LevelBlue Knowledge Base » Knowledgebase » Legacy Products » Endpoint Protection Suite

What is File Integrity Monitor (FIM)?

Charles — Wed, 17 Apr 2019 16:49:58 GMT

File Integrity Monitor (FIM) monitors a host’s local system for changes to specified files, directories, and registry settings to detect illicit modifications. FIM accomplishes its task by creating signatures of its targets during each scan and comparing them to signatures from the previous scan. Any changes are reported to a server, while the signatures for the current scan are saved in a local cache for future use. Our server analyzes the changes to identify security events which are then made available to the customer in the Self Service FIM application in the portal. The portal's Self Service FIM is broken down into three sections: Dashboard, All Events, and Email Preferences.

This module can be provided to customers using Windows or Linux operating systems.

When FIM is first installed on a host, it can take up to 24 hours for the first FIM report to appear in the portal. Once the first report has been received, FIM runs and reports nightly.

FIM in the Portal

A dashboard provides a quick look at the FIM activity of the client's agent population.

Changes by Agent is a list of all agents running FIM that shows an event history of the past 30 days. The list can be filtered to show or hide agents that have not submitted a FIM report, and to show only critical or high severity events. Critical events are shown as red dots. Selecting an event block that contains a critical event marker will display critical and high severity events from that date in the Critical Events table.
Event Volume is a vertical bar graph that shows a breakdown of events by type and amount over the past 30 days. Selecting an event block in the Changes by Agent calendar will display the event volume chart for the selected date.
Critical Events lists only the most recent critical or high severity events. Selecting an event will open it in the Dashboard | Details sub-menu, which operates in the same manner as the All Events page.

All Events is an interface clients can use to search through the entire history of FIM events for all agents. Events may be sorted by severity and date. Clients may also search for specific findings or finding types. Clicking on a finding populates the event details menu at the bottom of the page, which displays the Event ID, Type, IP address, OS, Time, Priority, Source, and Description. All data can be exported as an excel sheet, PDF, CSV or HTML.

The Email tab allows users to configure their FIM email preferences. They may choose whether or not to receive emails and the frequency of receipt (daily or weekly). They may also elect to only receive email notifications about critical and high severity events. Changes to email preferences in FIM do not affect email preferences for other applications.

Configurations and Custom Profiles

FIM configurations are lists of files, directories, and registry settings that SpiderLabs has determined are vulnerable. These configurations identify and instruct FIM to scan the following items:

Files
Directories, recursively and not
Files that match patterns in specified directories
Registry keys, recursively and not
Registry values

Occasionally a client requests that we configure FIM to monitor certain files in addition to that covered by our standard profiles. In general, we will only create a custom profile if the client can tell us the specific pathways they want to monitor. We do not help clients decide which files need to be monitored, other than those that are included in the standard FIM profiles. If a client wants our input, they will need to work with sales and develop a special work order for this service.

If you have access to SAM, you can create or apply a custom FIM profile for an individual agent. For a large population of agents who will have identical custom profiles, agent engineering can create a custom template for the client. Contact Trustwave for a copy of the Trustwave File Integrity Monitoring Template Guide for details.

Endpoint Protection Suite Release Notes

Charles — Wed, 10 Oct 2018 13:52:19 GMT

This article applies to:

Trustwave Endpoint Protection Suite 3.0

Question:

What are the latest updates and Release Notes for Endpoint Protection Suite?

Information:

Here are the most recent release notes for Endpoint Protection Suite.

These notes apply to version 3.0 agents.

Note that there was no release in March, April, July, or August 2018.

Installing Trustwave AV (Endpoint Protection) on macOS 10.13 High Sierra

Charles — Tue, 12 Jun 2018 15:25:58 GMT

This article applies to:

Trustwave AV (in Endpoint Protection Suite)
macOS 10.13 High Sierra

Question:

Why does Trustwave AV not enable On Access scan for new installations on macOS High Sierra?
Why do I see a pop-up notification "System Extension Blocked" when Endpoint Protection first attempts to update Trustwave AV on macOS 10.13?
How can I make Trustwave AV work on macOS 10.13?

