NTFS level.

[Link] 757 3/11/10 4:31:42 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

758 CompTIA A+ Certification Study Guide

EXERCISE 17-1
Creating a Share and Modifying Share Permissions in Windows Vista/7
These instructions are specific for Windows Vista/7, but they very similar to those in
Windows 2000/XP:

1. From Windows Explorer, right-click on a folder you wish to share and select
Properties.
2. Select the Sharing tab, and then click the Advanced Sharing button. This
step is important because you wish to modify the permissions on the share
you will create.
3. In the Advanced Sharing dialog, most of the options will be dimmed until
you click to place a check in the checkbox labeled Share This Folder.
4. Once the share is created, the other options will be active.
5. Click the Permissions button.
6. In the Group Or User Names box, click the Add button and select the user
or group you wish to give permissions to the share. These should be users or
groups to whom you have already assigned NTFS permissions to the folder.
Click OK when you are done.
7. In the Group or User Names box, select each added user or group and give
them Full Control. Then, select the Everyone group and click the Remove
button.

Permissions and Moving and Copying When a file or folder is created on

an NTFS volume, it inherits permissions from its parent folder; this is also true
when a file or folder is copied or moved to a folder on an NTFS volume. There is
one important exception to this rule that occurs when you move a file or folder to
a different folder on the same NTFS volume: in this case, the file or folder takes its
permissions with it.

Administrative Shares
Windows has special hidden administrative shares that it creates automatically
and uses when administrators, programs, and services connect to a computer over
a network to perform special tasks that are mainly for use in a Microsoft domain

[Link] 758 3/11/10 4:31:42 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 759

network. Before Windows Vista, you could connect to an administrative share using
a valid local account, but that feature is disabled in Windows Vista/7, only allowing
access to users with domain accounts. You cannot modify the permissions on an
administrative share.
An administrative share has a special name that ends in the $ character, which
marks the share as being hidden as well as being administrative. You can create a
hidden share by appending the dollar sign to its name, but only the operating system
can create administrative shares. These are the administrative shares:

■ Root partitions or volumes Only internal storage is shared, no removable

drives (optical, USB flash drives, etc.). The administrative share for drive
C: is C$. The complete network path to this share is \\computername\C$,
which is a Universal Naming Convention (UNC) path.
■ System root folder This share points to the folder in which Windows
was installed, which usually is C:\Windows. The UNC path to this share is
\\computername\admin$.
■ FAX$ share This share points to a shared fax server.
■ IPC$ share This share is used for temporary connections for remotely
administering a computer.
■ PRINT$ share This share is used for remote administration of shared printers.

Applying NTFS File and Folder Encryption

Encrypting a folder using the Encrypting Files System (EFS) on a Windows NTFS
volume does not actually encrypt the folder itself, but all files in the folder are
encrypted, and any new files saved in the folder are automatically encrypted. NTFS
encryption only applies to files when they are saved in the encrypted folder and
when they are moved or copied into unencrypted folders on NTFS volumes that
support encryption. This is true, even if the folder to which the files are moved does
not have encryption turned on. The files are not encrypted if they are copied to
non-NTFS volumes or if they are e-mailed to someone.
Conversely, moving a nonencrypted file into an encrypted folder using drag-and-
drop will not encrypt the file. Therefore, if you want a file to remain encrypted, be
sure to only use cutting and pasting (or saving from within an application) to move
the file into an encrypted folder.
It is simple to encrypt a folder. Simply open the properties dialog box of the folder
and click Advanced. In the Advanced Attributes dialog box, click Encrypt Contents
To Secure Data (see Figure 17-3), and then click OK.

[Link] 759 3/11/10 4:31:42 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

760 CompTIA A+ Certification Study Guide

FIGURE 17-3

Turn on the
Encrypt attribute.

You can only decrypt a file when logged on with the account used to encrypt it.
Knowing this is important. Then decryption is transparent; simply open the file
using the usual application for that file type. Both normal permissions and a special
authorization to decrypt are applied. Even when logged on with another account
with Full Control permissions to the file, you will not be able to decrypt the file,
and, therefore, you will not be able to use it in any way.
The Encrypting File System (EFS) in Windows XP/Vista/7 has the following
features, which are not available in Windows 2000:

■ A user can share encrypted files with other users.

■ A user may encrypt offline files, which are files that are stored on a network
server but cached in local memory when the local computer is disconnected
from the server.

The only person who can decrypt a file or folder is the person who encrypted it,
or a member of a special group called Recovery Agents. By default, only the local

[Link] 760 3/11/10 4:31:42 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 761

Administrator account is a member of this group. Recovery is not the same as being
able to directly access the data; it is an advanced task, described in the Windows
Help utility in each version that supports NTFS encryption.

While the CompTIA A+ Essentials Exam objectives require that you

understand NTFS encryption, this encryption has shortcomings that you will
learn about later in this chapter in the section “Troubleshooting Security.”

Working with BitLocker

As described in Chapter 16, BitLocker will encrypt your entire boot volume. It
requires that the boot volume be separate from the system volume, and when you
install Windows Vista or Windows 7 on a blank hard disk, Windows Setup will
create two volumes and will enable BitLocker. The system volume is the active
primary partition containing the boot loader accessed by the BIOS during startup.
Traditionally, the system and boot volumes are one and the same, but they must
be separate because BitLocker cannot encrypt the system volume since it must be
accessible by the BIOS startup, which cannot access an encrypted drive. Figure 17-4
shows the Disk Management snap-in on a Vista computer on which the system and

FIGURE 17-4 The system and boot partitions are combined on Drive 0.

[Link] 761 3/11/10 4:31:43 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

762 CompTIA A+ Certification Study Guide

boot volumes (seen on Disk 0) are one and the same: Volume C:. Realizing that two
volumes on the same physical disk are required, not two physical disks, is important.
Further, beginning with Windows Vista Service Pack 1, drives other than the boot
volume can be encrypted with BitLocker.
If you install Windows 7 on an unpartitioned hard drive, it will create a small
(approximately 100 MB) system partition and a second partition containing the
balance of the drive space as the boot partition, as shown in Figure 17-5, in which
Disk 0 contains a 100 MB NTFS volume identified as System, Active, and Primary.
The boot volume is drive C:. This configuration will allow BitLocker to store the
encryption key on the hard drive.
You can configure BitLocker to install the encryption key in one of several
locations, including a USB drive, a TPM chip, or on the system volume (Windows 7
only). The minimum requirements for using BitLocker in Windows Vista are

■ Separate NTFS-formatted boot volume

■ Separate NTFS-formatted system volume with a minimum of 1.5 GB

If you wish to store the encryption keys on a TPM chip the Vista requires

■ TPM version 1.2

■ System BIOS, with support to at least 1.2 Trusted Computer Group (TCG)
standards

FIGURE 17-5 The system volume and boot volume are separate on Disk 0.

[Link] 762 3/11/10 4:31:43 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 763

If you wish to store a personal ID number (PIN) on a USB drive, Vista requires
■ System BIOS with support for accessing USB storage devices

Table 17-1 compares the features of BitLocker with NTFS Encrypted File System
(EFS).
When you install the Ultimate or Enterprise versions of Windows Vista or
Windows 7 on a computer with a TPM 1.2 chip on the motherboard, Windows
Setup will automatically enable BitLocker and install the BitLocker applet in
Control Panel; otherwise, you will need to enable it yourself.

Data Wiping
In many organizations, the permanent removal of data is an important security
function, but in too many organizations removing data from storage devices is
overlooked. Further, the ordinary user deletes data every day that is not really
deleted but saved in the Recycle Bin. Suppose you delete confidential files and then
walk away from your computer without logging off. Someone with malicious intent
could sit at your computer in your absence, open the Recycle Bin, and restore the
deleted files.
In a scenario in which you remove computers from service, thoroughly removing
the data from the hard drives is important because Windows’ delete, format,
and even partition programs do not truly destroy the data saved on hard drives.
Therefore, a determined person can recover the data or even remnants of data files.

TABLE 17-1
BitLocker NTFS Encrypted File System (EFS)
BitLocker vs. Protects the entire boot volume. Only protects specific files and folders;
NTFS Encryption cannot protect operating system files.
Protects system integrity during the boot Does not protect system integrity.
process, looking for system changes.
Only administrators can enable or disable. All users can encrypt files.
Does not restrict file access to particular Can restrict file access to specific users.
users.
Stores encryption keys in a TPM or USB Stores encryption keys in user profiles.
drive.
Can prevent system startup without a PIN Cannot prevent system startup.
Requires two volumes. Can be used when the system and boot
volumes are combined.

