CIS288 Security Design in a Windows 2003 Environment

CIS288 Securing Network Resources

Objectives
When you complete this lesson you will be able to:
Design an access control strategy for files and folders Analyze auditing requirements Design an access control strategy for the registry Design a permission structure for registry objects Design a strategy for the encryption and decryption of files and folders Design security for a backup and recovery strategy

Designing an Access Control strategy for Files and Folders

One of the fundamental elements of data security is controlling access to information. Step 1
Authorizing access to user

Step 2
Controlling what data those users can access

Windows Server 2003

Analyzing Risks to Data

Common elements that should be reviewed and analyzed as part of a comprehensive security plan:
Physical loss of data Data corruption Data modification from viruses and other attacks Security breaches due to incorrectly configured permissions Auditing practices

Reviewing Access Control and Access control Lists

When designing a resource strategy, you must determine how to grant and manage appropriate access to users, groups, and computers. Two methods:
Access control
Permissions User Rights Object Auditing

Resource Authorization
User/ ACL Account Group/ACL Account Group/ Resource Group Role-Based Authorization

Analyzing Auditing Requirements

As part of designing network resource security, you should analyze your requirements for auditing to determine what level of auditing is appropriate for your organization. Knowing your business patterns will help you spot patterns in the audit events. There are a number of events that could be managed, but the following list is a good starting point:
Logon events Account logon events Directory service access events Privilege use events Object access events Object access events System events Process tracking events Policy change events

Design an Access Control Strategy for the Registry

The registry is the heart of the Windows Server 2003 operating system and contains sensitive data about the files and folders, the applications, and the computer state. The only users who are granted full access to the entire Registry are administrators. While permissions can be modified for the Registry using the Registry Editor, it makes sense in a larger organization to apply security to the Registry via Group Policy.

Design a Permission Structure for Registry Objects

By default, when you install a clean version of Windows Server 2003, the Setup Security.inf security template is applied The easiest way to manage Registry settings is to use the settings provided in the predefined security templates in Windows Server 2003 Secedit.exe Group Policy Object Editor Snap-in Security Configuration and Analysis Snap-in

 An encryption strategy for files and folders includes an assessment of vital data, an assessment of the environment, policies for using EFS, and procedures for recovering encrypted files. Obviously, not all files are sensitive enough to warrant encryption. In most cases, files protected with two layers of security will be safe. However, files that contain sensitive data such as social security numbers, credit card data, medical or health data, or corporate trade secrets should be protected with EFS.

Creating a Strategy for the Encryption and Decryption of Files and Folders

Designing Security for a Backup and Recovery Strategy

Youve probably heard horror stories about companies that failed to back up their data and suffered the consequences. Currently 60% to 70% of a companys data storage management efforts are associated with backup and recovery functions. Most companies today use tape backup systems for both current backup and archival backups.

Summary
Design an access control strategy for files and folders Design an access control strategy for the registry