Background:

Apple tech notes state: "macOS High Sierra 10.13 introduces a new feature that requires user approval before loading newly-installed third-party kernel extensions (KEXTs). When a request is made to load a KEXT that the user has not yet approved, the load request is denied."
To use Trustwave AV, you must approve the extension.

Procedure:

After Trustwave Endpoint Protection has been installed with the Trustwave AV module, the application begins the first update of AV.

When the download of AV is complete, the application attempts to install AV including the system extension for scanning.
You are prompted that a system extension is blocked.
To approve the extension, click OK, and then navigate to System Preferences > Security and Privacy.
Click Allow.
If more than one extension is waiting for approval, you will see a list. On the list, select Bitdefender SRL, and then click OK.

Notes:

Approval is automatically granted if you already had Trustwave AV installed before upgrading to macOS 10.13.
You only need to approve the system extension once. Future updates will not require approval.

Accessing the Trustwave Support Portal using Safari

Charles — Tue, 22 Nov 2016 14:26:37 GMT

This article applies to:

Trustwave Support Portal (TrustKeeper)
Safari 10 (Sepember 2016 release)

Question:

How do I access TrustKeeper portal using Safari?

Procedure:

Most users can access TrustKeeper with Safari using the steps in the PDF document below (also attached to this article).

For some users, additional steps may be required. See further in this article.

Enabling JavaScript and Flash:

If you see a page similar to the below, follow these further instructions.

Go to the Safari menu located on the upper left-hand side of your screen and click Preferences.
Click the Security tab. Check (select) the boxes Enable JavaScript and Allow Plug-ins.
Click Plug-in Settings.
Check the box for Adobe Flash Player to enable use of this plug-in.
Once Adobe Flash Player has been enabled you will see login.trustwave.com listed as a currently open website.
From the menu, select On to allow login.trustwave.com to use the Adobe Flash Player plug-in. Then click Done.
Close Preferences by clicking the red button on the upper left-hand side of the box.
Click the Refresh button in your browser to load login.trustwave.com. You will then be redirected to log in to your TrustKeeper account.

Accessing the TrustKeeper Portal using Google Chrome

Charles — Tue, 22 Nov 2016 14:01:00 GMT

This article applies to:

Trustwave Support Portal (TrustKeeper)
Google Chrome (December 2016 release)

Question:

How do I access TrustKeeper portal using Google Chrome?

Procedure:

Most users can access TrustKeeper with Chrome using the steps in the PDF document below (also attached to this article).

For some users, additional steps may be required. See further in this article.

Enabling JavaScript and Flash:

If you see a page similar to the below, follow these further instructions:

Go to the Google Chrome menu located in the upper right-hand corner of your screen and click Settings.
Scroll to the bottom of the Settings page and click Show advanced settings.
Under Privacy choose Content Settings.
Scroll to Plugins and choose Manage exceptions.
Enter login.trustwave.com and ensure the menu is set to Allow, then click Done.
You can then close the Settings window and Refresh the login.trustwave.com page. You will be redirected to log in to your TrustKeeper account.

Troubleshooting TKA Installation Failures

Raven Fagelson — Wed, 13 May 2015 14:06:54 GMT

The most common problems encountered with the Agent occur during installation. Follow the troubleshooting list in order and then try to reinstall the Agent according to the instructions in the following section. Tips for specific circumstances are in the final section.

Troubleshooting steps

Check for each of the following. If the client does not have or has not done one of these things, correct it and then reinstall the Agent following these steps.