[Link] 763 3/11/10 4:31:43 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

764 CompTIA A+ Certification Study Guide

So whether it is your personal financial data, or your employer’s super-secret research

and development information, start being smarter about removing data from hard
drives before it falls into the wrong hands. In the extreme, you could remove a
hard drive from a user’s computer and physically destroy it. Most of us do not need
this extreme measure, but can use one of the many inexpensive software tools for
permanently removing data from hard drives.
To begin with, be smarter about deleting files from your hard drive in Windows.
A simple delete from any menu in Windows will only move the file from its present
folder into the special Recycle Bin folder. There are conditions under which
normally deleted files do not go to the Recycle Bin. These include files stored on
removable media, files stored on network drives, and files deleted from compressed
folders. These files are said to be “permanently” deleted, but even they can be
recovered, although not quite as easily as from the Recycle Bin. Undeleting these
files takes special hardware.
Recovering a file from the Recycle Bin is easy. This is great for those times
when you change your mind after deleting a file—or accidentally delete the wrong
file. It is also a security hole. So, when you are absolutely sure that you want to
permanently delete a file, you can avoid sending it to the Recycle Bin by selecting
the file and holding down the SHIFT key while pressing the DELETE key.
This only protects you from the user who gains access to your computer and
uses the Recycle Bin to recover deleted files. It does not protect you from someone
who gains access to your computer or hard drive and uses specialized software
(and hardware) to recover deleted files or files from a reformatted or repartitioned
partition.

Use the staying power of data on a hard drive to your advantage. If a hard
drive with valuable data fails or somehow is damaged so you cannot access the
data on the drive, you can send the drive to a company that will recover your
data—at a price. If recovering the data is worth thousands of dollars, then this
is an option to explore. You will find these services by searching on hard drive
data recovery in a search engine. Remember the bad guys can do this, too.

To protect your data from malicious attempts to recover it, use a data-wiping
program that removes the data from the hard drives and other writable storage
devices. The most recent name for this class of program is “shredder.” A shredder
overwrites deleted files using random data, and it overwrites the same space multiple
times. You can choose to shred an entire disk or just any one or more documents.
Most of these programs will protect your data from all but the most aggressive

[Link] 764 3/11/10 4:31:43 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 765

attempts to recover data using very high-end software and equipment. Several free
shredders and several commercial products are available. Use a shredder program
to wipe out a hard drive before moving a computer to another user, donating it, or
sending it to a recycler.
Consider using a shredder program on a regular basis to ensure that deleted files
are truly deleted. Beginning with XP, Microsoft Windows comes with CIPHER, a
command prompt utility for encrypting files and folders. However, one option of this
command, the /w (wipe) switch, makes it work like a shredder, permanently removing
all deleted files from a folder or an entire volume. When you enter the command
cipher /w:drive:\folder

all the empty space (which includes deleted files) in the folder specified will be
overwritten. If you enter the command with this syntax and only specify a drive, it
will overwrite all the “empty” space on the drive. Figure 17-6 shows the CIPHER
command with the correct syntax to overwrite the deleted files in D:\SalaryReview.
The line of dots acts as a progress bar, with more dots showing as the program works
until it is finished. CIPHER makes three passes: in the first pass, it writes all zeros
onto the empty space; on the second pass, it writes the hexadecimal value FF over
the same space; and on the final pass, it writes random numbers. This technique is
the same one used by shredder programs.
Neither the CIPHER command nor third-party shredder programs should be
used without taking the precaution of first backing up any data on the same drive,
because the way these programs manipulate data on the drives has the potential of
damaging good files if anything goes wrong during the shredding process.

FIGURE 17-6 The CIPHER command is used to remove all deleted files in a single folder permanently.

[Link] 765 3/11/10 4:31:44 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

766 CompTIA A+ Certification Study Guide

Implementing a Defense Against Malicious Software

There are many small building blocks to an effective defense against malicious
software. It begins with educating yourself about threats and defenses and setting up
a foundation of secure authentication and data protection techniques, and continues
with placing a firewall and related technologies at the junction between a private
network and the Internet. Then, each computer in the private network must use a
group of technologies, such as software firewalls and programs that detect and remove
all types of malware, to protect it from attacks.

Self Education
Research malware types, symptoms, and solutions to keep yourself informed. Check out
the many virus encyclopedias on the Internet sponsored by many different organizations,
including security software manufacturers, such as Trend Micro, Kaspersky, and
Symantec. Despite the use of the word “virus,” these lists contain all types of known
threats and are always up-to-date. Threat Encyclopedia is the title of the list maintained
by Trend Micro, a security software manufacturer. Also look for antivirus support
forums, which also include information about threats other than viruses.
Such resources categorize the malware by type and describe symptoms and
solutions. The Web site [Link] contains lists of antivirus support
forums and virus encyclopedias. The U.S. government maintains excellent general
information on all types of threats to computers at the United States Computer
Emergency Readiness Team (US-CERT) Website at [Link]/cas/tips/.

Protecting Windows Files and Programs

As described in Chapter 11, Windows 2000/XP protects essential system files and
programs using the Windows File Protection (WFP) service. Windows Vista/7 uses
the Windows Resource Protection (WRP) service, which also protects critical
registry keys.

User Account Control

We described User Account Control (UAC) in Chapter 8. This feature is new
in Windows Vista and acts as a defense against all types of malware. With UAC
enabled, all users are required to run in standard user mode, even if they log on as
a member of the Administrators group. Both types of users can make changes to

[Link] 766 3/11/10 4:31:44 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 767

their own settings, but if either type of user attempts to run a program requiring
administrator-level permissions, the screen grays out and a dialog box appears.
A standard user will see the Credentials Prompt, requesting an administrator’s user
name and password. Supplying these credentials will allow the task to continue. An
administrator will see a Consent Prompt, as shown here, and must click Continue.
In both cases, only the identified task will run in the more privileged mode, while
the user continues to work in standard mode.

UAC is turned on by default in both Windows Vista and Windows 7, although

Microsoft made changes to Windows 7 that reduce the number of prompts you will
see because they changed the number of Windows programs that require approval to
run. Turn UAC off or on in Windows Vista by opening User Accounts in Control
Panel and then selecting Turn User Account Control On Or Off and clearing
the check box labeled Use User Account Control (UAC) To Help Protect Your
Computer. Select OK and then click Restart Now or Restart Later. In Windows 7,
access this dialog box quickly by typing uac in the Start Search box. This dialog is
more complex in Windows 7 than in Windows Vista, allowing an administrator to
further modify how UAC works. Figure 17-7 shows the Windows 7 User Account
Control Settings with four options to control when the Consent Prompt appears
when the administrator is logged on:

■ Always Notify Notify when programs try to install software or make

changes to the computer, or when the administrator user attempts to make
changes to Windows settings. The desktop will dim when the prompt
appears.
■ Notify Me Only When Programs Try To Make Changes To My
Computer The desktop will dim. This is the default setting.

[Link] 767 3/11/10 4:31:44 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

768 CompTIA A+ Certification Study Guide

FIGURE 17-7 The Windows 7 User Account Control Settings dialog box

■ Notify Me Only When Programs Try To Make Changes To My Computer

(Do Not Dim My Desktop) Only choose this option if it takes a long time
to dim the desktop.
■ Never Notify Not recommended.

Software Firewalls
If your computer is behind a well-configured hardware firewall, that is all the firewall
protection you should require for attacks coming from outside the private network.
However, many attacks come from within a private network. Therefore, whether your
computer is behind an expensive well-managed hardware firewall or an inexpensive
SOHO broadband router, you still need to install and configure a software firewall
on every Windows computer. The best strategy is to start with the most restrictive

[Link] 768 3/11/10 4:31:44 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 769

settings and then make exceptions to allow the required traffic to pass through
the firewall. Since one of the main jobs of a firewall is to maintain port security,
exceptions are in the form of port numbers and can even include specific IP addresses
or domain names associated with port numbers. The Windows Firewall Exceptions
page allows you to make an exception based on a program name or port. The program
names work because Windows knows the port numbers of the listed programs.

Windows Firewall
Until Windows XP Service Pack 2, the Windows firewall was called Internet
Connection Firewall (ICF) and was intended to be enabled on a Windows computer
that was sharing its Internet connection with other computers on a LAN. When
Windows XP installs, this firewall is not turned on. When Windows XP Service
Pack 2 installs, it includes the Windows Firewall, which is more configurable than
ICF. Windows Firewall is on by default, and you can open the Windows Firewall
dialog box through its Control Panel applet. Here is the Windows Firewall dialog
box with three tabbed pages as it appears in Windows XP Service Pack 2 or later.

[Link] 769 3/11/10 4:31:44 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

770 CompTIA A+ Certification Study Guide

Windows Firewall is on by default in Windows Vista/7, and an easy way to access

the Windows Firewall folder is to enter windows firewall in the Control Panel’s
Search box and then click Windows Firewall. Exercise 17-2 will help you learn
more about the Windows Firewall. You must log on as the local administrator or
a member of the local Administrators group to work with the Windows Firewall
(and to complete this exercise). If you install a third-party firewall, you should
turn off Windows Firewall, because multiple firewalls on the same computer do not
cooperate. Therefore, when you do Exercise 17-2, if you find that it is turned off, do
not turn it on unless you are sure that no other firewall is installed.

