Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Best Practices for Securing Authentication

This chapter describes Windows authentication and provides instructions for configuring Windows authentication. It details practices that can make Windows systems more secure. However, it does not always point out which practices are considered best, and it doesn't support authentication practices by detailing auxiliary practices that support and protect authentication practices. You should use the information in this section to evaluate and strengthen your current authentication practices:

Create a strong account policy.

Configure user account restrictions when individual restrictions vary. In general, use account restrictions if it is necessary to weaken security.

Teach users how to create strong passwords. Options include creating long passphrases and adding numbers and special characters in the middle of passwords.

Require administrators to use password requirements that exceed those set in the domain password policy. For example, administrators might be required to use passwords longer than 14 characters, while the domain policy only requires passwords to be 8 characters. Another option administrators might use is Unicode characters. You cannot technically enforce the administrator requirement without writing or purchasing custom code; however, you can still create the requirement and audit its implementation.

Set Security Options that enforce secure authentication practices such as requiring NTLMv2 and maintaining or improving anonymous connection restrictions.

Use a Password Auditing Tool to audit compliance with password policy. Be sure to have written authorization to do so.

Understand the role of defense in depth. Security practices such as physical security, authorization controls, and others can stop attacks that breach authentication controls or prevent attempts at authentication attacks.

Train users to resist social engineering attacks. All of the strong passwords and secure authentication practices can do no good if users can be tricked into revealing their passwords to others.

Train users in good credential management practices. If users leave passwords where others can see or find them, or if users use domain passwords for website registration or lend passwords or other credentials to others, then it won't matter if authentication controls are in place.

Understand all of the administration tools and methods by which authentication can be manipulated, and ensure that access to these tools is permitted only to those authorized to use them.