(DRAFT)
The goal of this page was to help testers assess IoT devices and applications in the Internet of things spaces. The guidance below is at a basic level, giving testers of devices and applications a basic set of guidelines to consider F Rom their perspective. This isn't a comprehensive list of considerations, and should is treated as such, but ensuring s are covered would greatly improve the security of any IoT product.
Category
IoT Security Consideration
i1:in
To limit the number of login password errors in the input system through Group Policy
Solution:
First, win+r open run, input gpedit.msc
Computer Settings---Windows Settings---Security settings---account policy---account lockout policy ", and then to the" Account lockout threshold "entry in the right pane, where you can set the number of unsuccessful logon attempts for a user account, which is between 0
Server 2016, using Docker engine to connect containers between hosts in cluster mode. Resolves a problem that does not allow users to access online Help content when they click the Help icon in various Windows applications, such as File Explorer.Resolves the problem, and the display closes unexpectedly even when the display and screen saver are disabled in the power profile. Resolves an issue in which two bad logon attempts are committed each time an error password is supplied during Kerberos-b
using reversible encryptionDisabled
By default, these settings are stored in the default domain policy GPO, but should not be listened to from there. You should analyze local security policies such as DUMPSEC or domain controller (run GPEDIT on the domain controller. MSC. DUMPSEC will not collect the complex requirements of passwords. It collects the information through other channels. The Local Security Policy can provide all the information for listening to these settings.
#2 account logon de
Wait for a specified event to occur before the multiple waiting threads continue to execute, here are a few ways I can think of, welcome to discuss, correct me.1. Latching CountdownlatchLatching is a typical synchronization tool class that waits for an event to occur, sets the initial value of the lockout to 1, all threads call the await method to wait, and when the event occurs, calls countdown to reduce the lock
dialog box, click Computer Configuration →windows settings → security settings → Local policies → security options. Then go to the right pane and double-click the shutdown: Allow shutdown before logon item, and after setting its property to Disabled in the pop-up Properties dialog box, Click "OK".
7. Prevent passwords from being guessed
When our windows 7 user password setting is simpler, it is easy for illegal users to try to "guess" the user password multiple times and log on to the system,
simultaneously audit its success and failure events.
Account Management: Create, modify, or delete users and groups, and make password changes that must audit both its success and failure events.
When you open the above audit, when someone tries to do something to your system (such as trying user passwords, changing account policies, unauthorized file access, etc.), it is logged by the security audit, stored in the security log in Event Viewer.
In addition to the "Local Security policy" can
required to be open, and others can be added as needed:Policy settingsAudit System Login Event succeeded, failedAudit account management Success, failureAudit Login Event Success, failureAudit object Access succeededAudit policy Change succeeded, failedAudit privilege use succeeded, failedAudit system event succeeded, failed5. Open Password Password PolicyPolicy settingsPassword complexity requirements EnabledMinimum password length 6 bitsEnforce password history 5 timesEnforce password history
As you all know, Windows 2003 administrator users cannot be deactivated, which means that others can try this user's password over and over again. Try to disguise it as a regular user, such as GUESYCLUDX.
4. Create a trap user
What is a trap user? That is, create a local user named "Administrator", set it to the minimum, do nothing, and add a super complex password of over 10 bits. This would allow those hacker to be busy for a while to discover their invasion attempts. The follo
First, in the computer desktop we also press the "Win+r" in the Pop-up Run dialog box we in the inside of the loss of "gpedit.msc"
Second, then we click on the left side of the local Group Policy Editor, "Computer settings---Windows Settings---Security settings---account policy---account lockout policy", in the right window to find "Account lockout threshold" where we can enter between 0 and 999, The def
problems when the system crashes and blue screens. However, it can also provide hackers with some sensitive
Information such as the password for some applications. Control Panel > System Properties > Advanced > Startup and failback to change write debug information to none.
Close Dr. Dr.Watson of China
Enter "DrWtsn32" in Start-run, or start-Program-attachment-System Tools-System Information-tools-DR Watson, pull up the system
Dr. Watson Dr.Watson, only the "Dump all thread context" option is
hacked for months until the system was compromised. The following audits are required to be open, and others can be added as needed:
Policy settings
Audit System Login Event succeeded, failed
Audit account management Success, failure
Audit Login Event Success, failure
Audit object Access succeeded
Audit policy Change succeeded, failed
Audit privilege use succeeded, failed
Audit system event succeeded, failed
5, open password Password policy
Policy settings
Password complexity requirements Enabl
requirement, you've increased the amount of time that a hacker might break your key with log crack or something like that, and then we click Enable and then click Okey.
Then, given this limitation, some users will choose a key such as FRIDAY13. When the key expires, they cannot be used again because we have set Windows 2000 to remember the old key so what we have to do is we set it to be more difficult.
It is also possible to lock our admin account if the administrator has typed this key too o
-click to open the item, select both "Success" and "fail" in the Setup dialog, and then click OK. After this policy is in effect, each logon of the FTP user is logged.
Figure 4 Logging User login information
2. Enhance the complexity of the account password
Some FTP account password set too simple, it is possible to be "lawless" cracked. In order to improve the security of the FTP server, users must be forced to set a complex account password.
In the Local Security Settings window, expand
, these settings are stored in the default domain policy GPO, but should not be listened to from there. You should analyze local security policies such as DUMPSEC or domain controller (run GPEDIT on the domain controller. MSC. DUMPSEC will not collect the complex requirements of passwords. It collects the information through other channels. The Local Security Policy can provide all the information for listening to these settings.
#2 account logon denied policyThis policy takes effect when the us
. Open Account PolicyPolicy settingsReset account lockout counter for 20 minutesAccount lockout time 20 minutesAccount lockout threshold 3 times7. Setting access rights for Security recordsSecurity records are not protected by default and are set to be accessible only to administrator and the system account.8. Store sensitive files in a separate file serverAlthou
Server security Settings1, system disk and site placement disk must be set to NTFS format, easy to set permissions.2, system disk and site placement disk in addition to administrators and system user rights are all removed.3, enable Windows to bring the firewall, only to retain the useful ports, such as remote and Web, FTP (3389, 80, 21), and so on, there are mail server also open 25 and 130 ports.4. After installing SQL, go to directory search xplog70 and then rename or delete the three files f
A total of 9 server models were summarized on UNPV3:1. Iterate server 2. Concurrent server, fork a process for each customer 3. Pre-derived subprocess, each child process calls Accept,accept no lockout protection 4. Pre-derived subprocess, protected by file Lock accept 5. Pre-derived child processes, Protect accept with thread mutex lock 6. Pre-derived child process, passed to child process by parent process Socket Descriptor 7. Concurrent server, cre
? That is, create a local user named "Administrator", set it to the minimum, do nothing, and add a super complex password of over 10 bits. This would allow those hacker to be busy for a while to discover their invasion attempts.5. Change the permissions of shared files from Everyone group to authorized usersDo not set the users who share files to the Everyone group, including print sharing, the default attribute is "Everyone" group, must not forget to change.6. Open User PolicyUsing User policy,
The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion;
products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the
content of the page makes you feel confusing, please write us an email, we will handle the problem
within 5 days after receiving your email.
If you find any instances of plagiarism from the community, please send an email to:
info-contact@alibabacloud.com
and provide relevant evidence. A staff member will contact you within 5 working days.