NIST Site Search
Search NIST.GOV
Custom Search
[Official NIST.GOV TIME]
Product Research

Advertise on this site
NIST SP 800-69 (draft) Guidance for Securing Microsoft Windows XP Home Edition
A NIST Security Configuration Checklist
on Monday 14 August 2006 print the content item {PDF=create pdf file of the content item^plugin:content.58}
in NIST.gov Publications > Special Publications - SP 800 series

SP 800-69 should be considered essential reading for all Windows XP Home Edition users. It does a very good job of summarizing the various threats facing home computer users and lists simple ways for users to mitigate them without having to be technically proficient.

You can download the NIST Special Publication 800-69 from NIST.gov

This document should be considered essential reading for all Windows XP Home Edition users. But that is asking a lot, the SP 800-69 document is 169 pages. However it does a very good job of summarizing the various threats facing home computer users and lists simple ways for users to mitigate them without having to be technically proficient. Surprisingly the document also goes out on a limb in a few places such as listing services that users can disable. It won't make anyone a security expert but it will give the average computer user a much better understanding of the threats they face every time they use their computer online. It even covers wireless networking, re-installation of the operating system, backups, and step-by-step instructions on how configure many of the security features that are built-in to Windows XP Home Edition.


(The below is a short description of SP 800-69 from NIST.gov, edited)

The draft SP 800-69 provides a checklist and guidance to home users, such as telecommuting Federal employees, on improving the security of their home computers that run Windows XP Home Edition. These computers face many threats from people wanting to cause mischief and disruption, commit fraud, and perform identity theft. The publication explains the need to use a combination of security protections to achieve a defense in depth. Thee protections include such as: antivirus software, antispyware software, a personal firewall, limited user accounts, and automatic software updates, to secure a computer against threats and maintain its security. It also emphasizes the importance of performing regular backups to ensure that user data is available after an adverse event such as an attack against the computer, a hardware failure, or human error. The publication contains a detailed step-by-step directions for securing Windows XP Home Edition computers that can be performed by experienced Windows XP Home Edition users.

Users of Windows XP Home Edition need to be aware of the threats that their computers face and the security protections available to protect their computers so that they can operate their computers more securely. Security protections are measures used to thwart threats.

Summary:

One of the most important parts of securing a Windows XP Home Edition computer is eliminating known weaknesses, because attackers could attempt to take advantage of them. Five categories of methods for eliminating weaknesses are as follows:
  • Limiting access to the computer through separate password-protected user accounts for each person, with different accounts for administrative and daily tasks (a limited user account)
  • Applying software updates to the computer on a regular basis, including Windows XP Home Edition and software applications
  • Limiting network access by disabling unneeded networking features, limiting the use of remote access utilities and Internet Connection Sharing, and configuring wireless networking securely
  • Modifying default file associations and the display of default file extensions
  • Disabling services that are not needed.


The five most important protections that should be used for Windows XP Home Edition computers connecting to the Internet are as follows:
  • Using a personal firewall that is configured to restrict incoming network activity to only that which is required
  • Using a limited user account for typical daily use of the computer
  • Running up-to-date antivirus software and antispyware software that is configured to monitor the computer and applications often used to spread malware (e.g., e-mail, Web) and to quarantine or delete any identified malware
  • Applying updates to the operating system and major applications (e.g., e-mail clients, Web browsers) regularly, preferably through automated means that check for updates frequently
  • Performing regular backups so that data can be restored in case an adverse event occurs.


---
The SP 800-69 document was created by the National Institute of Standards and Technology and is public domain (not subject to copyright).


NIST Special Publication # 800-69


Translate to: French German Italian Spanish Portuguese GTM_LAN_DUTCH Russian Chinese Arabic Korean English
Google Ads