EXERCISE 17-2
Configuring the Windows Firewall in Windows Vista
In this exercise, you may encounter UAC prompts. If you are logged on with an
administrator account, simply choose to continue. If you are logged on with a
standard account, you will need to enter credentials to continue, in which case, you
should obtain these credentials before you begin.

1. Open Control Panel and enter Windows Firewall in the Control Panel
Search box.
2. If the Windows Firewall is on, proceed with the next steps. If it is not on, find
out why. If you have another firewall, you will need to look at the settings for
that firewall.
3. In order to view the settings or create exceptions, select Allow A Program
Through Windows Firewall (a task item on the left). This will open the Win-
dows Firewall Settings dialog box, shown in Figure 17-8.
4. Only place a check in boxes next to services you need to use. For instance,
turn on File And Printer Sharing only if you need to share folders or printers
from your computer.
5. The Add Program button will allow you to add a program or service to the
list. We do not recommend adding a program unless you have very reliable
information that this is required and will not cause harm.
6. Similarly, you should only use the Add Port button if you have expert advice
on adding a port, or port ID, the identifying information for an IP packet.
7. When you have finished with the Exceptions page, click the Advanced tab.

[Link] 770 3/11/10 4:31:45 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 771

FIGURE 17-8

The Windows
Firewall
Exceptions tab
in Windows Vista

8. The Network Connection Settings section of the Advanced page will allow
you to enable or disable the firewall for network connections to this computer.
If you only have a single network connection, you will see only one connection
listed.
9. Finally, the Restore Defaults button at the bottom of this page allows you to
restore Windows Firewall to the default settings.
10. When you are finished, close the Windows Firewall dialog box by clicking
OK (to accept changes) or Cancel to quit without making changes.

Third-Party Software Firewalls

There are many inexpensive third-party software firewalls—some commercial and
some free. Examples of personal firewalls are ZoneAlarm and ZoneAlarm Pro by
CheckPoint, Norton Personal Firewall by Symantec, and Sunbelt Personal Firewall

[Link] 771 3/11/10 4:31:45 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

772 CompTIA A+ Certification Study Guide

from Sunbelt (previously named Kerio Personal Firewall). Each of these is available
as a separate product, or as part of a security software bundle. ZoneAlarm is a free
program with fewer features than ZoneAlarm Pro.

Antivirus
An antivirus program can examine the contents of a disk and RAM looking for hidden
viruses and files that may act as hosts for virus code. Effective antivirus products
not only detect viruses in incoming files before they can infect your system, but also
remove existing viruses and help you recover data that has been lost because of a virus.
To keep an antivirus program up-to-date, always enable the update option you
will find in all popular antivirus programs. Configure it to connect automatically
to the manufacturer’s Website, check for updates, and install them. An antivirus
program will update at least two components: the antivirus engine (the main
program) and a set of patterns of recognized viruses, usually contained in files called
definition files. Manufacturers of antivirus software commonly charge an annual
fee for updates to the antivirus engine and to the definitions. Common commercial
antivirus manufacturers with both home and business solutions include Symantec,
TrendMicro, CA, McAfee, Kaspersky, and Grisoft. There are excellent free services
for home users. One example is AVG Anti-Virus from Grisoft. Even the commercial
vendors who do not offer a completely free product often allow you to try their
product for a period, usually 30 days.

Phishing Filter
In Chapter 16, you learned about the dangers of phishing, a practice in which
authentic-looking communications attempt to fool you into providing personal
financial information. Phishing is often very difficult to detect for what it truly is.
Along with educating yourself on what to look for, be sure to install or enable a
phishing filter for your Web browser. You may already have an unenabled one. Keep
in mind that even with a phishing filter, you must still be alert to possible phishing
attacks. A phishing filter will check for suspicious behavior on the Websites you
visit. It will also usually maintain a list of reported phishing sites. Here is how a
phishing filter works:

■ The filter manufacturer, such as Microsoft for Windows Internet Explorer 7

and 8, maintains a list of legitimate Websites, which it downloads to your
computer on a regular basis. As you browse the Web, the phishing filter
compares each site you visit with the list.

[Link] 772 3/11/10 4:31:45 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 773

■ The phishing filter looks at the information posted on Websites, and

compares it to traits typical of phishing Websites on each site you visit. If
it detects these traits, it will warn you and flag the Website as suspicious. If
you receive a message that a site is suspicious, do not submit any personal
information.
■ Depending on how you configure a phishing filter, it may automatically send
addresses of Websites you visit to the manufacturer, which compares them
to a list of reported phishing Websites. The information sent includes your
IP address, which is encrypted using SSL, and only the domain and path of
the Website. It sends no other information identifying your activities at the
Website.

To configure Phishing Filter in Internet Explorer 7, open Internet Options.

Internet Options is a Control Panel applet. You can open Internet Options from
Control Panel or from within IE by selecting Tools | Phishing Filter | Phishing
Filter Settings. In Internet Options, select the Advanced tab, and scroll down to
Phishing Filter in the Settings list.
While browsing the Web, selecting the Tools | Phishing Filter option on the
Tools menu in IE will allow you to check the current Website, turn off (or on)
Automatic Website checking, report a site, or open the Internet Options menu to
change Phishing Filter settings.
In Internet Explorer 8, the SmartScreen Filter, which also protects against
fraudulent Websites and other threats, replaces Phishing Filter. It works much like
Microsoft’s Phishing filter, except it communicates with the Microsoft SmartScreen
service while you are browsing the Internet, comparing sites you visit with known
phishing and malware sites.
Keep one thing in mind: a phishing filter is only an aid. You must educate
yourself, and the people whose computers you support, about the tactics phishers
employ. Never provide your social security number or other financial information
in response to an unsolicited message—no matter how official the message or the
method of transmitting it appears to be. Phishing attacks can come to you via any
means—through the mail (postal service) or via e-mail.

Antispyware/Anti-Adware/Pop-Up Blocker
As you learned in Chapter 16, spyware and adware are types of programs that install on
your computer and perform functions on behalf of others. The intent of spyware can
be very malicious, including identity theft, whereas the intent of adware is generally

[Link] 773 3/11/10 4:31:45 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

774 CompTIA A+ Certification Study Guide

less malicious, even if the people responsible for the adware hope to profit by
advertising their products.
How spyware and adware get installed on your computer is yet another issue.
Users have a hard time believing that their actions invite malicious programs in, but
that is how it happens. Perhaps you installed a wonderful free program. You may be
very happy with the program itself, but you may have also installed spyware, adware,
or worse along with the program.
The most insidious method used to install spyware and adware on your computer
comes in the form of a pop-up window resembling a Windows alert. These bogus
messages may warn you that spyware was installed on your computer, and you must
take some action, such as clicking OK in the pop-up window. By clicking OK, you
supposedly start downloading software from Microsoft or another credible source
to install on your computer to rid you of the threat. In reality, it is only a disguised
method for installing spyware or adware.
Do not fall for these tricks. Fighting these threats begins with being very careful
about how you respond to messages in pop-up windows and what you install on your
computer while browsing the Web. If you are unsure of a message, do not click any
buttons or links within the window, but close it using the close button at the upper-right.
Many free and commercial programs are available that effectively block various
forms of spyware and adware, especially pop-ups. These are the easiest to block, and
the most annoying because a pop-up advertisement appears in its own window and
must be closed or moved before you can see the content you were seeking. Such a
blocking program is a pop-up blocker. Configure a pop-up blocker so it will block
pop-ups quietly. You can also opt to configure it to make a sound, and/or display a
message, allowing you to decide whether to block each pop-up.
Microsoft’s Windows Defender protects your computer from spyware and some
other types of malicious software packages. It installs with Windows Vista and
Windows 7, and it is available as a free download for Windows XP, but it does not
support Windows 2000.
We have found a few Websites where blocking all pop-ups has blocked much of
the content we were seeking. If you find that to be the case, configure the pop-up
blocker to allow pop-ups for that session or configure it to display a message. You can
also configure it to always allow pop-ups from specified sites.
Pop-up blockers are now the norm in Web browsers, and third-party pop-up
blockers are available. If your Web browser does not have a pop-up blocker option,
you may simply need to update the browser to a newer version.
Antispyware software is now often part of an Internet security package that includes
a software firewall, antivirus, antispam, as well as antispyware. Many vendors offer

[Link] 774 3/11/10 4:31:45 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 775

these packages, including Symantec, Trend, AVG, and others. You can also find free or
inexpensive individual antispyware programs.

