"Deep in the sea are riches beyond compare.
But if you seek safety, it is on the shore."

How to secure Windows2000 / XP: Part Two

Additional points:

Before you do anything else...UPDATE!!! There are plenty of dangerous holes in Windows2k/XP, so go HERE with your Internet Explorer and update your version of Windows NOW!

There are plenty of automated and possible privacy problematic issues related to WindowsXP. There is only one good program how to control and disable most of them with a click of a button. It is called XP-Antispy. I strongly recommend you to run it.

You should use strong passphrases, over 14marks long. Remember to login as administrator (not just userX who is part of group called "administrators") and change set the administrators passphrase too! Even if you have disabled Guest account, I still suggest you put a good passphrase onto it...just to be sure!

Create password reset disk for your account(s) and store it in SAFE place. Because if you forget that passphrase, you are in trouble... You cant login, and there is no way you can decrypt your EFS encrypted files (unless you use Windows2000 where it is always possible to decrypt EFS encrypted files altought very difficult). You can create this disk from Control Panel / User accounts / [select the user] / Prevent forgotten password. You need one formatted floppy.

Dont use WindowsXP:s "firewall" (Internet connection firewall). Its not a real firewall, its just a inbound port blocker. Get ZoneAlarm instead.

NTFS has alternative data streams, which means that information can be hidden in your HDD without your knowledge or permission. One way to use alternative data streams is to put a trojan horse in your computer and hide it in alternative data streams. This is serious security issue. Only way to findout what alternative datastreams there is, is to download and use program like SFind you can get it here http://www.foundstone.com/knowledge/proddesc/forensic-toolkit.html

If you are serious about security, dont use NTFS and EFS. PGP is better researched and does not have any backdoors planted, in one form or an other. We cant know for sure about EFS, altought the actual EFS is well documented, the Windows that "runs it" isnt. In Windows2000 Microsoft totally blew the idea of EFS by implementing it so poorly that (in default configuration) all what the hacker had to do, was to change the users passphrase (easily done with third-party boot diskette and program) and then use that altered passphrase and username to login and...bingo: EFS was wide open because access to privatekey was allowed! This has been fixed in WindowsXP: while it is still possible to manipulate (not read in plaintext form!) the passphrases and that way get access to system (unless Syskey is used and its passphrase protected or stored in floppy), hacker cannot access EFS encrypted files since privatekey is encrypted using "real", salted passphrase from the user. Resetting the original user passphrase one way or the other results the privatekey being still encrypted. Also, it is unclear can the hacker even login as Administrator by deleting the SAM file in WindowsXP as he can do in Windows2000. Anyway, the point is that M$ is not very famous about security implementations and the faults the made with Win2k EFS make me seriously doubt about their abilities to do anything right.

Before you start implementing what I have down here, put your other settings in order. Like network settings, themes, etc. etc. This is because some of these settings disable you from altering those other settings. If you want to alter them later, get back to these settings and enable/disable/alter the proper setting.

-Markus Jansson