Professional Windows Server 1002003 Security A Technical Reference [Electronic resources] نسخه متنی

Chapter 10. Securing Active Directory

If an attacker can obtain unfettered access to Active Directory (AD), he gains absolute control over every computer, resource, and user account in the forest. Even limited privileged access can provide a wealth of information useful in future attacks. Active Directory is not only the seat for critical information in your network, but it is also the repository for major security controls and information such as password policy, security configurations, and audit policy. To ensure security for a Windows Server 2003 or Windows 2000 Active Directory network, you must secure the Active Directory. The steps that you take to do so will also support and improve the security status of other Windows systems and the data that they manage. To secure Active Directory, the following practices must be applied:

Physically secure domain controllers

Establish security configuration and administrative boundaries

Establish secure administration practices

Secure application and user access to domain controllers

Use secure Active Directory installation and deployment practices

Deploy secure DNS

Establish and use security maintenance practices

Monitor and audit directory access

Implement response to detected attack

Several of these practices are detailed in other chapters, specifically, securing DNS (see Chapter 11, "Securing Infrastructure Roles") and monitoring, auditing, and responding to attacks (see Chapter 19, "Monitoring and Assessment"). This chapter addresses physical security, secure installation, and deployment and administration practices for AD.

When following these practices, consider the typical locations where DCs are found: corporate headquarters and regional data centers, branch office locations and perimeter networks, or extranets. There are many differences between these deployment scenarios, and therefore, although some aspects of their management and security remain the same, the uniqueness of the setting may mean your approach may have to be modified. The differences include the following:

Corporate locations and regional datacenters
These have centralized IT operations housed in secured facilities, high bandwidth, established places to build and configure systems, written policies and procedures, dedicated IT staff, and monitoring and auditing facilities.

Branch offices
These may have slow and even intermittent connectivity. Domain controllers are not segmented from client networks, nor can they always be isolated from running additional services, including print and file services. There typically is no dedicated secure facility to house the DC and other servers. No dedicated IT staff exists, and it is difficult to restrict administration to IT. Physical access is also more difficult to restrict. It is harder to detect problems and attacks, and remotely manage these systems. Each branch office presents its own unique situation, and it is difficult to uniformly establish good physical or other controls.

Extranets
These typically have high bandwidth and secured facilities. The location provides facilities for testing and central IT staff. An outward-facing DC provides authentication and access to customers and partners. Internet exposure is a given but is usually highly protected by firewalls and other network devices. If administration is provided externally to the extranet, it is usually established via a VPN.