Extract - A risk assessment of the Piql Preservation Service

13 Appendix

13.1 Recommendations by the Norwegian National Security Authority

The Norwegian National Security Authority

Ten important measures against cyberattacks

Step 1: The four most effective measures 1. Upgrade software and hardware. Newer versions of software/hardware will seal more security holes than older versions, and they often have better security features. 2. Install security updates as soon as possible. Even the best products have flaws and vulnerabilities which could be exploited by attackers. System owners should establish a centrally controlled regime for update of applications, operating systems and firmware (f. ex. BIOS code). 3. Do not assign admin rights to end users. Most end users do not need administrator privileges. In a centrally managed system, end users get the software they need from a common distribution point. 4. Block running of unauthorized programs ("whitelisting"). Use tools such as Windows AppLocker to verify that end users only run approved applications. Block special programs outside the approved folders and removable media, such as on CDs and memory sticks.

Studies show that these four measures stop about 80-90% of Internet-related attacks.

Step 2: Six additional measures

5. Activate code protection against unknown vulnerabilities. DEP SEHOP, ASLR and EMET forces the system against vulnerabilities in applications and operating system even when there's an update 6. Curing applications. Protected Mode / View for Internet Explorer, Microsoft Office and Adobe Reader limiting the extent of the compromise. Disable unnecessary mobile code and macros. 7. Use client firewall. Windows Firewall blocks all unsolicited incoming traffic and logs safety related events. Inspect the log files regularly.

8. Use secure boot and disk encryption. Windows Secure Startup and Windows BitLocker uses measurements and hard drive encryption to detect tampering of the boot process and prevent data loss from stolen / lost PCs.

Page | 22