Chapter 5. Controlling Access to Data Controlling access to data is the reason for information security. Let's not forget that. The reason for protecting servers or the network is to protect the data that resides on them. The best approach to controlling access to data is to use defense in depth. This can be accomplished by using perimeter controls such as firewalls, by monitoring the internal network using intrusion detection, by insisting on the use of VPNs and other types of encrypted data transport, and by properly managing authentication and the rest of the principles and practices that are explained elsewhere in this book. Ultimately, however, when all is done, if these other systems fail, it's the controls that are closest to the data that protect them, becoming their last bastion of defense.Two kinds of data access controls existtechnical and cultural. Technical data controls are the permissions set on files, folders, shares, web folders, registry keys, and other objects. You should know them well; apply, maintain, and audit them. Cultural controls are the security orientation of the IT administrators, software developers, and data owners. This not only means they support, they are eager for the necessary technical controls to be properly in place, but also that they have an understanding of data security that allows them to evaluate new technologies with an eye to preventing users from getting around the technical controls used with older technologies. This chapter will provide information primarily to assist you with technical controls, first by reviewing the traditional technical controls for file systems and registry data, and then by examining new and improved data management technologies in Windows Server 2003 with an eye to securely implementing them. |