Windows NT Security

Description

• Copyright 2000
• Dimensions: 7" x 9-1/4"
• Pages: 432
• Edition: 1st

• Book
• ISBN-10: 0-13-083990-6
• ISBN-13: 978-0-13-083990-9

8399K-8

A solid security foundation for enterprise NT 4/Windows 2000 networks!

• Understand Windows NT 4 and Windows 2000 security architecture
• Make the most of NTFS file and directory permissions
• Restrict users via system policies and user profiles
• Use encryption, decryption, authentication, and Windows 2000 Kerberos support
• Web security via Proxy Server filtering, logging, and alerts
• Windows 2000 Security Configuration Toolset, Group Policies, DFS, and more

In Windows NT Security, leading global IT consultant Michael McInerney presents the hands-on, task-oriented information you need to maximize NT security right now(and crucial insights into key underlying concepts for building a more secure enterprise for the long term. You'll find detailed coverage for NT 4 enterprise networks, plus discussion of Windows 2000's extensive security improvements and practical guidance for migration.

McInerney introduces security models of both Windows NT 4 and Windows 2000, demonstrating how to establish a rock-solid security foundation from scratch, how to audit existing NT networks, and how to enhance flawed security quickly and effectively. Discover how to make the most of NT's powerful file and directory security mechanisms, as well as the new Windows 2000 Distributed File System (DFS). Learn how to secure IIS-based Internet/intranet sites and RRAS remote access; even how to secure specific registry keys.

McInerney provides in-depth coverage of NT/Windows 2000 encryption and authentication, including a detailed look at Kerberos support in Windows 2000. Appendices provide comprehensive system policy file listings; services and packet filter logging information; and a comprehensive Security Checklist.



Sample Content

Downloadable Sample Chapter

Click here for a sample chapter for this book: 0130839906.pdf

Table of Contents

(NOTE: Most chapters begin with an Introduction.)

I. SYSTEM SECURITY OVERVIEW.

1. Introduction to Security Concepts.

Layered Approach to Securing Your Network. Physical Security. Location. Use of Removable Media. Removal of Unnecessary Hardware. Denial of Service. IT Security Control Objectives. Confidentiality. Integrity. Availability. Legal Notice at Logon. Qualities Defining a Secure System. Discretionary Access Controls. Audit Capabilities. Mandatory Identification and Authentication. Memory Management and Object Reuse. Encrypted Data Transfer. Encrypted File System. Summary.

2. NT 4.0 Security Architecture Overview.

Design Goals for Windows NT 4.0 Security. Modules of the NT 4.0 Security Architecture. Graphical Identification and Authentication (GINA) DLL. Trusted System. Objects. Access Control Lists (ACL). Access Control Entry (ACE). System Identifier (SID). Local Security Authority (LSA). Access Tokens. Security Reference Monitor (SRM). Security Account Manager (SAM). File and Directory Permissions. Mandatory Logon Process. Single Logon. Security Support Provider Interface (SSPI). Intra- and Interdomain Communication. Authenticated RPC and DCOM. NTLM Authentication. Impersonation. Security Implementation Overview. Installation Security Concerns. Logon and the Authentication Process. The Administrator Account. File and Directory Security. Registry Security. User Profiles. System Policies. Auditing Capability. New Security Management Tools. Microsoft Management Console. Security Configuration Manager for NT. Microsoft Proxy Server.

II. WINDOWS NT 4.0 SECURITY COMPONENTS.

3. File and Directory Security.

Disk Partitions. FAT. CDFS. CDFS. Share Permissions. NTFS. File and Directory Permissions. File Permissions. File Permissions. Directory Permissions. Viewing File and Directory Permissions. Setting File and Directory Permissions. The “No Access” Permission. Implementing File and Directory Security. Securing a New Volume. Directory Structure. Securing an Existing Volume. Conflicting Permissions. NTFS Permissions and the Administrator. Default System Permissions. Taking Ownership of Files or Directories. Share Permissions. NTFS and Share Permissions Working Together. Default Shares. Applying Share Permissions. NTFS Security or Share Security?

4. User Profiles.

User Profile Overview. What Is a User Profile? Types of User Profiles. User Profile Location. Creating a Roaming User Profile for NT 4.0. Define the Location. Create the Network Share. Create a Template User Account. Create a Base Profile. Distribute the Base Profile. User Setup. Amend the Roaming Profile. Making a Profile Mandatory. Profile Permissions. Amending the Profile with Regedt32. Ntuser.xxx Registry Permission Changes. Default User Profile. Windows NT 3.5x Profile Upgrades. Creating a Roaming Profile for Windows 95. Client Workstation Setup. Domain User Setup. Create the Profile. Making the Windows 95 Profile Mandatory.