Headlines

»Spotlight on Commerce: Donna F. Dodson
»Lack of Effective Timing Signals Could Hamper Internet of Things Development
»NIST 2015 SBIR Grants to Fund Research in Manufacturing, Clean Energy, Cybersecurity and Bioscience
»NCCoE Speaker Series March 2015
»New NIST Tools to Help Boost Wireless Channel Frequencies and Capacity
»NIST Announces Pilot Grants Competition to Improve Security and Privacy of Online Identity Verification Systems
»Vendors Sought to Develop Model System to Monitor Security of Energy Industry Networked Control Systems
»NIST Releases Update of Industrial Control Systems Security Guide for Final Public Review
»Cybersecurity Summit Technical Workshop
»NIST Forensic Science Standards Committees to Hold First Public Meetings in February 2015
»NIST Security Guide Walks Organizations Through the Mobile App Security Vetting Process
»Open-Source Software for Quantum Information
»NIST Requests Round Two Comments on its Cryptographic Standards Process
»Symposium to Focus on Future of Voting Systems
»NIST Meeting: Cybersecurity Is a Key Ingredient In the Manufacturing Mix


Date published: not known
Details

»Cisco Releases Semiannual IOS Software Security Advisory Bundled Publication
Original release date: March 26, 2015 Cisco has released its semiannual Cisco IOS Software Se ...
»Installer Hijacking Vulnerability in Android Devices
Original release date: March 24, 2015 A vulnerability in Google's Android OS has been discove ...
»Apple Releases Security Update for OS X Yosemite
Original release date: March 20, 2015 Apple has released Security Update 2015-003 for OS X Yo ...
»Mozilla Releases Security Updates for Firefox, Firefox ESR, and SeaMonkey
Original release date: March 20, 2015 | Last revised: March 23, 2015 The Mozilla Foundation h ...
»Drupal Releases Security Updates
Original release date: March 19, 2015 | Last revised: March 20, 2015 Drupal has released upda ...
»OpenSSL Patches Multiple Vulnerabilities
Original release date: March 19, 2015 OpenSSL has released new updates addressing multiple vu ...
»Ubuntu Releases Security Update
Original release date: March 19, 2015 Ubuntu has released a security update to address multip ...
»Apple Releases Security Updates for Safari
Original release date: March 18, 2015 | Last revised: March 19, 2015 Apple has released secur ...
»Adobe Releases Security Updates for Flash Player
Original release date: March 12, 2015 Adobe has released security updates to address multiple ...
»Microsoft Releases March 2015 Security Bulletin and Patches FREAK
Original release date: March 10, 2015 Microsoft has released updates to address Windows vulne ...


Date published: not known
Details

»Paper: Dylib hijacking on OS X
Patrick Wardle shows how OS X is also vulnerable to once common Windows attacks. A few years ago, DL ...
»Will DIME eventually replace email?
Protocol has all the advantages of email, yet is orders of magnitude more secure. In the current Int ...
»Paper: Windows 10 patching process may leave enterprises vulnerable to zero-day attacks
Aryeh Goretsky gives advice on how to adapt to Windows 10's patching strategy. Patching is hard, esp ...
»The ghost of Stuxnet past
Microsoft patches .LNK vulnerability after 2010 patch was found to be incomplete. Mention Stuxnet an ...
»Virus Bulletin seeks hackers, network researchers for VB2015
One week left to submit an abstract for the 25th Virus Bulletin conference. A few weeks ago, I made ...
»Canadian firm fined $1.1m for breaching anti-spam law
First success story for long-awaited CASL. The Canadian Radio-television and Telecommunications Comm ...
»VB2014 paper: Leaving our ZIP undone: how to abuse ZIP to deliver malware apps
Gregory Panakkal explains that there are different ways of looking at APK files - and that sometimes ...
»FREAK attack takes HTTPS connections back to 1990s security
Golden keys from the (first) crypto wars have come back to haunt us. When a web client makes a secur ...
»Paper: Script in a lossy stream
Dénes Óvári explains how to store code in lossily compressed JPEG data. Malformed PDF ...


Date published: not known
Details

»Hotel Router Vulnerability A Reminder Of Untrusted WiFi Risks
A flaw in a popular router product may have exposed millions of hotel guests, says Cylance
»Black Hat USA 2015: Defensive Bonus +3
Defense never seems to garner quite as much glory as offense, but good home-base security is what ke ...
»Cyber Hunting: 5 Tips To Bag Your Prey
Knowing the lay of the land and where attackers hide is a key element in hunting, both in nature and ...
»SSL/TLS Suffers 'Bar Mitzvah Attack'
Researcher at Black Hat Asia shows how attackers could abuse a known-weak crypto algorithm to steal ...
»SDN Shows Promise For Security
Improved security is emerging as a major reason for adopting software-defined networking, but concer ...
»Researchers Use Heat To Breach Air-Gapped Systems
BitWhisper project is part of ongoing air gap security research at Israel's Ben-Gurion University
»FBI Threat Intelligence Cyber-Analysts Still Marginalized In Agency
Despite good progress, 9/11 Review Commission says that analysts could have a greater impact on FBI ...
»Preparing for a Breach: The Charge of the Security Brigade
Automation is key to shorter response times and better containment.
»Black Hat USA 2015: Caution: Disassembly Imminent
The ability to reverse-engineer binary software components is more than just a fun party trick -- it ...


