Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Creating Custom Group Roles

To successfully develop and use custom groups for role-based access control, you should thoroughly understand the following:

Predefined user rights

Predefined access permissions associated with specific object types

Windows access control mechanisms

Default operating system rolesthe default user groups and users

How to create custom roles by directly assigning rights to groups and giving these groups access to objects

How to use tools that provide another way to grant authority, including the Delegation of Control wizard and Authorization Manager

How to audit user and group use of rights and access

Using custom groups to provide role-based access control is as much a function of administrative and programmer understanding as it is operating system enforcement. To ensure that custom group role development is properly applied on your systems, you should establish a policy that specifies how each custom group role is authorized, defined, implemented, maintained, and audited and how membership in the group is authorized. Executive management must back and enforce this policy. Train programmers and administrators in its concepts and the rules of its application, implement it methodically, and audit it to ensure compliance.

NOTE: Writing Information System Policies

While this book recommends many items that should be included in information system security policies, policy writing is beyond this book's scope. For an excellent introduction to policy writing, see Scott Barman's book Writing Information Security Policies (Que, 2001).

Best Practices for Local Users and Local Groups

One of the most important uses of groups is that of providing access to objects in an orderly, scalable, sustainable, and auditable fashion. There are options for doing so. Following sound practices on the single standalone computer is important. Good habits here will enable best practices at the domain and forest level if and when the server is joined to a domain. Use these best practices:

Assign rights and permissions to groups, not to individual users. This makes things far easier to manage. If groups represent the role a user can play, then adding a user account to a group allows the user to play that role, and removing the user prohibits him from playing that role.

Add users to groups to provide them the access and rights they need on the computer.

Keep the number of users assigned to the Administrators group small.

Assign users to groups in a manner that only provides them the access they require and not a bit more.