Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

What's Inside and What's Not

Information security is not a new field. What is new is the requirement that every information technology worker emerges from being security-challenged to being security-conscious. Those who are responsible for any facet of production networks have a higher calling. They must not only be aware, but they also must be proactive. They cannot afford to merely react to the latest Internet threat. They must apply the principles of information security through their network. This book can help them.

Chapter 1, "Principles of Information Security," defines these principles and relates them to the content of each chapter. Each chapter deals with a specific Windows Server 2003 security topic and provides both information and instructions for securing the server and for using its security technologies to provide protection for the network. Topics include authentication, user rights and permissions, Software Restriction Policies, Authorization Manager, NTFS, the Encrypting File System (EFS), WebDAV, changes in security technologies introduced with Active Directory, securing Active Directory, trusts in an Active Directory forest between domains in different forests and between forests, Public Key Infrastructure (PKI), using Routing and Remote Access and RADIUS, IPSec and PPTP, SMB signing, a role-based approach to server security, auditing monitoring, and maintenance.

This book often provides a unique approach to its subject. It explains not just how to use the technology but when and why and how to use security technologies in a secure manner. An example of this approach is the two chapters on PKI. The first chapter explains the technology and details what must be done to ensure that this key security technology does increase security and not just provide a false sense of security. The second chapter details precisely how to do this. It provides the implementation details of securely implementing a two-tier Certification Authority (CA) hierarchy, including an offline root CA. This chapter is also an example of the type of value added by this bookit's rare to find a thoughtful security approach to a security technology, and it's even rarer to find such a step-by-step detail all in one document.

While the book starts with basic security information relative to Windows Server 2003 in a workgroup or domain environment, progresses to security in an Active Directory network, and finishes by explaining the details of advanced Windows-based security technologies, an advanced reader can also benefit by jumping right to the material relevant to a specific problem or a current desire for knowledge. This is because with some exceptions, chapters are based on technical issues rather than technologies. Chapters are therefore often focused around topics such as "Securing Remote Access" (RRAS, VPNs, Internet Information Server), "Securing Data in Flight" (IPSec, PPTP), "Controlling Access to Data" (NTFS, EFS, protecting shares, using WebDAV), "Authorization: Limiting System Access and Controlling User Behavior" (user rights and permissions), or "Restricting Access to Software, Restricting Software's Access to Resources" (Software Restriction Policies, Authorization Manager).

This book cannot be your only source for Windows security information. It does not, for example, provide information on securing other versions of Windows. While much of the information on Windows Server 2003 is relevant to the security of earlier versions and will be relevant to future versions, much is unique to Windows Server 2003. You also won't find everything you need to know about securing IIS or securing Windows applications. It is not a book on secure programming, and it does not seek to train you in computer forensics. These topics require book-length discussions of their own. It would be presumptuous to attempt to deliver them along with everything else.

This is also not a sexy book. You won't find cool hacker tricks within or justification for using a security technology based on some exploit that works if you don't utilize the hardening technique. There are far too many "I can hack into your network and here is how to stop me" security books. You should not be relying primarily on securing your network against attacks that are so well known that they are published in a book. Instead, you should be applying the knowledge that not only works against multiple current attacks, but that also may quite possibly secure networks against exploits not yet designed.