Windows Registry, system hardening

1.1 System and Network Architecture Concepts

OS concepts

📘CompTIA CySA+ (CS0-003)

---

1. Windows Registry

The Windows Registry is a central database that stores configuration settings and options for the Windows operating system and installed applications. Think of it as the “brain” of Windows—it keeps track of everything from user preferences to system hardware and software settings.

Key Points for the Exam:

1. Structure of the Registry
   • The registry is organized like a tree with keys (like folders) and values (like files inside the folders).
   • The main sections (called hives) are:
     • HKEY_LOCAL_MACHINE (HKLM): Stores system-wide settings.
     • HKEY_CURRENT_USER (HKCU): Stores settings specific to the currently logged-in user.
     • HKEY_CLASSES_ROOT (HKCR): Stores file associations and COM object information.
     • HKEY_USERS (HKU): Contains all user profiles.
     • HKEY_CURRENT_CONFIG (HKCC): Stores current hardware configuration info.
2. Common Registry Usage
   • Startup programs: Registry keys control which programs run when Windows starts.
   • Security settings: Policies for password complexity, user rights, and software restrictions are stored here.
   • Device drivers: Information about installed hardware and drivers.
   • Application settings: Many software applications store their configurations in the registry.
3. Registry Locations for Security Monitoring
   • Autoruns and startup keys:
     • HKLM\Software\Microsoft\Windows\CurrentVersion\Run
     • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
       These keys list programs that automatically start, which attackers often exploit.
   • Service configurations:
     • HKLM\System\CurrentControlSet\Services
       Services and their startup types can indicate misconfigurations or malware persistence.
4. Tools for Accessing the Registry
   • Registry Editor (regedit) – GUI tool for manual inspection.
   • PowerShell (Get-ItemProperty) – Script-based querying for automation.
   • Third-party monitoring tools – Used in enterprise environments for detecting unauthorized changes.
5. Security Considerations
   • Unauthorized changes in the registry can lead to malware persistence.
   • Monitoring the registry is part of host-based intrusion detection.

---

2. System Hardening

System Hardening is the process of securing a computer or server by reducing its attack surface—basically making it harder for attackers to exploit it.

Key Points for the Exam:

1. Purpose of Hardening
   • Prevent unauthorized access.
   • Reduce vulnerabilities.
   • Ensure compliance with security policies.
2. Steps for Windows System Hardening
   1. Patch and Update Management
      • Regularly apply OS and software updates to fix vulnerabilities.
   2. User Account Control
      • Use least privilege: give users only the access they need.
      • Disable or remove default accounts that aren’t used.
   3. Password Policies
      • Enforce strong passwords and expiration policies.
   4. Service Management
      • Disable unnecessary services that could be exploited.
   5. Registry Hardening
      • Restrict changes to critical registry keys.
      • Example: Restrict Run keys to prevent unauthorized startup programs.
   6. Software Restrictions
      • Use AppLocker or similar policies to prevent running unauthorized software.
   7. Network Hardening
      • Configure firewalls.
      • Disable unused network ports.
   8. Audit and Monitoring
      • Enable logging of important events (logon attempts, changes to key files or registry).
      • Regularly review logs for suspicious activity.
3. System Hardening Tools
   • Group Policy Objects (GPOs): Centralized management of security settings.
   • PowerShell scripts: Automate hardening tasks like disabling unneeded services.
   • Security baselines: Predefined configurations recommended by Microsoft (like CIS Benchmarks).
4. Why Hardening Matters for Cybersecurity Analysts
   • Reduces the number of entry points for attackers.
   • Makes detection of compromise easier because normal system behavior is more predictable.
   • Helps in compliance with security standards (NIST, ISO, etc.).

---

Exam Tip:

For CySA+, focus on:

• Recognizing what the Windows Registry is and where attackers might manipulate it.
• Understanding common registry paths used by malware.
• Knowing hardening steps to reduce vulnerabilities on Windows systems.
• Understanding why hardening and monitoring improve security posture.

---

✅ Quick Summary Table for Easy Recall:

Topic	Key Points
Windows Registry	Database of OS & app settings; main hives: HKLM, HKCU, HKCR, HKU, HKCC; startup & service keys are critical for security monitoring.
System Hardening	Process to secure OS; includes patching, user control, password policies, disabling services, registry protection, network hardening, monitoring.
Tools	regedit, PowerShell, GPOs, AppLocker, security baselines.
CySA+ Focus	Monitor registry for attacks, understand hardening steps, reduce attack surface, improve detection & compliance.