Implementing Security Programs

Today’s security software is very different from a decade ago, because today’s threats
are more diverse than a decade ago. Therefore, you are not as likely to install a
simple antivirus program, but rather an entire security suite, so we’ll talk in terms
of a multifunction security suite. Symantec, Trend Micro, and many other software
manufacturers offer such suites, which normally offer a full range of security products
including antivirus, antispyware, phishing filters, and even firewalls. Like these
third-party security suites, Microsoft’s Windows Security Essentials protects against
all known malicious software. It is available as a free download from Microsoft’s
Website at [Link]/security_essentials/.
Installing a security suite that includes a firewall will normally disable the
Windows Firewall. Installing this into Windows Vista or Windows 7 automatically
disables Windows Defender. Before installing a security suite in Windows XP, you
must uninstall Windows Defender.
Part of the installation of a security suite is a thorough scan of your computer,
including memory contents and all portions of all storage devices, examining all
types of files, and the parts of the disk where viruses can hide, such as the boot
sector or boot block. Also, as part of the installation, you can choose to turn on
automatic scans (the normal default) and the frequency of those scans. Even when
you configure automatic scans, you can choose to initiate a scan when you detect
possible malware symptoms.

Identifying Malware Symptoms

Malware symptoms range from no symptoms to overt, but not too obvious, symptoms
such as sudden slowness, unusual cursor movements, and unusual network activity
(indicated by status lights or messages) when you are not actively accessing the
network.

Removing Malware
When malware is detected, you must remediate the infected systems, removing
the malware and repairing any damage it may have done. We will explore several
techniques.

[Link] 775 3/11/10 4:31:45 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

776 CompTIA A+ Certification Study Guide

Quarantine
In the case of detected malware, your security program may quarantine the
malware file or it may remove it entirely. It all depends on the security software
configuration. A quarantined file is disabled, but not removed from the computer.
Some security software talks about the malware being in a “vault,” which is the same
as quarantining. Since security software can make mistakes, identifying a critical and
uninfected file as malware, configuring it to place detected malware into quarantine
gives you an opportunity to review the file and decide what action to take. On a
larger scale, some organizations, upon discovering that one or more computers are
infected, will quarantine those computers, removing them from the network entirely
until the malware is removed.

Scan and Removal Techniques

Some malware is not detectable under normal computer operation. These infections
are often, but not always, ones that occurred before adequately protecting a system.
They can also occur if you have not kept up-to-date with updates—both to the
operating system and to the security programs. If you suspect that a computer is
infected, but a normal scan from within Windows does not detect malware, then
you should try a special technique for detecting and removing malware. For such
a scenario, the top security programs have a special Safe Mode Scan that runs in
Windows Safe Mode. To do this, restart Windows in Safe Mode, and then locate the
security program and have it run a full scan. If it detects malware, have it quarantine
or remove it, and then restart the computer and see if the symptoms have gone away.
Although the top security programs claim to protect against all types of malware,
including boot sector viruses, these are rather difficult viruses to detect and remove
once they have infected a computer. Therefore, security software will, by default,
scan all removable media upon insertion, not allowing access to it or programs to run
from it until the scan is complete. Never disable this option.
If you suspect a boot sector virus in Windows 2000 or Windows XP, repair the
boot block with the Recovery Console. In Windows Vista or Windows 7, use the
System Recovery Options menu described in Chapter 11.

Preventive Maintenance for Security

As all steps you take to implement security are preventive steps, we do not need
to add a long description of preventive security maintenance. There are, however,
certain tasks that we should add to those described so far in this chapter that fall

[Link] 776 3/11/10 4:31:46 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 777

under preventive maintenance, beginning with backing up data, keeping up-to-date

on service packs and patches, training users, and recognizing social engineering.

Implementing Data Backup Procedures

An important part of data security is a backup policy that includes frequent backups
of data to removable media. Storage of the media should also be part of the policy.
Although backup media should be handy for quick restores, a full backup set should
also be stored offsite in case something occurs to the building in which the computer
is housed, as well as to the computer. The frequency of the backups, and of the full
backup that is stored offsite, depends on the needs of the organization. It is not
possible to overemphasize how important it is to back up data. We discussed backup
in Chapter 10. We will talk about additional issues related to backup here.
Users can back up files they created on their local NTFS volume, including the
My Documents or Documents folder in their own profile and its contents. Users
can restore files and folders to which they have the Write permission on an NTFS
volume. Members of the local Administrators and Backup Operators groups have the
right to back up and restore all files. Individual users in these groups can back up and
restore files that they do not normally have permissions to access. This ability does
not give them any other access to these files and folders.

Installing Service Packs and Patches

Although this point was made previously in this book, it is important to the security
of your computer and your confidential data that you keep your computer updated
with the latest service packs and patches. If you have Internet access, turn on
Automatic Updates in Windows. In addition, any security software you install will
normally have an automatic update feature. Be sure to turn this on.

Although every security and user training. User training should

measure you take is preventive against include the use of the malware prevention
threats, the CompTIA A+ Essentials Exams technologies on users’ systems and the
stress the importance of keeping your social engineering situations they may
operating system and security software encounter.
up-to-date with service packs, patches,

[Link] 777 3/11/10 4:31:46 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

778 CompTIA A+ Certification Study Guide

SCENARIO & SOLUTION

I support computers in a large organization that uses A properly configured hardware firewall will protect
Cisco routers and firewalls at all connections to the against invasions to the network, but it will not
Internet. Why should we use personal firewalls on all protect each computer from invasion from within the
our Windows computers? private network.
Now that I have a phishing filter enabled in Yes, you still must watch for phishing attempts.
Windows, do I need to be on the watch for phishing? Educate yourself on the techniques phishers use to
obtain your personal financial information.

Training Users
Knowledge of the danger of threats and ways to prevent malicious software from
invading computers is important to both the computer professional and to each PC
user. Do your part to keep yourself current on security technologies. Depending on
your role in an organization, take all opportunities to educate users. Make them aware
of the company’s security policy and the role they need to play in preventing attacks.

Recognizing Social Engineering

In Chapter 16, you learned about social engineering and ways to recognize social
engineering when you encounter it in e-mails and other messages. Do your part to
inform other users about social engineering by sharing what you have learned and by
directing them to look at a site that educates people about these threats. We gave an
example in Exercise 15-1.

Securing a Wireless Network

In Chapter 14, you learned about creating a Wi-Fi network. The radio signals Wi-Fi
uses make your Wi-Fi network vulnerable. Anyone with a computer with a Wi-Fi
adapter can pick up these radio waves and access your network and your computers,
unless you take steps to secure your wireless network.

Wireless Access Point/Wireless Router Configuration

The heart and soul of a wireless network is the wireless access point or wireless
broadband router. This is the central point for implementing security, followed up by
configuring the wireless NICs for each client. The important security tasks involve

[Link] 778 3/11/10 4:31:46 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 779

keeping the WAP updated, setting the administrator password, disabling the SSID
broadcast, configuring MAC filtering, disabling DHCP, encrypting transmitted
signals, and configuring firewall settings. You should implement as many of these
changes as is practical, and be sure to document all the settings on your WAP and
your wireless client computers. This will help you to restore the WLAN to the same
level of protection if something should happen to the WAP, such as a complete
failure or an invasion by someone who manages to lock you out. More on this last a
bit later in the following discussion.
We assume that you have updated the firmware on your WAP and wireless
NICs, as suggested in Chapter 14. Exercise 14-2 in Chapter 14 walked you through
configuring a WAP, including basic security settings such as changing the default
administrator user name and password and changing the SSID name. We will pick
up where that exercise left off, describing other security tasks, such as disabling the
SSID broadcast, and go into more detail here.

Disable SSID Broadcast

After you change the default SSID to a unique name, disable the SSID broadcast.
Disabling the broadcast makes it difficult for the casual user to see your wireless
network, since the wireless configuration software that comes with most wireless
NICs only displays wireless networks detected from the access point’s broadcast
of the SSID name. Disabling this also reduces the volume of wireless traffic
incrementally. As with the IP address, you will need to search for the SSID broadcast
setting using the access point’s Website. Once the SSID broadcast is disabled, you
will need to manually configure each wireless client with the SSID. Remember you
changed it from the default, and so you must use the new name.

Enable MAC Filtering

All wireless access points that we have worked with also allowed you to limit users of
the wireless network based on the MAC address of each wireless NIC. Recall that all
NICs have a universally unique physical address, called the MAC address. Filtering
will require that you obtain the MAC address for each wireless computer. You can do
this several ways, but we like using the IPCONFIG command on each computer.
Write down the MAC address and connect to the WAP using your browser.
Search for the page where you can configure MAC filtering and enter the MAC
address for each wireless NIC. If you cannot find a setting on the WAP that uses
the term “MAC filtering,” look for other terms, such as “Trusted Wireless Stations.”
Figure 17-9 shows the MAC filter page for a wireless broadband router with a single
MAC address entered. Each address must be added separately to this list.

