Dangerous Services, Part 1

Basic physical security policy for a building calls for eliminating all unnecessary doors and putting locks, guards, or cameras on the rest. For computers, network services are the doorways into a Windows 2000 system, so "eliminate all unnecessary services" is a time-honored commandment for protecting computers. Win2K comes with a lot of services enabled by default, many of which you don’t need. Even if the service doesn’t offer direct access to system resources, it might expose a system to buffer overflow attacks and denial of service (DoS) attacks. Consider disabling vulnerable or unnecessary services on workstations and servers—you’d be surprised at how many times you can access confidential information or impersonate a high-level user simply by breaking into an unsecured workstation. Let’s look at a few of the services common to Win2K that you might consider disabling on your systems.

The Clipbook service. The Clipbook service is an interesting tool that lets you copy and paste the contents of your computer’s clipboard to another. If you want to try out this tool, run clipbrd and look at the Help file. Although this service lets you configure who has remote access to your clipboard, why enable an open target on your system for attackers? Don’t enable this feature unless you need it. . . .