Check that the customers installed as an administrator.
If the client says yes, ask them if they have done anything to increase the security of their operating system. Hardening is a commonly used process that increases the security of a system by removing access to certain critical features. This can cause problems when installing the agent, as a hardened system may prevent the agent from running as a system service. If the client has hardened their system, or if they do not know, ask them to consult with their IT support to ensure the agent has all administrator privileges when it runs. You should not need to go into detail on this; the process they use to secure their system is likely to be specific to their environment, and as such it is their responsibility to sort out any permission issues themselves.
Check that the customer has Internet connectivity.
The client must be able to contact the following servers:
- TrustKeeper Agent registration server, https://agentregistration.trustwave.com
- TrustKeeper Agent update server, https://agentupdate.trustwave.com
- TrustKeeper Agent message server, https://agentmessage.trustwave.com
- TrustKeeper Agent antivirus server, https://agent-av-mirror.trustwave.com
- TrustKeeper OCSP server, http://ocsp.trustwave.com
- TrustKeeper CRL server, http://crl.trustwave.com
- TrustKeeper CRL server, http://crl.securetrust.com
If the client has a firewall or access control list place on their network, you may need to add these servers to the client’s white list.
Check the version of the installer.
The most recent version is listed in the Version History tab. If the client is attempting to install with a prior version, be sure they are using the most recent installer available to them through their account. If this is an MSS customer, verify with Provisioning that there is not a later version of the installer available for the client–files uploaded to a client's documents area are not updated automatically and their current installer may be out of date.

To check the version of the client's installer download a copy of it and right-click, selecting Properties from the menu. In the Details tab, you will see the version number listed.

If the client has already installed the agent but was unable to register, you can have them run CSI and then view the version by opening the FileVersions.txt file. You'll see something like this:
"VersionInfo: BUILD=3.0.734,DATE=2014-01-16_22-00-41,PROJ=tkagent-greatwhite-windows-release,TYPE=Release".
Check if this client active in TrustKeeper Klassic.
If they are, they may need to have their Agent population migrated to the new portal. This process takes about a week and is done by the agent development team in conjunction with IT.
If the client is seeing an error message when trying to run part of the agent, such as an update or report, consult the list of curl error codes. For HTTP status errors, see this list.
If you cannot solve the problem with the above steps, escalate the issue to the Agent team by sending an e-mail to Agent@trustwave.com or create a new ticket in the Agent Support RT queue.

How to reinstall an agent after a failed attempt

If you are replacing an existing agent, fully remove (uninstall) the agent before installing the new one.

Run the Agent installer as an administrator to remove the TKA files that were just installed.
Run the Agent installer as an administrator to install the Agent.

Tips for Specific Situations

Access Control Lists (ACLs) and Firewalls

An access control list is a list of rules applied by a router or server that govern access to and from specified ports and IP addresses. Clients who do not have a premium router or network security setup generally do not have ACLs. (This means that the average L4 caller, for whom Windows Firewall is the height of security, will not have an ACL).

The Agent needs to connect to seven servers to register and function. If the client blocks access to any of these servers, the Agent will either fail to install or fail to run after installation. Make sure they have whitelisted:

agentregistration.trustwave.com
agentupdate.trustwave.com
agentmessage.trustwave.com
agent-av-mirror.trustwave.com
crl.trustwave.com
crl.securetrust.com
ocsp.trustwave.com

Note: Some of these servers are not hosted by Trustwave, but are instead hosted by a company called Akamai. To increase availability to clients, these sites may resolve to any one of thousands of IP addresses. As such, the client must whitelist Agent servers using an application layer tool; that is, they need to whitelist using the text domain (for example, "trustwave.com") instead of the IP address (for example, "127.0.0.1"), or the Agent will not be able to reliably reach our servers.

Antivirus detects the Agent

Sometimes, antivirus software will detect the Agent's activity as a malicious intrusion since TKA scans many system critical files. If this happens, the client might see an alert in their antivirus software indicating that the Agent has been quarantined. If so, the client must release the Agent from quarantine and add it to their antivirus software's exclusion list. The process for adding a file to the exclusion list varies from product to product, so it is best to let the client figure it out from there.

Failed registration

If an agent's registration fails, check your firewall settings and then re-run the registration. You can do this without reinstalling the agent by using the TkAgentRegistrant utility. TkSvc.xml must first be present on the host before registration. The TkAgentRegistrant utility requires administrator privileges. To register an agent, use the command on 64-bit machines:

"C:\Program Files (x86)\Trustwave\Agent\"TkAgentRegistrant.exe --retry_registration

or this command on 32-bit machines:

"C:\Program Files\Trustwave\Agent\"TkAgentRegistrant.exe --retry_registration

Installations with GPO (Group Policy Object) Present

GPO (Group Policy Object) is used by system administrators to remote install software on their network(s).

