Summary Protecting data while it traverses the network is important, whether the network is the Internet or the internal network. Several strategies can be employed depending on the nature of the data that must be protected. Active Directory access should be protected by using LDAP signing where LDAP is used and, where appropriate, by requiring SASL or TLS. Other secured communications, such as logons, can be secured via Security Options to ensure that they are signed and/or encrypted. SMB sessions are secured by default using SMB signing. Where web servers and other servers configured for SSL are part of the communication, SSL should be appropriately configured. Finally, where communications need to be blocked, specifically permitted, or negotiated between two computers, IPSec policies can be configured to provide computer authentication, integrity, and encryption. Many of these security strategies require computer certificates, and if Microsoft certificate services have been implemented, computers may be configured for automatic enrollment. |