5. System Policies.

Policy Editor Installation. Windows NT Server. Windows NT Workstation. Windows 95. System Policy Editor Modes. Registry Mode. File Mode. Registry Mode vs File Mode. Available Settings Groups. Computer Settings. User Settings. Windows NT 4.0 Policy Editor Interface. Categories. Policy Settings. Template Files. Policy File. Default Computer Policy. Network. System. Windows NT Network. Windows NT Printers. Windows NT Remote Access. Windows NT Shell. Windows NT System. Windows NT User Profiles. Individual Computer Policy. Default User Policy. Control Panel. Desktop. Shell. System Restrictions. Windows NT Shell. Windows NT System. Individual User and Group Policies. Single User. Groups. Group Priorities. Saving the Policy. Automatic Update Mode. Manual Update Mode. Policy Implementation Rules. Policy Conflict Resolution. Computer Policy Conflicts. User Policy Conflicts. The Dangers of Conflicts. Policy Template Files. Template File Structure. Hints for Building Custom Template Files. Summary.

6. Cryptography.

What Is Cryptography? Encryption and Decryption. Asymmetric (Public Key) Cryptography. Symmetric (Shared Key) Cryptography. Shared Key vs Public Key. Encryption Algorithms. One-way Functions. RC4. Data Encryption Standard (DES). RSA. Authentication. NT LAN Manager (NTLM). Distributed Password Authentication (DPA). Kerberos v5. Standard. Smart Cards. Kerberos in Windows 2000. Kerberos vs NTLM. Verification. Hash Function. Digital Signatures. Digital Envelopes. Digital (Public Key) Certificates. Secure Channel Services (SCS). Secure Sockets Layer (SSL). Private Communications Technology (PCT).

7. Proxy Server.

Services Overview. Benefits of Proxy Server. Single External Contact Point. Concealing Internal IP Addresses. Packet Filtering. Protection of Published Data. Administering Proxy Server. Permissions. Web Proxy. Winsock Proxy. Socks Proxy. Packet Filtering. Enabling Packet Filtering. Adding a Predefined Exception Rule. Creating a Custom Exception Rule. Creating a Custom Exception Rule. Editing Existing Exception Rules. Removing Exception Rules. Reset Defaults. Domain Filtering. Granting Access: Web and Winsock Services. Denying Access: Web and Winsock Services. Domain Filtering with Socks Proxy. Alerting. Rejected Packets. Protocol Violations. Disk Full. Switching Off Alerting. Configuring Email. Services Logging. Windows NT Event Log. Text File Logging. Database Logging. Packet Filter Logging. Text File Logging. Database Logging. General Proxy Server Guidelines.

8.Intallations.

Password Restrictions. Removing POSIX and OS/2 Subsystems. Restrict Access to Floppies and CD-ROMs. Last Logged-On Username Display. NTuser.dat Registry File.

9. NT Audit.

Windows NT Audit Basics. System Audit. Application Audit. Security Audit. Windows NT Security Audit Capabilities. Audit Policy Design. What to Audit. Whom to Audit. When to Audit. When to Clear the Audit Log. Example Audit Scenario. Event Viewer. Restrict Guest Access. Check Registry Security. Audit Policy Setup. Event Log Settings. Event Log Distribution. Enabling Audit Policies. Viewing Event Data. Summary.

10. Microsoft Management Console.

MMC Panes. Consoles. Creating Your Own Consoles. Windows NT 4.0 SP4. Windows 2000. Console Layout. Saving Your Consoles. Accessing Saved Consoles. Console Security Settings. Summary.

11. Security Configuration Manager for NT 4.0.

The Dangers of the SCM. Installation and Configuration. SCM-NT Functionality Overview. Template File Definition. Security Configuration. Security Analysis. Security Configuration Areas. SECEDIT Command-Line Utility. Unconfigured System Analysis. Comparing Analysis Results. Comparing Analysis Results. Applying a Standard Security Configuration File. Saving the New Configuration. Template Files. Custom Template File Location. Creating a Blank Template. Creating Custom Templates. Template Descriptions. Configured System Analysis. Security Areas. Static Definitions. Account Policies. Local Policies. Event Log. Dynamic Definitions. Restricted Groups. System Services. Registry. File System. ACL Editor. Protection of Child Objects. Inheritable Permissions. Advanced Attributes. Updating the Baseline Template. Summary.

III. LOOKING FORWARD TO WINDOWS 2000.

12. Windows 2000 Overview.

Introduction to the Windows 2000 Infrastructure. The Reality of Client/Server Technology. Client/Server Moves On. Features. Introduction of the Active Directory. Hierarchical Namespace. Object Organization. Replicating the Active Directory. Scalability. A Complete Directory Solution? Do You Use Administrator Account Too Much?

13. Active Directory.

What Is a Directory Service? Directory Terminology. Windows 2000 Active Directory Overview. Centralized Management. Single Unified Directory. Scalability. Domain Structure. Organizational Units (OU). Active Directory Structure. Naming Support. Partitions. MultiMaster Replication. Active Directory Security. Administration. Secondary Logon. Trusted Administrative Applications. Delegation of Administrative Rights and Processes. Windows 2000 Authentication Process. Local Machine Authentication. Application Server Authentication. Domains and Trust Relationships. Inheritance. Transitive Trusts. Advantages of the Directory System. Object Organization. Scalability. Replication. Groups. Granularity of Access Controls. Management Interfaces. Summary.

