Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Chapter 4. Restricting Access to Software; Restricting Software's Access to Resources

Many of today's successful attacks are application layer attacks, which are the result of an exploit based on vulnerabilities in applications other than the operating system. While these attacks do cause enormous problems, many other problems are caused by accidental user actions such as clicking on email attachments, downloading software from the Internet, and misusing applications. These actions can result in accidental deletions, loss of data integrity, and loss of access to encrypted data. While we must strengthen defenses to protect applications from malicious attack, write applications that do not include vulnerabilities, and train users to make better decisions, we must also consider if we can design and manage applications better.

Perhaps the answer is blocking the use of specific software, or perhaps we should configure systems so that only approved software will run. Doing either may help. After all, if malware cannot run, it cannot cause harm. In addition to securely coding applications, perhaps we can do a better job of embedding control within the application to manage user rights and access to resources at the application level. We can accomplish these things by using the following components in a Windows Server 2003 network:

File, registry, printer and Active Directory access control lists (ACLs)
Setting appropriate file ACLs on an executable program prevents unauthorized individuals from running it. Setting file, Active Directory, and registry ACLs can prevent unauthorized individuals from performing specific tasks with the software and can prevent them from copying files to areas of the hard drive. File and registry ACLs were introduced in Chapter 3, "Authorization: Limiting System Access and Controlling User Behavior," and are explored in depth in Chapter 5, "Controlling Access to Data."

Authorization Manager Framework
New in Windows Server 2003, Authorization Manager allows developers to build role-based security into their applications. Administrators manage the use of this software by adding users into Windows groups, Application Groups, Application Basic Groups, and LDAP Groups. Authorization Manager also permits control over who can run specific parts of software running on a system.

Software Restriction Policies
New in Windows XP Professional and new to the server in Windows Server 2003, Software Restriction Policies can be used either to selectively prevent software from running or to only allow identified software to run on a computer.

Component Services: Permissions and Roles for COM+
Applications can be managed using the Component Services tool. To be fully effective, COM+ applications must be developed with defined roles. Otherwise, the administrator is restricted to making changes in launching permissions and authentication levels. New in Windows Server 2003, you can set the Software Restriction security level directly in the COM+ properties pages of the application.

Group Policy
Many applications can also be managed through Group Policy. Specific controls for managing system applets are contained in the Administrative Templates section of Group Policy. Special Administrative Templates are available for products such as Microsoft Office. The use of Administrative Templates in Group Policy is discussed in Chapter 7, "Active Directory's Role in Domain Security."

EFS
Application files can be encrypted using the Encrypting File System (EFS). EFS basics are described in Chapter 6, "EFS Basics."

Three major software management tools are available in Windows Server 2003: Authorization Manager, Software Restriction Policies, and the Component Services console. This chapter will describe them and how they can be used.