1 / 38

NTFS

NTFS. Authentication. Is the person who she says she is? If so, access is allowed In Windows, authentication is handled by a password-protected user account. Authorization. What an authenticated user can, and can not, do on a system.

nhu
Télécharger la présentation

NTFS

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. NTFS

  2. Authentication • Is the person who she says she is? • If so, access is allowed • In Windows, authentication is handled by a password-protected user account.

  3. Authorization • What an authenticated user can, and can not, do on a system. • Authorization for Windows files and folders is controlled by the NTFS file system • NTFS assigns permissions to users, groups or both

  4. Principle of least privilege • Give a user only as much permissions as are required for the tasks they do and no more. • To much invites trouble

  5. Local User Account • Each Windows computer keeps an encrypted list of user names and passwords • You don’t get to use a computer unless you know a valid user name and password (even if it is blank) • User also belongs to a group • To create/manage users and groups you need administrator privileges

  6. Passwords • Ultimate key to protecting your computer • For a hacker, this is half the battle • Protect passwords; make them complex; no Post-It notes on the monitor • Make passwords strong: at least eight characters including letters, numbers and punctuation symbols • You should change passwords at regular intervals • Password reset disk had to be a floppy – little value; now can be USB stick in Windows 7; can’t use it if you are on a domain

  7. Groups • Groups are collection(s) of accounts with similar needs/permissions • Add a person/account to a group rather than set permissions for the single account • XP groups: Administrators, Power Users, Users, Everyone and Guest • Home editions: Administrators, Users and Guest

  8. Managing Users in XP • User Accounts applet in Control Panel • Limited Users see only their account in User Accounts; Admins see all accounts

  9. Vista Users • Three accounts when you set up Vista: guest, administrator and a local account that’s a member of Administrator group • User Accounts and Family Safety in Home • User Accounts applet in Business, Ultimate

  10. Add a User - Vista • Open the User Accounts applet • Click Manage Another Account and select Create a New Account • Click Create Account • At least one account must be Administrator

  11. Parental Controls • Administrator account can monitor and limit the activities of any standard user • Can be used for employees also • Web sites, applications, files downloaded, amount of time logged on, access to types of games and specific applications

  12. Users in 7 • User Accounts Control Panel applet • Open User Accounts and select Manage Another Account; Create a New Account • Almost the same as Vista

  13. Local Users and Groups • Control Panel | Administrative Tools | Computer Management • Right-click Computer and select Manage | Users and Groups • Can add Users, Groups or Computers • Can add group membership of a user’s properties or add a user to a group’s properties

  14. Authorization Through NTFS • After creating account, need to specify permissions for files, folders applications, etc.) • File or folder Properties window then Security tab • Permissions can be assigned to both user and groups; best practice: groups • Whoever creates file/folder has complete control over it (ownership) • Administrators do not automatically have control over every file and folder

  15. Ownership • If you created it, you own it and have full control over it • Can remove Administrator access

  16. Take Ownership Permission • With this, you can take ownership of any file or folder and then set permissions as you want • Administrator accounts have Take Ownership for all files and folders • Leaves a “trail” behind Administrator

  17. Change Permission • Able to take away or give permission to file or folder • Different from file permission

  18. Folder Permissions • Full Control: do anything you want • Modify: Anything except delete, change permissions and take ownership • Read and Execute: Allows you to see the contents of folder and any subfolders • List Folder Contents: See contents of folder and any subfolders • Read: enables you to view a folder’s contents and open any file in the folder • Write: Write to files (and delete) and create new files/folders

  19. File Permissions • Full Control: do anything you want • Modify: Anything except Take Ownership or Change Permissions • Read and Execute: Open folders and run application(s) • Read: Open folders and files; not applications • Write: Open and write to file

  20. The Rule • Permissions are cumulative. The highest permission is the rule. Except Deny. • Full Control on folder means full control on files in folder

  21. Permission Propagation • Inheritance: Folder gets permissions of parent folder; turned on by default • Deny trumps anything

  22. Copy/Move • Copy within partition. Original retains original; copy inherits new permissions • Moving within partition. Retains permissions unchanged • Copying across partitions. Original retains original; copy inherits new permissions • Move across partitions. Inherits permissions from new location • Copying to FAT partition. New copy has no permissions • Moving to FAT partition. No permissions • (FAT partitions are on flash drives)

  23. Techs and Permissions • Major pain; have to have Administrative permissions to do most work • Try to get new admin account for duration of work • Make sure admin deletes account when you are done

  24. Secure Sharing - XP • Each user has set of folders: My Documents and folders within (My Pictures, etc.) • Shared Documents: folder all users can access • Simple file sharing is enabled • XP Pro allows full NTFS permissions • Can make My Documents private to block access; administrator can take ownership • Any folder in Shared Docs is also shared

  25. Simple File Sharing • One option: put it in Shared Documents • Over a network have to give everyone full access • Pro allows turning off SFS: folder | Tools | Folder Options |View tab. Last option is SFS

  26. Sharing in Vista • Targeted sharing: select user account, then permission level – • Reader, read-only • Contributor, read and write, delete user-created objects • Co-owner, do anything • Public folders: share with anyone on the network; full access by default

  27. Sharing in 7 • Add homegroup to share libraries; accessible by everyone, need password • Finding shares: Computer Management | Shared Folders. Works in XP and above

  28. Administrative Shares • C$ • Allow administrators access local or remote • Have to have administrator password (not blank) to get access to these shares

  29. Encryption • This is for the really paranoid • Home editions don’t do it • XP uses Encrypting File System to encrypt files • Vista/7 add encryption system that can encrypt entire hard drive • Tied to password and system ID so if you loose password, file(s) are gone

  30. BitLocker Drive Encryption • Again, for the really paranoid or defense contractors • Select Security in Control Panel Home view • Must have Trusted Platform Module (TPM) chip on motherboard

  31. User Account Control • What helped bury Vista • The vast majority of users had no idea how risky their computing behavior was • Long list of dangerous actions – page 709 • XP has Power User to handle most of the list; few people used it • Vista actually has four UAC prompts: • Red for blocked programs • Yellow for unverified programs • Blue/gray for verified programs • Teal for published by Vista programs

  32. Turn Off UAC • UAC Control Panel applet; uncheck the box • MSCONFIG and select Disable UAC on Tools tab

  33. UAC in 7 • Made UAC less aggressive • Introduced four levels to UAC: • Always notify is same as Vista • Don’t notify me when I make changes (default) • Notify me only when programs try to make changes • Never notify • Mike votes for turning UAC back on

More Related