14. Security Configuration Tool Set.

Building Your Security Management Console. Benefits of Saved Console. New Console Creation. Security Configuration Server service. Security Configuration Editor (SCE). Security Configuration Manager (SCM). Group Policy Editor. Introduction to Security Policies. Security Configuration Editor (SCE). Preinstalled Security Policy Templates. Security Configuration Manager (SCM). Sample Security Implementation: Local Machine. Build a New Template. Implement the New Template. Security Policy Violation and Analysis. Group Policy Editor. Security Configuration Manager: Command Line.

15. Group Policies.

Group Policies. Benefits of Group Policies. Group Policy Categories. Uses of Group Policies. User and Computer Settings. Security Groups. Software Policies. Software Management. Scripting. User File and Folders. Group Policies vs Local Policies. Group Policy Storage. Backward Compatibility. Group Policy Administration Requirements. Group Policy Migration Pattern. Group Policy Implementation. Summary.

16. File Systems.

Distributed File System. Securing Your Data in a DFS. Load Balancing. Disparate File Systems. ACLs. Encrypting File System (EFS) Architecture. NTFS Integration. Low Administrative Overhead. File Encryption, Decryption, and Recovery Mechanisms. File Encryption. Accessing Encrypted Files. File Decryption. File Recovery. File Sharing. Encryption and Decryption Processes. Implementing File and Folder Encryption. Implementing File and Folder Decryption. Copying Encrypted Files and Folders. Backing Up Encrypted Files and Folders. Restoring Encrypted Files and Folders. Encrypted File Recovery Process. Defining Recovery Agents. Adding Recovery Agents. The Future of EFS.

Appendix A: System Policy File Listings.

Common.adm. Winnt.adm.

Appendix B: Proxy Server Logging Information.

Services Logging Information. Server-Oriented Fields. Client-Oriented Fields. Connection-Oriented Fields. Object-Oriented Fields. Packet Filter Logging Information. Service Information Fields. Remote Information Fields. Local Information Fields. Filter Information Fields. Packet Information Fields.

Appendix C:Security Checklist.
Index.

Preface

Preface

System security is a tricky subject to write about. The measurement of what is secure and what isnÕt secure is highly subjective and dependent on many factors. The individual or group view of todayÕs requirements for your organization, assumptions, and any known facts concerning the situation in the future and views on the criticality of your systems are all factors relating to this measurement.

It would be very easy for me to preach about what I think you should do to secure your systems, but without knowledge of your individual environment and needs, it would also be very wrong.

With this book I have approached the subject of security in two ways. First, I have tried to show why you may consider implementing a particular security feature or process. This attempt has been included to prompt the discussions between you and your colleagues that are a necessary part of the design process for the security model. Second, I have included step-by-step guides for implementing the security feature itself. You will be able to use the step-by-step guides to implement the security features and thresholds that are right for your organizational needs, adapting the examples as necessary.

Audience

Windows NT Security targets Systems and Network Administrators, Security Professionals, System Audit Specialists, Compliance Officers, Developers, and anybody who needs to understand Windows NT and Windows 2000 security features.

Concern over data security today means that management focus is moving more than ever toward data and system security. Sadly, this focus and the ensuing demand for performance are not always accompanied by a large budget allowing for add-on tools and specialist consultants who can design your security model and help to implement this design. The responsibility for the design, implementation, and maintenance of the security model falls on the shoulders of the System Administrators or other in-house group of professionals who may not have needed to face this particular challenge before.

The content of this book requires a good administrative knowledge of Windows NT systems and also Windows 2000 systems if you wish to leverage the Windows 2000 content to its fullest potential. Many of the functions and features discussed in this book focus on the system registry as both a source of information and also the place to make changes to move toward the target of securing your systems. For this reason, the reader knowledge level for this book has been set between intermediate and advanced. Readers should be comfortable using the registry editing tools for browsing and amending settings before attempting any of the exercises that include this type of activity.

Organization

Windows NT Security is divided into three parts.

Part One, System Security Overview, is an introduction to security concepts and how these concepts can be mapped to the Windows NT security architecture. This is a good starting point for all readers and will give you grounding in this particular topic. Seasoned Security Professionals who feel comfortable with their own knowledge in this area may still want to cover this part of the book simply as a comparison tool to their own thoughts.

Part Two, Windows NT 4.0 Security Components, looks at the security related components of Windows NT 4.0. This part of the book looks at all of the built-in features of Windows NT and how they can be best leveraged at your own site to meet the needs for security and also give the flexibility required to run a business.

Part Three, Looking Forward to Windows 2000, looks at Windows 2000 and the changes in the security model between Windows NT 4.0 and Windows 2000. This part contains an introduction to the Active Directory and then moves on to look at the security-specific features contained in the new operating system. Encrypting file systems, distributed file systems and the security concerns around this technology, the security configuration tool set, and group policies are discussed in this part of the book.

Each chapter is organized as individual unit. The chapter can be looked at on its own, and because of this organization, the seasoned NT professional can use the book as a reference guide to each topic. The main focus, however, is on building a security model for your organization, and as readers work through the book, the security model can be defined around the concepts and discussions contained in each chapter. Readers will gain the most benefit from this approach to the book.



Updates

Submit Errata