[Link] 779 3/11/10 4:31:46 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

780 CompTIA A+ Certification Study Guide

FIGURE 17-9

The Wireless
MAC filter page
on a wireless
broadband router

Disable DHCP
One task that will make your wireless network less vulnerable is to disable DHCP
on the wireless access point. Unwelcome wireless clients must have an IP address
to access your wireless network, and if, in the absence of other security, the DHCP
server gives out addresses indiscriminately it makes it easy for intruders.
To set up a wireless network without a DHCP server requires some knowledge
of IP addressing, because, once you disable the DHCP server on the WAP, you will
need to give each wireless client on the network a unique IP address. You must
make sure the IP address for each wireless client is on the same logical network as
the access point. To do this, look at the IP address of the access point. This address
is normally the only one that is static because the access point includes the DHCP
server, which gives out addresses.
Using the Web-based administrative tool for your WAP, locate the DHCP settings
for the wireless network and turn off DHCP. Then assign appropriate static addresses
to each wireless NIC on your network. For instance, if the internal IP address for

[Link] 780 3/11/10 4:31:47 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 781

the WAP is [Link], with a network mask of [Link], manually assign

addresses in the 192.168.1/24 network to each wireless NIC, being careful not to
duplicate addresses. See the instructions for manually configuring a client with an
IP configuration later in this chapter in “Wireless Client Configuration.”
If you do not wish to disable DHCP, then limit the number of IP addresses the
DHCP server can give out to the number of wireless clients on your network. This
will at least avoid unused wireless connections, but don’t stop there.

Encrypt Wireless Signals

The most important setting you will find involves encrypting the wireless
transmissions. On the wireless router’s Website, this setting may simply be labeled
“Security” or “Encryption.” Once you locate it, look for the latest Wi-Fi encryption.
If you do not see a setting for WPA or WPA2, it may be labeled WPA-PSK or WPA-
PSK for WPA pre-shared key, or simply PSK or PSK2. You will also need to choose the
encryption method (TKIP or AES). Once you have done this, enter a passphrase from
8 to 64 characters. The more complicated and the longer the passphrase, the more
secure it will be. Also, be sure you remember this passphrase, because you will need to
enter it in the wireless configuration utility at each computer on the WLAN.
One big problem you could encounter is a mixture of old and new equipment.
If your WAP supports WPA2, but your NICs do not, you need to make a choice.
Use one of the weaker encryption standards that all the wireless devices support,
or spend the time and money upgrading to newer NICs that support the same
encryption standard as the WAP.
A wireless device manufactured before 2003 may only support an older encryption
standard, Wired Equivalent Privacy (WEP). If wireless security is important to you,
ensure that all of your wireless devices support WPA2, which may require upgrading
the BIOS in the device, or even replacing it.

Enable the Firewall

Enable the firewall in your WAP. The firewall setting may be several menu layers
down, but locate it and ensure it is turned on. Then, enable the options appropriate
for your network. A wireless firewall may be minimal, because it assumes that you
do not have servers on the wireless LAN. If available, enable the denial of service
protection, perhaps labeled “DoS Firewall.”

Wireless Client Configuration

Wireless client configuration follows the access point configuration and must be
compatible with the settings on the access point.

[Link] 781 3/11/10 4:31:47 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

782 CompTIA A+ Certification Study Guide

DHCP Client Configuration

By default, when a new network interface card is installed on a computer that has
the TCP/IP stack, Windows configures the card as a DHCP client. Therefore, you
should not have to touch this if a DHCP server is enabled on the network.

Manual IP Configuration
If you have chosen to disable the DHCP server on the wireless access point and do
not have another one on the network, you must manually configure the wireless
NIC on each client computer with an appropriate IP configuration.
To do this, for each PC that has a wireless NIC, open the Network Connections
applet from Control Panel. Right-click the connection for the wireless NIC and
select Properties. On the General tab, scroll down, select Internet Protocol (TCP/IP),
and click Properties. In the Internet Protocol (TCP/IP) Properties dialog box, enter
a unique IP address that is on the same network as the WAP, enter the same subnet
mask as that of the WAP, enter the WAP’s IP address in the Default Gateway box,
and enter the DNS service addresses provided by your ISP or network administrator.
Figure 17-10 shows an example of a static IP address setting.

FIGURE 17-10

Manually enter
the IP settings
for each wireless
NIC.

[Link] 782 3/11/10 4:31:47 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 783

Manual SSID Configuration

If you have disabled the SSID broadcast on the WAP, then you will need to manually
configure each wireless client with the SSID name, since the name cannot otherwise
be easily discovered when SSID broadcast is turned off.

MAC Filtering
If you have configured the WAP to allow only specified MAC addresses, then every
time you add a new client to the WLAN, you need to discover the MAC address
of the wireless NIC on the new client and add it to the list on the WAP. You can
usually find the MAC address on the wireless device itself or on the packaging, or
else you can find it after installing the wireless NIC by running the IPCONFIG
command using the following syntax: ipconfig /all.

Encryption
You will need to configure each wireless client to match the WAP’s encryption
setting. In most cases, you will need to enter the appropriate passphrase—the one
you configured on the WAP. If the client is not at the same level of encryption as the
WAP, determine if an upgrade is available from the manufacturer. If not, consider
purchasing a new wireless NIC.

Troubleshooting Security
Troubleshooting security follows the same path as all computer troubleshooting.
Gather information, perform an analysis, arrive at possible solutions, and apply
the solution and test it. Once you are successful, document the process so you or
your coworkers will not have to “solve” the same problem twice. There are certain
problems that are specific to PC security, and you will explore some of these in the
following sections.

BIOS Password Problems

Earlier in this chapter, we explored the issue of setting passwords in BIOS. As with
all passwords, forgetting a BIOS password is easy. How this will affect the user
depends on the type of BIOS password that was set.
If a BIOS password is set on the system at startup, no one will be able to get
beyond the BIOS password prompt and boot up the computer until the password is
provided. Forget the password, and you are locked out of using the computer.

[Link] 783 3/11/10 4:31:47 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

784 CompTIA A+ Certification Study Guide

If a BIOS password is set on the System Setup menu, and only on this menu, the
computer will boot up normally without requiring a BIOS system startup password.
Forget the password and you can start up the computer just fine, but you will not be
able to access the System Setup menu and make changes. As we mentioned earlier,
this password is necessary in situations in which people have physical access to
computers, as in a computer lab.
In both cases, documenting the password or passwords is very important, and you
should maintain and kept them in a safe place available to all authorized personnel.
The password should not be something only the head techie knows but does not
share with anyone else. There are better ways to gain job security.
If you set a password and later forget it, you will have to find out how to reset
the BIOS in order to access BIOS Setup. Finding this in the motherboard manual
can be difficult, as we have never seen one with an index. Fortunately, motherboard
manuals are usually short and the instructions for resetting or cleaning the BIOS
settings are usually near the back in a troubleshooting section. Alternatively, search
the motherboard manufacturer’s Website. What you must do after that depends on
the system and can range from temporarily removing the battery that supports CMOS
to changing a jumper setting and restarting the computer. Then, you can enter Setup
without providing a password. Your work is not yet done, however, because you will
have lost all custom settings and will need to reconfigure the BIOS settings. Recall
Exercise 4-5 in Chapter 4, in which you learned how to back up CMOS settings. If
you have access to a copy of the CMOS settings for the computer, the configuration
process will be far easier than trying to guess what the settings were. If you do not
know the previous BIOS settings, accept the default settings, but you may face more
than one choice here, such as Fail-Safe Defaults and Optimized Defaults. If you have
such a choice, select Optimized Defaults first and see if everything functions. If not,
you will have to change to the Fail-Safe Defaults. The moral to this story is either
don’t set a BIOS password or, if you do, don’t lose the password.
Anyone who knows how can remove a BIOS password from a physically
unlocked computer case. This demonstrates the futility of setting BIOS passwords on
physically unsecured computers.

Biometrics
Sometimes users cannot log on to a Windows XP computer using biometrics when
the computer resumes from Standby or Hibernate. Microsoft solved this problem in
a hotfix. A hotfix is program code that fixes a specific problem. A hotfix is normally
only available from Microsoft Product Support Services to persons who identify the
problem. In these cases, Microsoft usually waives the normal charges for Microsoft

[Link] 784 3/11/10 4:31:47 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 785

Product Support Services. When we last checked, contacting Support Services

was the only manner in which this fix was available. However, it is worth running
Windows Update to see if this hotfix was added to the updates that are available free
through this service. If you support one or more Windows computers that are using
biometric authentication, check to see if they were updated, and update them before
this becomes a problem.
When this problem occurs, the computer will still accept a basic interactive logon
from the keyboard. Therefore, enter a user name and password from the keyboard.
Then take steps to update the computer.

Forgotten Windows Password

If you have forgotten your password, there is help. For one thing, if you are part
of a Windows domain, tell the network administrator about your problem. Lost
passwords are at the top of the list of things administrators must fix, especially in
an environment where people log on with a standard interactive logon—entering
user names and passwords at their keyboard. The administrator can log on with the
Domain Administrator account (or any account with appropriate rights), access
the Domain User account, and reset the password. The administrator can assign a
password and configure your account so you will sign on with the assigned password
but then must change it during that logon.
Now, if you are not part of a Windows domain, there is still some hope if you
can log on with the Administrator account. If you know the local Administrator
password, or an account that is a member of the local Administrators group, simply
log on with this user name and password, modify the password setting for the user.
If you do not know the Administrator password, and you are working with
Windows XP, your installation of Windows may possibly have a hidden Administrator
account. To access this account, simply restart your computer in Safe Mode. Basic
Safe Mode will do. If you need help with Safe Mode, flip back to Chapter 11 and
read about Safe Mode. Log on in Safe Mode with the Administrator account. Unless
the password was changed, you can leave the password blank when you log on.
After logging on as the Administrator, run the User Accounts applet, and reset the
password on the user account.

