Windows 2000 Security Little Black Book
Authors: Ian McLean
Venue:  (2000)

From the Book:This book discusses network security on a Microsoft Windows 2000 network, although many of the principles of good security are product independent. It's a technical book, addressing technical issues--but it doesn't lose sight of the fact that security is as much a people problem as a technical one. It's designed to help the administrator to balance security and usability, and to set security criteria that colleagues accept as workable and sensible. Security technologies are developing rapidly. Public key certificates and dynamic passwords help meet the security needs of the enterprise environment. Remote access over public networks, and Internet access for business-to-business communication, are driving the evolution of security technology. Smart cards are replacing password security where the use of the latter has proven to be problematical, and biometrics--the use of a unique physical characteristic such as a fingerprint or retina scan instead of a PIN--provides a sound basis for account security combined with ease of use. This book covers the new features that Windows 2000 provides to assist the security professional to set up a sound but useable security framework--always remembering that nothing's infallible! Who the Book Is For This book is for network professionals, possibly with a Windows NT 4.0, NetWare or Unix background, who are administering or intend to administer Windows 2000 networks--and specifically to set up Windows 2000 security. It would also be of use to technical support personnel and to consultants and designers tasked with developing and setting up security on a network. The book's structure makes it ideal for those who want to learn the facts, carryout the procedures and solve the problems--fast. The book assumes that readers know how an NT 4 trust works, have come across User Manager for Domains, Server Manager, System Policy Editor and Event Viewer, have a working knowledge of TCP/IP and know the limitations of 10BaseT. How the Book Is Organized The first chapter takes a broad-brush approach, introducing the topics that will be described in detail later in the book, and the terms and acronyms that the reader will come across time and time again when implementing Windows 2000 security. The purpose of the chapter is to provide an overview, familiarize the reader with the concepts, and let him or her decide which of the subsequent chapters is of particular interest. This book is about solving problems. Chapter 1 addresses the problem of knowing where to start, what to look for, and where to find it. Chapter 2 describes Active Directory, which defines the structure of a Windows 2000 network, and provides the means to implement structured, multi-level security zones with a finer granularity of control than was possible with previous Microsoft Windows implementations. The chapter demonstrates how Active Directory can be customized and Access Control Settings configured, and introduces the Microsoft Management Console (MMC) snap-ins that are used to configure and administer all aspects of Windows 2000, including security policies. Chapter 3 describes group policy, and the methods by which the settings contained in Group Policy Objects (GPOs) can be applied to Active Directory objects such as sites, domains and Organizational Units (OUs). The chapter discusses policy inheritance, how domain-level policies may be enforced or blocked at lower levels in the Active Directory structure, and how security group filtering enables the certain administrative tasks to be delegated without compromising of overall domain security policy. Chapter 4 looks at the various Windows 2000 Security Protocols and how these are used. In particular, the chapter highlights Kerberos 5, the Windows 2000 default authentication protocol. The chapter describes how mutual authentication is achieved using a shared secret protocol, and discusses shared keys, session keys, key distribution centers, Kerberos tickets, the ticket granting service, and cross-domain authentication. The principles and practice described in this chapter are central to the entire concept of Windows 2000 security. In Chapter 5, the problem of unauthorized access to sensitive data id outlined, and the Windows 2000 solution, the Encrypting File System (EFS) is described. EFS is normally invisible to the user, who can access and edit his or her own files in the usual manner, while the files remain inaccessible to any other user. This has its own problems, and the use of recovery agents to retrieve encrypted files is also discussed. Chapters 6 and 7 are interlinked. The use public keys, private keys, and security certificates provides strong security when sensitive data is being sent over a hostile environment such as the Internet. Chapter 6 discusses the Windows 2000 public key infrastructure (PKI), the use of the SSL3 protocol to set up a secure Web site, and the use of digital signatures and encryption to protect sensitive e-mail traffic. Chapter 7 discusses certificate authorities (CAs), including Microsoft Certificate Services and third party CAs such as VeriSign and Thawte. The chapter describes how to set up a CA, how to obtain certificates, and how to set up a certificate revocation list (CRL). Chapter 8 discusses certificate mapping, which implements certificate-based security for logons over a hostile environment, such as the Internet, and provides a method of authenticating logons by employees of a partner or subsidiary organization who don't have individual accounts in a domain. Smart cards, discussed in Chapter 9, are rapidly becoming the authentication method of choice, particularly for large organizations that have found password security difficult to manage in the past. Sensitive data is at its most vulnerable when travelling across a network. While SSL3 encryption can be used by (for example) browsers, it requires applications to be SSL3 aware. Internet Protocol Security (IPSec), discussed in Chapter 10, provides a method, invisible to the user, of securing all network traffic against both outsiders and malicious insiders. Where traffic passes over a foreign network, such as the Internet, tunneling through Virtual Private Networks (VPNs), discussed in Chapter 11, provides a cost-effective answer to security concerns. Chapter 12 looks at the tools provided for configuring local security using security templates, editing security parameters, creating new templates, and analyzing security settings Finally there's a glossary that lists and explains the technical terms used in the book, and a comprehensive index to enable the reader to search for specific terms and topics, making the use of the book even quicker and more effective. How the Book Can Be Used This book can be read through from start to finish, and will give an excellent grounding in Windows 2000 security. However, the reader may feel it's more appropriate to skip around, finding examples and procedures that will help with current tasks or with any problems he or she may encounter. The book is a reference resource, to be used in the way best suited to the reader's needs and experience.