Elevate privileges on the target machine(s) to administrator level. If the client needs a tool to elevate privileges, this may be helpful http://code.kliu.org/misc/elevate/.
Clients must contact Trustwave Support to get the MSI installer which is not publicly available.
To install the MSI, pass along a command line parameter that includes their registration code along with silent install switches. For instance:

msiexec /I "C:\[installation directory]\TrustKeeper Agent.msi" TKREGCODE={[code]} /quiet /qn

NOTE: The MSI cannot be used to later uninstall the TrustKeeper Agent. You must either use the standard Add/Remove Programs dialog to remove the Agent or trigger an uninstall from the portal in the My Agents application.

Invalid Installer

If an invalid installer is downloaded or the installer’s hash is wrong, some part of the installer is missing. Download the installer again.

Linux

When installing on Linux, only use the 32-bit installer on 32-bit systems and the 64-bit installer on 64-bit systems.

The 64-bit Agent installer for Linux fails to install on Suse Linux 10 x 64. Check if the 32-bit libraries have installed. If they have and you still get this message, try installing with the 32-bit installer instead of the 64-bit installer; that should work.

Satellite Internet Connections

Some satellite providers (notably HughesNet) provide 'SSL enhancement' (most often an SSL proxy) services to their business clients. These products work by detecting any outgoing SSL requests and forwarding them to a dedicated SSL server owned by the ISP. To register the agent, any SSL proxy service must be disabled. This is because the connection forwarding process replaces the agent's SSL certificate with one signed by the ISP, which causes TrustKeeper to reject the connection as invalid. Once an agent has registered, clients can re-activate the SSL enhancement service and the agent will function as normal.

When an SSL proxy is causing problems, the client will get an error during agent installation "CURL CODE 60". This means that we were unable to verify the agent's connection request with the provided SSL certificate.

So far this has been documented with HughesNet, who call their SSL proxy "Turbo Page". Clients will need to contact HughesNet directly to disable this feature.

If the client is unsure whether their problem is caused by an SSL proxy, they can run the following OpenSSL command from the command line to verify that the proper certificate chain is in use:

To verifying a SSL Proxy Error

Issue the command on a 64-bit machine:

"C:\Program Files (x86)\Trustwave\Agent\"openssl s_client -CAfile C:\ProgramData\Trustwave\Agent\certs\tkagent_CA.pem -connect agentregistration.trustwave.com:443 -verify 5

or on a 32-bit machine:

"C:\Program Files\Trustwave\Agent\"openssl s_client -CAfile C:\ProgramData\Trustwave\Agent\certs\tkagent_CA.pem -connect agentregistration.trustwave.com:443 -verify 5

The correct certificate chain is

s:/CN=agentregistration.trustwave.com/O=Trustwave Holdings, Inc./L=Chicago/ST=Illinois/C=US i:/C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Organization Validation CA, Level 2/emailAddress=ca@trustwave.com

s:/C=US/ST=Illinois/L=Chicago/O=Trustwave Holdings, Inc./CN=Trustwave Organization Validation CA, Level 2/emailAddress=ca@trustwave.com i:/C=US/O=SecureTrust Corporation/CN=SecureTrust CA

Any certificate chain that shows a different signing organization is proof positive of an SSL proxy.

What is Beacon?

Raven Fagelson — Wed, 11 Feb 2015 15:50:21 GMT

The Beacon module is automatically provisioned and installed with every agent. It keeps the TrustKeeper portal informed of basic information required by other modules and gives the portal a way to know if an agent is still active.

Beacon pings the TrustKeeper portal to simulate a heartbeat for its host agent at a regular interval, by default every fifteen minutes. With each contact, Beacon sends its host’s IP address. Beacon’s ping for Windows and Linux are identical except that on Linux, Beacon includes a message version and beacon version.