No Permissions on FAT32
You would like to set permissions on a folder that you plan to share. You first notice
that there is no Security tab in the Properties dialog box for the folder. Perhaps you
don’t have Simple File Sharing turned on. Then you notice that the volume is not

[Link] 785 3/11/10 4:31:48 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

786 CompTIA A+ Certification Study Guide

NTFS but FAT32. FAT32 does not support file- and folder-level permissions. The
only permissions in this case will be at the share level, and you want to set NTFS
permissions so you can assign permissions to each subfolder under the shared folder.
What can you do?
If there is no compelling reason for using FAT32 on the volume, convert it
to NTFS. Before doing this, back up the entire drive that you plan to convert,
just in case something goes wrong during the process. Once the backup is
completed, convert the volume using the Disk Management node of the Computer
Management console, or by opening a Command Prompt window and running the
CONVERT program. The syntax for running the convert program is
convert d: /fs:ntfs

where d: is the drive you wish to convert. Whether you use Disk Management or the
CONVERT program, if the drive you are converting is not being used by the OS or
any other program, the conversion will occur immediately. If the drive is in use, as
is always the case with the system drive (normally drive C:), you will see a message
that the conversion will occur the next time Windows is restarted.
This conversion is one-way. You cannot
convert back from NTFS to FAT32 unless you
reformat the drive, and then you lose all the
data on the hard drive.
Be sure you understand
Once you have converted the file system
how to convert a volume from FAT32 to
from FAT32 to NTFS, you can assign
NTFS. Remember you cannot reverse this
permissions to files and folders and use other
without losing the data on the drive.
NTFS features not available in FAT32.

Encryption Issues
If you, or the users you support, encrypt files using NTFS encryption, you risk having
the encryption defeated or being locked out of your own encrypted files. Sometimes
we leave the worst news for last. After learning about NTFS encryption in Chapter 16,
we will now explain its shortcomings, and why we do not use it.

NTFS Encryption Can Be Broken

One way in which someone can break NTFS encryption is by guessing your
password. Once someone does that, that person can log on with your user name,
which is often displayed in the logon dialog box as the last logged-on user. Once

[Link] 786 3/11/10 4:31:48 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 787

logged on, the invader has access to everything on your computer, including your
encrypted files.
The key is to not allow any unauthorized person physical access to your computer.
With physical access, someone can use a variety of tools to access your encrypted
files. There are inexpensive software tools, classified as password recovery software,
that can crack passwords on Windows accounts—both local and domain. If you need
such a tool, use an Internet search engine to search on this category of software.

Encrypted Files Can Become Inaccessible

You have been careful to encrypt sensitive data files and to back up your computer.
Then, one day your computer crashes. After trying many recovery options, you
reformat the hard drive, reinstall Windows, and restore your data from the most
recent backup set. Your new installation of Windows has an account with the same
user name as your old one. You believe you did everything you were supposed to do,
but you cannot access the encrypted files you restored to your computer. What can
you do?
First, we will explain what went wrong in spite of your diligence. Your user
account in the original installation of Windows had a unique security identifier
(SID). The NTFS encryption associated this key with the encrypted file, and the
only person who can open and use the encrypted files is someone who logs on with
the account using this SID. Unfortunately, when Windows failed, it took your
account and this identifier with it. After you reinstalled Windows and created a new
account, even though you used the old name, the new account received an entirely
different SID. Therefore, when logged on with this account, you cannot use the
encrypted files.
Products such as ElcomSoft’s Advanced EFS Recovery program may be able to
decrypt NTFS files.

Software Firewall Issues

A firewall may prompt a pop-up a message that a program running on your computer
is trying to access the Internet; the firewall then requires that you make a decision to
allow this action or not. When this happens, use a search engine to discover if the
program is harmful. A wealth of information is on the Web about problem programs.
If your firewall has blocked a program, you can be sure that others’ firewalls have also.
Your search will normally result in many hits, and some of the Websites it discovers may
not be well monitored or the advice may not be from experienced and qualified people.
Do not make a decision based on just one Website. Check out several. If you know and

[Link] 787 3/11/10 4:31:48 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

788 CompTIA A+ Certification Study Guide

trust the company posting the information, such as one of the top security software
companies, you may accept their answer as authoritative.
Some personal firewalls provide additional information on blocked files with
a recommended action you may choose to take. Still, you often have to make a
decision without being absolutely sure of the safety of the program, even when it
appears to be one you are familiar with. Windows does protect certain operating
system files with safeguards in the form of digital signatures. If Windows indicates
that a program is digitally signed, you can usually trust the program.

Wireless Access Point Problems

You are the administrator of a wireless LAN and find that although you could once
access the wireless access point’s Web page, you no longer can do this from any computer
on the WLAN. You also fear that someone has gotten into the WAP and made changes
in the security settings. What can you do? You will need to reset the WAP, using the
manufacturer’s instructions. Then, because resetting the WAP erases all your settings,
you will need to reconfigure it. Be sure to set a complex password on the Administrator
account to keep intruders out, and set all the security settings on the WLAN.

SCENARIO & SOLUTION

I am preparing a new computer for a computer lab. Check out the manufacturer’s documentation on the
How can I configure the computer so students will computer’s system settings and look for the password
not be able to access the system setup and change the settings. Set the password to the BIOS Settings menu
BIOS settings, making the computer unusable? only. Do not set the password on system startup
unless the security policy for the computer lab
requires this.
We are getting ready to order ten laptops for traveling Since you are in the process of purchasing the laptops,
auditors who will have sensitive data on the hard check out biometric devices, such as fingerprint
drives. We are looking for a secure authentication scanners. These are more secure than the basic
method beyond a simple user name and password for interactive logon and work with a Windows domain.
basic interactive logon to a Windows domain. What
do you recommend?
Our employees’ computers are in a public area where We suggest you show the employees how to use
customers and others can easily wander in and out. Windows’ Lock Computer option.
Employees must frequently leave their computers
unattended during the workday for brief periods.
How can they keep their desktops secure without
shutting down their applications and Windows?

[Link] 788 3/11/10 4:31:48 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 789

CERTIFICATION SUMMARY
There are no easy answers or quick fixes when it comes to computer security.
Security threats go beyond simple computer invasions to inflict damage to threats
against your very identity. Therefore, computer security must be multifaceted to
protect computers, data, and users.
This multifaceted approach includes implementing a variety of security programs
and features, including authentication, permissions at both the file system level and
the share level, NTFS or BitLocker encryption, backing up data, and removing data
from computers moved from one place to another or taken out of service with your
organization.
Additionally, train users to protect their computers when they must temporarily
walk away. One effective and simple solution is to use Windows’ Lock Computer,
which preserves the desktop and open files, while protecting them from intruders
until the user enters a password to unlock the computer.
Take steps to secure wireless networks, beginning with the access point
configuration and extending to the wireless clients, which must be compatible with
the WAP. You will need to make decisions about the configuration based on what all
the wireless devices in the WLAN support. Areas of concern are DHCP, SSID name
and broadcasting, MAC filtering, the administrative password, firmware updates,
encryption, and firewall settings.
Approach security troubleshooting as you would any PC troubleshooting. Some
special security issues are BIOS passwords, biometric devices, forgotten Windows
passwords, lack of permissions on FAT32 volumes, problems with NTFS encryption,
software firewall messages, and preventive maintenance for security.

[Link] 789 3/11/10 4:31:48 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

790 CompTIA A+ Certification Study Guide

✓ TWO-MINUTE DRILL
Here are some of the key points covered in Chapter 17.

Implementing Authentication and Data Security

❑ Two types of BIOS passwords can be set—one that must be entered at startup
before an operating system is loaded, and another that is required for access to
the BIOS system settings (also known as CMOS settings).
❑ A smart card reader is a device for authenticating with a smart card. It
requires software and drivers on the local computer and Certificate Services
installed on the domain controllers for the Windows domain.
❑ A smart card cannot be used in three scenarios:
❑ When a user is required to join his or her computer to a domain.
❑ When a user needs to promote the logon computer to a domain controller.
❑ When a user is configuring a network connection for remote access.
❑ Installing support for a key fob involves installing an agent that runs on the
local computer and a service on the active directory domain controllers.
❑ The most popular biometric devices are fingerprint scanners. Some are built
into computers, such as Tablet PCs, and others can be added as external
devices.
❑ Both the built-in and external biometric devices require drivers and software
to integrate with the computer’s security system.
❑ When a user needs to walk away from a PC for short periods, the Lock
Computer option will hide the desktop until the user returns and enters his or
her account password.
❑ In addition to authentication, take steps to protect data directly by using
NTFS and share permissions.
❑ On any computer with Windows 2000 or greater, use NTFS encryption on the
most sensitive data files. In the Ultimate and Enterprise editions of Windows
Vista and Windows 7, enable BitLocker to encrypt the entire boot volume.
❑ Permanent data removal is an important security task, required when moving
a computer from one user to another in an organization or when removing
the computer from service within the organization.

