Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

CalCom

Securing Remote Desktop: RDS Configuration & RDS Hardening Guide

Windows Remote Desktop Service (RDS) is a component of Microsoft Windows that allows users to take control of a remote computer or a virtual machine that supports the Remote Desktop Protocol (RDP) via a network connection for RDP access. When enabling remote desktop access (RDP), it is crucial to implement strong passwords to thwart potential brute force attacks to ensure a secure remote desktop.

MSS: (DisableIPSourceRouting) IP source routing protection level (protect against packet spoofing)

Optimally configuring “DisableIPSourceRouting” parameter enhances security by mitigating the risk of denial-of-service (DOS) attacks through packet spoofing. In such attacks, the goal is to inundate the target with high volumes of traffic, and using spoofed IP addresses makes it challenging to filter and identify the true source of the attack. Server hardening can be arduous. CSH by CalCom automates the process, learning your network to eliminate the need for testing.

PowerShell Security Best Practices

Windows PowerShell is a powerful scripting language and a command-line executor developed by Microsoft to provide a better interface for system administrators to simplify managing and automating administrative tasks. PowerShell was launched in 2006 and has been a standard feature of the Windows operating system (OS) since Windows 7, enabling system administrators to simplify and automate administrative tasks while following essential security best practices.

Understanding Active Directory Security Principals

Active Directory is most organizations’ primary identity storage, and is integral to an organization’s operating system. It is used to manage security principals, including user accounts, computers, servers, and other devices in the network. Since its launch 20 years ago, it has been integrated with numerous applications and systems and became one of the main foundations in the organization’s IT infrastructure.

Disable NetBIOS on Windows Servers

While NetBIOS (Network Basic Input/Output System) has been historically used for local network communication, it has several security vulnerabilities and limitations, and its use has diminished over time. Here are some reasons why someone might want to disable NetBIOS: Broadcast Traffic: NetBIOS relies on broadcast traffic for name resolution, which can lead to network congestion and inefficiency, especially in larger networks.

User Account Control: Only elevate UIAccess applications

User Account Control (UAC) serves as a security feature in Windows, aiming to safeguard the operating system from unauthorized modifications. Whenever alterations demand administrator-level permissions, UAC prompts the user, allowing them to either authorize or reject the requested change.

Audit Kernel Object

The Audit Kernel Object feature dictates whether the operating system records audit events when users try to access the system kernel, encompassing mutexes and semaphores. Security audit events are generated exclusively for kernel objects with a corresponding System Access Control List (SACL). Typically kernel objects are only given SACLs if the AuditBaseObjects or AuditBaseDirectories auditing options are enabled.

NetBT NodeType configuration

NetBT (NetBIOS over TCP/IP) is a protocol used to integrate NetBIOS services into the TCP/IP protocol suite and was originally designed for small local networks but needed adaptation to work in larger, modern TCP/IP-based networks. NetBT NodeType is a setting that determines how a device communicates with other devices on a network using the NetBIOS protocol.