Once a day, Beacon sends an expanded report to the TrustKeeper, generally just after midnight if the host is on. If the host is turned off or the agent’s service is stopped, Beacon will send its full report after the host or the service next starts up. This report contains:

Host name
Local time
Whether that operating system is Windows or Linux
Full version of the operating system that the agent is installed on
List of adapters including the IP and MAC addresses of the host
What version its agent is
Installed agent components. For some it includes:
- A hash of the last successful report of each component
- Start times of the component's most recent successful run

The Last communication field in the portal’s My Agents refers to the last time that Beacon sent its full report.

What is File Scanner or PAN Scanner?

Raven Fagelson — Wed, 11 Feb 2015 15:46:40 GMT

File Scanner scans an agent’s host for unencrypted credit card data such as the card number, track (magnetic stripe) and Personal Account Numbers (PAN) data, while avoiding false positives. In order to match, a PAN must:

Be 16, 17, 18 or 19 digits in length. Digits may be separated by dashes or dots.
Begin with an Issuer Identification Number (IIN).
Be long enough to match the detected IIN. If the length and IIN do not match, the Agent marks the number unknown and does not report it in the Portal.

File Scanner can detects track data by searching for the PAN preceded by '%[A-Z]' or ';'. File Scanner displays its results in the portal’s Credit Card Data Storage report.

There is always the possibility that the scanner flags a file as credit card information due to the format of stored info for that file type of program. For such files, the client will need to mark them as a false positive within the portal under the section "Credit Card Data Storage".

Note: Support for the File Scanner module of the agent is handled by the Technical Assistance Center's Data Loss Prevention group (TAC DLP).

What is Policy Scanner?

Raven Fagelson — Wed, 11 Feb 2015 15:45:21 GMT

The Policy Scanner module verifies whether certain settings (link) on a computer comply with PCI Digital Security Standards (PCI DSS). Policy Scanner verifies that user and password, system configuration, and system auditing policies on the agent’s host comply with PCI DSS. Like other PCI modules, Policy Scanner is currently only available on Microsoft Windows.

By default, scans run once a day. After each scan, Policy Scanner sends its findings to the TrustKeeper server. If Policy Scanner detects a setting that is not in compliance with the PCI DSS, it reports that information in the My Agents application under Security Configuration and references the specific requirement that the host is violating. Clients may choose to ignore alerts in Security Configuration in the same way that they ignore files in Credit Card Data Storage.

What is Windows Log Monitoring (WLM)?

Raven Fagelson — Wed, 11 Feb 2015 15:37:21 GMT

Windows Log Monitoring monitors Windows Event Logs on the host and specified plain text files on the host for events allowed by Trustwave’s SIEM (Security Information and Event Management) product. WLM collects, filters, and then forwards events from its data sources in an XML format at a configured interval or queue size (5 minutes or 30 events by default) to the Agent Messaging Server (AMS) which passes the message onto a SIEM database. SIEM identifies which events are important and logs them. Those events are collected into a report in the MSS application under Security Activity in the L4 portal.

WLM is not available for Linux systems.

Which Windows policies does Policy and Security Scanner verify

Raven Fagelson — Thu, 15 Jan 2015 10:54:17 GMT

The Policy and Security Scanner is a PCI module which verifies whether certain settings on a computer comply with PCI Digital Security Standards (PCI DSS). Policy and Security Scanner verifies that user and password, system configuration, and system auditing policies on the agent’s host comply with PCI DSS. The module runs the following checks on user and password policies, system configuration policies, and system audit policies. See the attached Adobe PDF document for details.

Best Practices for Securing a Remote Access Application

Raven Fagelson — Mon, 12 Jan 2015 15:00:38 GMT

Accessing your computer network from off-site can be useful. You and your technical support staff can update your software, troubleshoot problems, monitor security cameras or do any number of things to sustain your business. However the same applications that provide you remote access can also provide malevolent criminals access to your computers. You can make your remote access applications more secure by following these nine best security practices.

Only allow people with a legitimate legal or business need to use your remote access applications.

The first step to securing your network is to restricting who may access it. The most secure networks only allow access to users with a need to access it.
Do not share login credentials or use credentials that have been shared with you.