[Link] 790 3/11/10 4:31:49 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 791

❑ Data deleted by users is not truly deleted but saved in the Recycle Bin and
easily recovered. Even after you remove data from the Recycle Bin and
“permanently” delete it, it can be recovered.
❑ A class of programs called “shredders” removes data from hard drives. Run a
shredder on your files as you delete them.

Implementing a Defense Against Malicious Software

❑ A properly configured hardware firewall will protect a network from certain
types of invasions from the Internet or other untrusted network, but personal
firewalls on each computer will protect from attacks that originate on the
private network.
❑ Before Windows XP Service Pack 2, the Internet Connection Firewall (ICF)
was available, but not turned on.
❑ The Windows Firewall that comes with Windows XP Service Pack 2 is an
improvement on ICF, but does not stop traffic generated from your computer,
including connections to the Internet that originate from locally installed
malware.
❑ Antivirus programs examine the contents of a disk and RAM looking for
hidden viruses and files that may act as hosts for virus code.
❑ Always enable the update option in an antivirus program and configure it to
automatically connect to the manufacturer’s Website, check for updates, and
install them. These updates will include changes to the antivirus engine and
definition files.
❑ Install or enable a phishing filter for your Web browser. This filter will check
for suspicious behavior on the Websites you visit. You will still need to watch
out for possible phishing attacks.
❑ Your response to an innocent-looking pop-up can result in spyware or adware
being installed on your computer. A pop-up blocker can prevent unwanted
windows from opening in your browser.
❑ Pop-up blockers are available in Web browsers or as add-ons to Web browsers.
Because pop-ups are often necessary on some legitimate Websites, configure
your pop-up blocker to allow certain sites, or just temporarily allow pop-ups
for a single session at a site.

[Link] 791 3/11/10 4:31:49 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

792 CompTIA A+ Certification Study Guide

Securing a Wireless Network

❑ First configure the wireless access point (WAP), including DHCP (enable or
disable). Then change the SSID name, disable SSID broadcast, enable MAC
filtering, change the default Administrator password, update firmware, enable
the strongest encryption available on the WAP, and enable the firewall.
❑ Configure each wireless client with settings compatible with the WAP.

Troubleshooting Security
❑ A BIOS password, depending on its function, will keep users from starting up
the OS, or just keep everyone out of the Systems Settings menu.
❑ To remove a BIOS password, follow the manufacturer’s instructions, which
may require opening the computer and setting jumpers to erase the contents
of CMOS where the BIOS password is saved.
❑ If you remove the BIOS password by erasing the contents of CMOS, you will
need to run the system Setup program and enter the correct settings for the
system.
❑ If users cannot log on to a Windows computer using biometrics as the
computer resumes from Standby or Hibernate, check to see if the computer
is up-to-date on updates. When this happens, the short-term fix is to log on
with a basic interactive logon from the keyboard.
❑ A Windows hotfix that was not generally available solved the preceding
problem, but by the time you read this, it may be. If not, contact Microsoft
for the hotfix.
❑ You have several options if you forget your password, depending on the
situation. If your logon account is in a Windows domain, ask the domain
administrator to reset the password.
❑ If the forgotten password is for a local user account, you also have several
options. Log on as the local Administrator if you know that password. Then
reset the password for the user account.
❑ Or perhaps your installation of Windows has a hidden Administrator
account. Access this account by restarting in Safe Mode and logging on with
the Administrator account. Unless the password was changed, you can leave
the field blank. Then reset the password for the user account.

[Link] 792 3/11/10 4:31:49 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 793

❑ If the Security tab is missing from the Properties dialog of a file or folder on
an NTFS volume, Simple File Sharing is probably on. Turn this off, and the
Security tab will appear.
❑ FAT32 does not support file and folder permissions. Therefore, unless there
is a special reason for having a FAT32 volume, convert FAT32 volumes to
NTFS using the following syntax:
convert d: /fs:ntfs

where d: is the drive you wish to convert.

❑ Two major problems with NTFS file encryption are that it can be broken and
that encrypted files can become inaccessible. Third-party programs may be
able to recover the encrypted files.
❑ A message from the firewall may pop-up that a program running on your
computer is trying to access the Internet. The firewall then requires that you
decide to allow this action or not. You should research the filename displayed
in the message to determine the action you should take. Use a search engine
and/or information available from the firewall.
❑ If you cannot access a WAP’s Web page and you previously could, reset
the WAP using the manufacturer’s instructions. This will erase the WAP’s
settings, so you will need to reconfigure it. Be sure to set a complex password
on the administrative account to keep intruders out, and set all the security
settings on the WLAN.
❑ Preventive maintenance for security includes installing service packs and
patches, training users, recognizing social engineering, and performing all the
security implementation steps described in this chapter.

[Link] 793 3/11/10 4:31:49 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

794 CompTIA A+ Certification Study Guide

SELF TEST
The following questions will help you measure your understanding of the material presented in this
chapter. Read all of the choices carefully because there might be more than one correct answer.
Choose all correct answers for each question.

Implementing Authentication and Data Security

1. On a computer that has DriveLock, or a similar feature, the password to access the hard drive at
startup can either be stored on the hard drive itself or in this special type of chip, if present.
A. Key Fob
B. TPM
C. CMOS
D. Biometric
2. What service must be installed on domain controllers before users can log on to a client
computer using a smart card?
A. Smart Services
B. Secure attention sequence (SAS)
C. Remote access
D. Certificate Services
3. What strategy should you use when setting NTFS permissions?
A. Set the least restrictive level for all users.
B. Set the most restrictive level that still allows users to accomplish their work.
C. Give the Everyone group Read permissions.
D. Use Allow or Deny on every permission.
4. What permission, applied directly to a file, defeats inheritance?
A. Deny
B. Allow
C. Full Control
D. Modify
5. What simple calculation rule does Windows apply to inherited NTFS permissions to determine
effective permissions?
A. Most restrictive applies.
B. Least restrictive applies.

[Link] 794 3/11/10 4:31:50 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 795

C. Full Control is calculated first.

D. Read is calculated first.
6. What is the recommended order of tasks for creating shares and applying permissions?
A. Create the share, apply NTFS permissions, and apply share-level permissions.
B. Give Everyone Read access, apply NTFS permissions, apply share-level permissions, and
create the share.
C. Apply NTFS permissions, create the share, and apply share-level permissions.
D. Apply NTFS permissions, apply share-level permissions, and create the share.
7. When a user connects to a network file share, how are the effective NTFS permissions and the
share permissions combined for that user?
A. Most restrictive.
B. Least restrictive applies.
C. Full Control is calculated first.
D. Read is calculated first.
8. If an encrypted file is moved or copied into an unencrypted folder on an NTFS volume, which
of the following will occur?
A. It will be decrypted.
B. It will remain encrypted.
C. It will be Read-Only.
D. Encrypted files cannot be moved or copied.
9. Which type of encryption comes with the Ultimate and Enterprise versions of Windows Vista
and Windows 7, as well as Windows Server 2008, and protects an entire boot volume?
A. NTFS encryption
B. WPA2
C. DriveLock
D. BitLocker
10. Which of the following identifies the administrative share that points to the system root folder?
A. C$
B. IPC$
C. \\computername\admin$
D. PRINT$

[Link] 795 3/11/10 4:31:50 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

796 CompTIA A+ Certification Study Guide

Implementing a Defense Against Malicious Software

11. What hardware device or software program uses several technologies to prevent unwanted
traffic from entering a network?
A. Proxy server
B. Firewall
C. Router
D. Switch
12. What two antivirus components are frequently updated?
A. Antispyware
B. Engine and definitions
C. Engine and spam filter
D. Definition files and phishing filter
13. What type of security software examines Website content for certain social engineering traits
and warns you if it detects one of these traits while you are browsing?
A. Antispyware
B. Spam filter
C. Phishing filter
D. Antivirus
14. What service do popular Web browsers, such as IE and Firefox, offer to prevent unwelcome
browser windows from opening on your desktop?
A. Phishing filter
B. Spam filter
C. Pop-up blocker
D. Personal firewall
15. What security software examines the contents of a disk and RAM looking for hidden viruses
and files that may act as hosts for virus code?
A. Phishing filter
B. Antivirus
C. Personal firewall
D. Pop-up blocker

[Link] 796 3/11/10 4:31:50 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 797

16. What Control Panel applet allows you to manage temporary Internet files?
A. Internet Options
B. Computer Management
C. Event Viewer
D. Administrative Tools

Securing a Wireless Network

17 Where do you begin when configuring security for a wireless network?
A. Wireless clients
B. Windows
C. WAP
D. Ethernet router
18. When possible, which wireless encryption should you use to secure your wireless network?
A. WEP
B. WPA2
C. WPA1
D. NTFS

Troubleshooting Security
19. What are the direct consequences of forgetting the password on the Systems Settings menu?
A. Inability to launch Windows.
B. All systems settings will be reset.
C. The Windows password will be reset.
D. Inability to access the System Settings menu.
20. Because users frequently forget their passwords, administrators have the right to take this action.
A. Reset the account.
B. Restrict the account.
C. Reset the password.
D. Remove the password from the account.

