Upload
sandra4211
View
686
Download
3
Tags:
Embed Size (px)
DESCRIPTION
Citation preview
The 5-Step Security Checkup for Education
Barbara ChungSecurity Advisor, EducationMicrosoft Corporation
Agenda
Secure Administrative Accounts Implement Zones of Trust Build a Baseline Patch Agile Processes
#1 Secure Administrative Rights
The keys to the kingdom, using them inappropriately can forfeit everything else you do for security– Two general types of problems:
• Attackers who obtain admin credentials
• Users who have been granted admin credentials, but may not understand the implications of using them carelessly or incorrectly
#1 Secure Administrative Rights
Forest is the security boundary, not the domain.
You must trust ALL domain admins Admin accounts not email-enabled, not
used as desktop accounts, use restricted to trusted machines
Administrative Accounts
Administrator Created accounts assigned to admin groups Accounts that use:
– EFS Data Recovery certificates– Enrollment Agent certificates– Key Recovery Agent certificates
Administrative Groups
– …in Builtin container: for example, Account Operators, Server Operators
– …in User container: for example, Domain Admins, Group Policy Creator/Owners
– Anything that you create and assign admin privileges
–
Administrative GroupsDefault Domain Groups
– Enterprise Admins– Domain Admins– Schema Admins– Group Policy Creator Owners– Administrators group– Administrator account– DS Restore Mode Administrator
Admin Account Types
Local admin accounts Domain admin accounts Forest admin accounts
Principle of Least Privilege
Always grant minimum privileges required to complete the current task
Requires some work, but helps to understand your organization
Don’t do it: logging on as Domain Admin to troubleshoot a workstation with suspected security problems
Best Practices Separate domain administrator and enterprise
administrator roles. Separate user and administrator accounts. Use the Secondary Logon service. Run a separate Terminal Services session for
administration. Rename the default Administrator account. Create a decoy Administrator account. Create a secondary Administrator account and
disable the built-in Administrator account.
•Best Practices, cont… Enable Account Lockout for Remote
Administrator Logons. (passprop.exe) Create a strong Administrator password. Automate scanning for weak passwords. Use administrative credentials on trusted
computers only. Audit accounts and passwords on a regular basis. Prohibit account delegation. Control the administrative logon process
References
– The Administrator Accounts Security Planning Guide: http://www.microsoft.com/technet/security/topics/serversecurity/administratoraccounts/default.mspx
The Services and Service Accounts Security Planning Guide http://www.microsoft.com/downloads/details.aspx?familyid=F4069A30-01D7-43E8-8B30-3799DB2D9C2F&displaylang=en
#2 Zoning
The concept is simple: enforce zones of trust on/within the network– Blue Zone………. controlled risk– Orange Zone……. reduced risk– Red Zone……….. High risk
Why?– You’re clear about what you’re going to
manage for security (not EVERYTHING)– Time = Opportunity
#2 Zoning
Firewalls 802.1x: use it to control access to the
wired/wireless network IPSec: control end-to-end communication
Zoning802.1x at the Border Standards-based, services and clients built
into newer versions of Windows, but you can mix-and-match
Components: Authentication directory or directories, RADIUS services, network device (switch, WAP), client software
#2 IPSec
Domain and Server Isolation
Protect trusted assets from unmanaged, rogue and guest PCs
Complement to other security mechanisms (firewall, antivirus, IDS)
Restrict communication to domain-managed computers
IPsec Domain And Server Isolation
Two scenarios– Domain isolation– Server isolation
Protects corporate hosts or servers from unmanaged, rogue, and guest PCs
Allows communication between hosts to be restricted between domain-managed computers
IPsec Domain And Server Isolation (2)
Provides ability to identify and control communications with critical client or server PCs
Complements other host security mechanisms
Complements network access protections
Domain Isolation Allows host to host communication to be
limited to domain members (managed computers)
Requires IPsec authentication and protection for any communication with domain members (managed computers)– Managed computers can initiate
communication with managed and unmanaged computers
– Unmanaged computers cannot initiate communication with managed computers
Scenario: Domain isolation
Common Access Infrastructure
Protected Ring
Quarantine Ring
Boundary Ring
Blocked
Allowed
AllowedAllowedAllowedAllowed
Server Isolation Requires IPsec authentication and
protection for communications from hosts to specific servers– Managed computers can initiate
communication with specific servers– Unmanaged computers cannot initiate
communication with specific servers
Group-specific server isolation– Only managed computers that are members of a
specific security group can initiate communication with specific servers
Scenario: Server Isolation
Protected Machine Group
All Machines
AllowedAllowed
Blocked
Additional resources
Microsoft Windows Server 2003 site at http://www.microsoft.com/ipsec/
“How to isolate servers by using Internet Protocol security” Support WebCast (see Knowledge Base article 889383)
2) Zoning
Won’t protect against trusted users/machines! (See #1: Secure Administrative Privileges
Building a Baseline for Trusted Machines Create visibility for security incidents Automate deployment of lock-down images
with tools like RIS, ADS Use Security Configuration Wizard to
develop role-based templates Use Group Policy to enforce security
settings
Patching
….
Agility
Agile processes are critical to maintaining a secure environment– Who do users notify when there’s a problem?– Who can call a security crisis?– What happens when a crisis is called?– What’s the timeline?– How does you security group interface with
operations group?
Questions?