Each individual at your company should have their own username and password which they should use and not share with anyone else. This practice allows you to track who accesses your computer.
Use two–factor authentication.

Two-factor authentication doubles the “guards at your gate”. It requires that you use two of the following methods of authentication to remotely access your computer and its network:
- Something you know – like a password
- Something you are – like biometrics or a fingerprint scan
- Something you have – like an SSL certificate, RSA fob, or code texted from your bank
The Payment Card Industry’s Data Security Standards (PCI-DSS) requires two-factor authentication when remotely accessing environments that contain cardholder data (CDE). If you have a question regarding how your configuration measures up against the PCI DSS, please contact a qualified Qualified Security Assessor (QSA) or Internal Security Assessor (ISA).
If you use a password, make it strong, unique, and change it often.

Strong passwords are long passwords. At least 20 characters are ideal. This does not mean they have to be complicated; just mash together the words of a sentence like “In2005,SarahMadeMyFavoriteMovie.” Add in a few numbers and punctuation marks to make it stronger. PCI-DSS requires a password that is seven numbers and letters long and that you change it every 90 days, among other requirements.

Make a unique password for every computer or network that you have. When cyber-criminals hack one password-protected account, they immediately try that password everywhere else. They can’t do that if your password is different for each network or computer.
Keep your software up to date.

Software vendors send out security updates frequently. Install those updates to make your computer networks the most secure. Check your vendor’s website at least monthly to make sure that your software has the latest security updates. Even better, configure the software to automatically download and install updates. If your remote access software does not provide updates any longer then it is time to move on to another solution.

PCI-DSS gives you a 30 day window to install critical updates, but you will want to patch software much sooner in most cases.
Lock down your firewall.

Add a rule to your network firewall that restricts remote access by source IP address, destination IP address, and the involved service. Only activate this rule when remote access should be used, i.e. only at a specific time and for a specific length of time. If you aren’t sure how to do this, talk to your tech support. They can set you up.
Limit how long your remote access application remains open.

Your remote access should be configured to automatically end a session after a set amount of time, even if it is active. Idle sessions should end after 15 minutes of inactivity. PCI-DSS mandates an idle timeout, though it does not specify how long the timeout should be.

Active sessions should end after one hour regardless of activity – this way if your credentials are hijacked by a cyber-criminal, they will be time limited in the damage they can do.
Use encryption.

Your remote access application should have encryption turned on by default, but check to make sure. PCI-DSS calls for strong encryption, which generally means using AES with a 128-bit key (AES-128), Triple-DES (3DES), or something stronger. Consult your product documentation to discover what encryption your application uses.
Hold your vendors and contractors accountable.

If you rent your computers from another company, outsource your IT support, or allow any other third party to access, manage or update your machines remotely, make sure they follow these guidelines. This includes being sure that they use login credentials that are unique to your business. After all, you don’t want to get hacked because a contractor uses a username and password that they use for other clients.

Apply the Best Security Practices to Microsoft Windows’ Remote Desktop

Raven Fagelson — Mon, 12 Jan 2015 14:41:59 GMT

Accessing your computer network with Microsoft’s Remote Desktop is useful. You and your technical support staff can update your software, check business files, or do any number of things to sustain your business. However, Remote Desktop can offer malevolent criminals an open door to your computers if you don’t take precautions. Below is a list of the seven best security practices you can use with Remote Desktop and how to implement them.

Only allow people with a legitimate legal or business need to use your remote access applications.

You can create a list of who is allowed to access your computer through Remote Desktop by following these instructions:

Open Remote Desktop
1. Click the Start button.
2. Right click the Computer link and choose Properties from the context menu.
3. Under Control Panel Home, select Remote Settings.
  The System Properties window opens.
In the System Properties panel under Remote Desktop, click Select Users.
The Remote Desktop Users window opens.
Click Add.
The Select Users or Groups window opens.
In the Enter the Object names to select field, enter the names of a people who may access your computer remotely. Separate the names with a semi-colon (;).
Click Check Names.
1. If multiple names match what you entered, select the correct person from the Matching names list.
Click OK to close the windows and save your selections.