Date published: Sat, 28 Mar 2015 05:01:23 EDT
Details
Main Menu
· Home
Current Security News
 
SANS Internet Storm Center, InfoCON: green

» Infocon: green

» Friday Digest - 27 MAR 2015, (Fri, Mar 27th)
[27 Mar 2015 06:59pm]

» ISC StormCast for Friday, March 27th 2015 http://isc.sans.edu/podcastdetail.html?id=4415, (Fri, Mar 27th)
[26 Mar 2015 09:01pm]

» ISC StormCast for Thursday, March 26th 2015 http://isc.sans.edu/podcastdetail.html?id=4413, (Thu, Mar 26th)
[25 Mar 2015 09:16pm]

» Pin-up on your Smartphone!, (Thu, Mar 26th)
[25 Mar 2015 06:59pm]

» Nmap/Google Summer of Code, (Wed, Mar 25th)
[25 Mar 2015 10:06am]

» F-Secure: FSC-2015-2: PATH TRAVERSAL VULNERABILITY, (Wed, Mar 25th)
[25 Mar 2015 09:20am]

» PHP 5.5.23 is available, (Wed, Mar 25th)
[25 Mar 2015 08:55am]

» ISC StormCast for Wednesday, March 25th 2015 http://isc.sans.edu/podcastdetail.html?id=4411, (Wed, Mar 25th)
[24 Mar 2015 09:19pm]

» Repurposing Logs, (Tue, Mar 24th)
[24 Mar 2015 10:11am]

» ISC StormCast for Tuesday, March 24th 2015 http://isc.sans.edu/podcastdetail.html?id=4409, (Tue, Mar 24th)
[23 Mar 2015 09:20pm]

***
CNET News.com

» Microsoft defends opening Hotmail account of blogger in espionage case
[20 Mar 2014 06:47pm]

» Syria's Internet goes dark for several hours
[20 Mar 2014 04:25pm]

» Symantec fires CEO Steve Bennett
[20 Mar 2014 03:07pm]

» Microsoft sniffed blogger's Hotmail account to trace leak
[20 Mar 2014 01:28pm]

» Microsoft sniffed private Hotmail account to trace trade secret leak
[20 Mar 2014 01:28pm]

» IBM's new services zero in on fraud, financial crime
[20 Mar 2014 07:31am]

» Despite assault on privacy, Page sees value in online openness
[19 Mar 2014 08:00pm]

» Hackers transform EA Web page into Apple ID phishing scheme
[19 Mar 2014 05:21pm]

» NSA top lawyer says tech giants knew about data collection
[19 Mar 2014 02:57pm]

» Microsoft touts study showing the cost of pirated software
[19 Mar 2014 06:55am]

» Microsoft touts study showing cost of malware in pirated software
[19 Mar 2014 06:55am]

» How to spy on your lover, the smartphone way
[18 Mar 2014 01:24pm]

» Mt. Gox update lets users see their Bitcoin balances
[18 Mar 2014 06:38am]

» Fake Malaysia Airlines links spread malware
[17 Mar 2014 05:12pm]

» IBM: No, we did not help NSA spy on customers
[17 Mar 2014 01:15pm]

***

***



***


More IT Security
News Feeds
More Sponsors

Advertise on this site
RSS Feeds
Our news can be syndicated by using these rss feeds.
rss1.0
rss2.0
rdf
Symantec News

NIST.org is in no way connected to the U.S. government site NIST.gov

This site is © John Herron, CISSP. All Rights Reserved.

Please visit daily to stay up to date on all your IT Security compliance issues.

http://www.nist.org -
Hosted by BlueHost. We've never had a better hosting company.
{THEMEDISCLAIMER}