[Link] 797 3/11/10 4:31:50 PM

 CertPrs8 / CompTIA A+® Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

798 CompTIA A+ Certification Study Guide

SELF TEST ANSWERS

Implementing Authentication
1. ®✓ B. TPM, or Trusted Platform Module, is a chip that can be used by DriveLock to store
passwords or keys for accessing a computer’s hard drive.
®˚ A, key fob, is incorrect; although a key fob contains a microchip, DriveLock-type systems do
not use one. C, CMOS, is incorrect; although this is a type of chip, DriveLock does not use it to
store passwords. D, biometric, is incorrect, because this is used to describe a type of device that
uses a scan of (usually) a fingerprint for authentication.
2. ®✓ D. Certificate Services must be installed on domain controllers before users can log on to a
client computer using a smart card.
®˚ A, Smart Services, is incorrect. B, secure attention sequence (SAS), is incorrect because
this is a special key sequence used to access the logon dialog box in Windows. C, remote access,
is incorrect because this service has nothing to do with using smart cards to log on to a domain.
✓ B. Set the most restrictive level that still allows users to accomplish their work.
3. ®
˚ A, set the least restrictive level for all users, is incorrect because this would expose data to
®
unauthorized users. C, give the Everyone group Read permissions is incorrect because this would
often be too permissive. D, use Allow or Deny on every permission, is incorrect because this was
not stated as a good strategy and it defeats inheritance, which is not always a good thing.
✓ A. Deny explicitly defeats an inherited permission.
4. ®
˚ B, Allow, is incorrect, because this defeats all inherited permissions except Deny. C, Full
®
Control, and D, Modify, are both defeated if they are explicitly set to Deny.
5. ®✓ B. Least restrictive applies is the correct calculation rule for determining effective
permissions on a file or folder on NTFS.
˚ A, most restrictive applies, is incorrect, as this is not the rule used. C, Full Control is
®
calculated first, and D, Read is calculated first, are both incorrect.
6. ®✓ C. Apply NTFS permissions, create the share, and apply share-level permissions.
®˚ A, create the share, apply NTFS permissions, and apply share-level permissions, is incorrect
because if you create the share before applying NTFS permissions, the share-level default
permissions will leave the shared files and folder too vulnerable. B, give Everyone Read access,
apply NTFS permissions, apply share-level permissions, and create the share, is incorrect for
two reasons: Everyone Read is too open for most situations, and you cannot apply share-level
permissions before you create a share. D, apply NTFS permissions, apply share-level permissions,
and create the share, is also incorrect because you cannot apply share-level permissions before
you create the share.

[Link] 798 3/11/10 4:31:51 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 799

7. ®✓ A. Most restrictive is how effective NTFS permissions and share permissions combine for
a user.
˚ B, least restrictive, is incorrect, although this is how the effective NTFS permissions are
®
applied. C, Full Control, is calculated first, and D, Read is calculated first, are both incorrect.
8. ®✓ B. The file will remain encrypted if moved or copied into an unencrypted folder on an
NTFS volume.
®˚ A, it will be decrypted, is incorrect because as long as the move or copy is not performed
as a drag-and-drop operation, an encrypted file will remain encrypted. C, it will be Read-
Only, is incorrect because this is not the result of moving or copying an encrypted file into
an unencrypted folder on an NTFS volume. D, encrypted files cannot be moved or copied, is
incorrect because encrypted files can be moved or copied.
9. ®✓ D. BitLocker is the encryption that comes with the OS and protects an entire boot volume
on a Windows Vista or Windows 7 computer.
®˚ A, NTFS encryption is incorrect because it only encrypts at the folder level on an NTFS
volume. B, WPA2, is incorrect because this is a Wi-Fi encryption standard. C, DriveLock, is
incorrect because it is not an encryption technology, but a system for controlling access to an
entire hard drive without data encryption.
10. ®✓ C. \\computername\admin$ identifies the system root folder administrative share.
®˚ A, C$, B, IPC$, and D, PRINT$, although all administrative shares, do not point to the
system root folder.

Implementing a Defense Against Malicious Software

11. ®✓ B. A firewall is the hardware device or software program that uses several technologies to
prevent unwanted traffic from entering a network.
®˚ A, proxy server, is incorrect because, although this is one of the technologies used by a
firewall, it does not fully describe a firewall. C, router, is incorrect because this is a separate
device (or software), although it may use one or more of the technologies associated with a
firewall. D, switch, is incorrect because this is not a device or software that prevents unwanted
traffic from entering a network. A switch is a cable-connecting device used within a network.
12. ®✓ B. The engine and definitions are the two antivirus components that are frequently
updated.
®˚ A, antispyware, is incorrect because this is not a component of antivirus, although
antispyware and antivirus may both be part of a security bundle. C, engine and spam filter, is
incorrect because, although the antivirus engine is one of the components that is updated, the
spam filter is not part of antivirus, even though it may be bundled with antivirus software in a

[Link] 799 3/11/10 4:31:51 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

800 CompTIA A+ Certification Study Guide

security package. D, definition files and phishing filter, is incorrect because, although definition
file is part of the correct answer, phishing filter is not part of an antivirus program, but a Web
browser add-on or feature.
13. ®✓ C. Phishing filter is the type of security software that looks at Website contents for certain
traits and warn you if it detects one of these traits while you are browsing.
®˚ A, antispyware, is incorrect because antispyware looks for spyware on your computer,
not social engineering traits. B, spam filter, is incorrect because this does not look for social
engineering traits but for spam in your e-mail. D, antivirus, is incorrect because this does not
look for social engineering traits, but for viruses.
14. ®✓ C. A pop-up blocker is the service offered by Web browsers to prevent unwanted windows
from opening on the desktop.
®˚ A, phishing filter, is incorrect because, although this filter works within a browser, it scans
Websites for certain social engineering traits. B, spam filter, is incorrect because this scans
incoming e-mails for suspected spam messages. D, personal firewall, is incorrect because it
does not work within a Web browser but blocks certain types of incoming messages based on
information in the packet header.
15. ®✓ B. Antivirus is security software that examines the contents of a disk and RAM looking for
hidden viruses and files that may act as hosts for virus code.
®˚ A, phishing filter, is incorrect because this filter works within a browser and scans Websites
for certain social engineering traits. C, personal firewall, is incorrect because this firewall blocks
certain types of incoming messages based on information in the packet header but does not look
at the contents to determine if it is virus code. D, pop-up blocker, is incorrect because it only
works within a browser to prevent unwanted browser windows from opening.
✓ A. Internet Options is where you can manage temporary Internet files.
16. ®
˚ B, Computer Management, C, Event Viewer, and D, Administrative Tools, are all incorrect
®
because none of these administrative tools allows you to manage temporary Internet files.

Securing a Wireless Network

17. ®✓ C. A WAP, or wireless access point, is the place to begin when configuring security for a
wireless network.
®˚ A, wireless clients, is incorrect because the access point must be configured before the
wireless clients can be configured to connect. B, Windows, is incorrect because Windows is also
on the client side of things and should not be configured until after configuring the access point.
D, Ethernet router, is incorrect because, although a wireless network may be connected through
the access point to an Ethernet router, this router has no other connection to the configuration
of the wireless network.

[Link] 800 3/11/10 4:31:51 PM

 CertPrs8 / CompTIA A+ Certification Study Guide / Jane & Charles / 170145-1 / Chapter 17

Chapter 17: Implementing and Troubleshooting Security 801

18. ®✓ B. WPA2 is the latest encryption method and the preferred one to use as of the writing of
this book.
®˚ A, WEP, is incorrect because this was replaced by WPA in 2003 and is no longer
considered secure. C, WPA1, is incorrect because WPA2 is more secure. D, NTFS, is incorrect
because NTFS encryption has nothing to do with wireless networks.

Troubleshooting Security
19. ®✓ D. Inability to access the System Settings menu is the direct consequence of forgetting the
password on the Systems Settings menu.
®˚ A, inability to start up Windows, is incorrect because forgetting the password on the
Systems Settings menu will have no effect on starting Windows. B, all systems settings will
be reset, is incorrect because this will not happen just because you forget the Systems Settings
menu password. C, the Windows password will be reset, is incorrect because the password on
the Systems Settings menu will not affect the Windows password for any user account.
20. ®✓ C. Resetting the password is something an administrator can do to help a user who forgot
his password.
˚ A, reset the account; B, restrict the account; and D, remove the password from the
®
account, are all incorrect actions when a user forgets her password.

[Link] 801 3/11/10 4:31:52 PM