Do not use shared login credentials or use credentials that have been shared with you.

Each individual at your company should have their own username and password which they should use and not share with anyone else. This practice allows you to track who accesses your computer.

Use two–factor authentication.

Two-factor authentication means using two methods of authentication to access your computer. These methods are generally two of the following:

Something you know – like a password
Something you are – like biometrics or a fingerprint scan\
Something you have – like an SSL certificate, random-number generating key fob, or a one time code texted to your email or mobile phone.

Microsoft Windows Vista, 7 and Server 2008 requires password authentication when someone tries to access your computer through Remote Desktop. You must install third party software to get Remote Desktop to accept a second type of authentication. No matter which software you choose, make sure that it is a different type of authentication then what Windows requires.

The Payment Card Industry’s Data Security Standards (PCI-DSS) requires two-factor authentication when remotely accessing environments that contain the cardholder data environment (CDE). If you have a question regarding how your configuration measures up against the PCI DSS, please contact a qualified Qualified Security Assessor (QSA) or Internal Security Assessor (ISA).

If you use a password, make it strong, unique, and change it often.

You can use your Windows password as one of the two means to login through Remote Desktop. Just make sure that password is a strong password. The most critical component to a strong password is the length. At least 20 characters are ideal. This does not mean they have to be complicated; just mash together the words of a sentence like “In2005,SarahMadeMyFavoriteMovie.” Add in a few numbers and punctuation marks to make it stronger. PCI-DSS requires a password that is seven numbers and letters long and that you change it every 90 days, among other requirements. Also make the password unique so that if cyber-criminals hack into your account, they can’t use your password to access any of your other accounts. This way if someone cracks your password, your information becomes quickly out-of-date.

Keep your software up to date.

Microsoft Remote Desktop comes bundled with your Windows operating system. Set Windows to automatically install important updates by following these instructions:

In the Start menu, search for Control Panel and open it.
In the Control Panel, choose System and Security | Windows Update.
Choose Change Settings.
Set all updates to install automatically. Depending on your operating system, you may need to choose multiple settings like Install updates automatically (recommended) and Give me recommended updates the same way I receive important updates on Windows 7 or Include recommended updates when downloading, installing or notifying me about updates on Windows Vista.
If there is an OK button, click it. If not, don’t worry.

For more information, see http://windows.microsoft.com/en-us/windows/turn-automatic-updating-on-off#turn-automatic-updating-on-off=windows-8

Lock down your firewall.

Add a rule to your network firewall that restricts remote access by source IP address, destination IP address, and the involved service. Only activate this rule when remote access should be used and then shut it down when no longer needed. Periodically review this rule to make sure that the source and destination addresses are current. If a third party manages your firewall, ask them to provide proof that they have properly enacted and maintained these rules.

Limit how long your remote access application remains open.

Your remote access should be configured to automatically end a session after a set amount of time, even without inactivity. Idle sessions should be configured to end after 15 minutes of inactivity. PCI DSS mandates an idle timeout, though it does not specify how long the timeout should be. Active sessions should be configured to end after 1 hour regardless of activity-this way if someone has hijacked credentials they will need to authenticate again.

Most Windows operating systems require an advanced registry setting to set session limits on Remote Desktop. To place or modify these limits, consult professional technical support. You can easily damage your operating system when changing its registry settings.

If you have Windows Server 2008 R2, use Remote Desktop Services to active a session limit. For information on how to do this, see http://technet.microsoft.com/en-us/library/cc754272.aspx.

Use encryption.

Remote Desktop uses SSL for encryption. This is the same protocol that you use when you access your bank on-line. While early versions of Remote Desktop (such as Microsoft Windows 2000) used encryption based on SSL, newer versions use stronger encryption.

Hold your vendors and contractors accountable.

If you rent your computers from another company, outsource your IT support, or allow any other third party to access, manage or update your machines remotely, make sure they follow these guidelines. This includes being sure that they use login credentials that are unique to your business. After all, you don’t want to get hacked because a contractor uses a username and password that they use for other clients.