Risks threats and vulnerabilities commonly found in the workstation domain

Casestudy

Requirement:

Please complete the Lab 6, 7,8 & 9 available on the Module 8 home page
Include at least 5 peer-reviewed sources properly cited and referenced and your course textbook.

Writing Requirements

8 pages in length (excluding cover page, abstract, and reference list)
5 peer-reviewed sources
APA format, Use the APA template located in the Student Resource Center to complete the assignment.
Please use the Case Study Guide as a reference point for writing your case study.

50 LAB #6 | Auditing the Workstation Domain for Compliance

Lab #6 - Assessment Worksheet

Auditing the Workstation Domain for Compliance Course Name and Number: _____________________________________________________ Student Name: ________________________________________________________________ Instructor Name: ______________________________________________________________ Lab Due Date: ________________________________________________________________

Overview

In this lab, you learned to recognize the risks, threats, and vulnerabilities commonly found in the Workstation Domain, you identified known vulnerabilities and exploits on the Common Vulnerabilities & Exposures (CVE) database listing, you described how risks, threats, and vulnerabilities or misconfigurations at the operating system level in the Workstation Domain might expose that workstation, and you identified steps to harden the Workstation Domain operating system and applications installed on the user’s workstation for compliance and safeguarding of sensitive data and access to that data. Finally, you applied Department of Defense (DoD) guidelines for securing the Workstation Domain, including the review and assessment of Windows 7 and Windows 2008 security guidelines.

Lab Assessment Questions & Answers

1. What are some risks, threats, and vulnerabilities commonly found in the Workstation Domain that must be mitigated through a layered security strategy?

2. File-sharing utilities and client-to-client communication applications can provide the capability to share files with other users (for instance, peer-to-peer networking or sharing). What risks and/or vulnerabilities are introduced with these applications?

3. Explain how confidentiality can be achieved in the Workstation Domain with security controls and security countermeasures.

51

Copyright © 2015 by Jones & Bartlett Learning, LLC, an Ascend Learning Company. All rights reserved. www.jblearning.com Student Lab Manual

4. Explain how data integrity can be achieved in the Workstation Domain with security controls and security countermeasures.

5. Explain how availability can be achieved in the Workstation Domain with security controls and security countermeasures.

6. Although users of desktop applications might not create mission-critical data, all of their data represents a resource that, if lost, can result in a permanent loss of information or productivity. Explain what countermeasures and best practices should be implemented to avoid this potential disaster.

7. What is the purpose of the Microsoft® Windows Security Configuration and Analysis snap-in? Explain.

8. How would you go about updating the Windows Security Options File? Explain how this option can help mitigate risk in the Workstation Domain.

9. What does the Microsoft® Windows executable GPResult.exe do and what general information does it provide? Explain how this application helps mitigate the risks, threats, and vulnerabilities commonly found in the Workstation Domain.

10. What is the risk involved in caching logon credentials on a Microsoft® Windows system?

11. What is the current URL for the location of the DISA Military STIGs on Microsoft® Windows 7

operating systems?

52 LAB #6 | Auditing the Workstation Domain for Compliance

12. Within the Windows 7 Security Technical Implementation Guide (STIG), what are the three Vulnerability Severity Code Definitions defined?

13. DumpSec is a tool used by system administrators performing information assurance on a

Microsoft® Windows 7 workstation. What is the purpose of this tool?

14. From the Windows 7 Security Technical Implementation Guide (STIG), where can Windows 7 File & Registry Settings be reviewed and audited on a Windows 7 workstation?

15. As per DoD and information assurance procedures, who must be notified if any exceptions to DoD STIGs standards for workstation configurations are to be implemented?

Course Name and Number:
Student Name:
Instructor Name:
Lab Due Date:
Question1:
Question2:
Question3:
Question4:
Question6:
Question7:
Question8:
Question9:
Question10:
Question11:
Question5:
Question12:
Question13:
Question14:
Question15: