Planning Server Security

Server Roles Review

The physical hardware and logical components of the network are necessary to provide a number of features for the network, such as connectivity, routing and switching capabilities, network security, and access control. The network infrastructure has to exist before the servers needed to support services and applications which are required by your users can be deployed into your networking environment. While Windows Server 2003 provides a number of features and tools when you install it on a computer, you have to implement additional features and functionality on a server to provide the services and capabilities required by the organization and its users.
With Windows Server 2003 came the introduction of server roles. Server roles group related administrative tasks, and are used to provide a specific capability or function to the network design. With Windows Server 2003, if you configure a server for a certain server role, a number of additional services, features and tools are installed for the server. In this manner, the server is set up to provide the required services to your users. Servers can be configured to perform a number of roles. The applications that the server is running specify the role of the particular server.

A few common server roles are listed below. For Windows Server 2003, there are a number of different server roles that you can configure using the Configure Your Server Wizard of the Manage Your Server utility:

Selecting the Operating System (OS)

For each of the above mentioned different server roles which can be configured in Windows Server 2003, you need to decide on the necessary security configurations which should be utilized for each specific server role. When planning server security, one of the initial elements that you need to ascertain is which Windows operating system (OS) you will utilize in the organization. This is particularly important because each specific operating system offers different security configurations which you can use to implement server security.

The Windows server operating systems are listed below, together with the minimum system requirements for installing each specific operating system. For you to install a particular Windows operating system for a server, the particular server should meet the minimum system requirements of the particular operating system:

As mentioned previously, each Windows server operating system provides different features, and different security configurations which can be enabled to enhance server security and network security. Therefore, before deciding on the operating system to utilize, you have to know which server system functionality and security features are required for your network design, as determined by the organization's requirements. Each Windows server system version that was introduced is accompanied by new features and additional security enhancements. This concept is illustrated in the remainder of this Section of the Article.

The editions of Windows 2000 have been designed for increased system reliability and availability, and scalability.

Windows 2000 Server supports enhanced TCP/IP networking services such as Dynamic DNS (DDNS), Dynamic Host Configuration Protocol (DHCP), Automatic Private IP Addressing (APIPA), and Windows Internet Name Service (WINS) for backward support in mixed mode environments. Windows 2000 Server also provides Internet Information Services (IIS), Distributed File System (DFS), Routing and Remote Access for policy based management of remote access servers, the Terminal Services feature, Removable Storage for managing removable media, Services for Macintosh, Gateway Services for NetWare, and Services for Unix for interoperability in a heterogeneous network environment. Windows 2000 also supports Open Database Connectivity (ODBC) software, Message Queuing Services, and Component Object Model (COM+). This makes it possible for new applications to interoperate with existing software and data. Windows 2000 includes new printers, modem and hardware drivers which further simplifies hardware installation, and makes it more effective. Windows 2000 includes support for USB, IEEE 1394, and Advanced Configuration Power Interface (ACPI) device configuration and power management. Windows 2000 can support device types that are cumbersome to use in Windows NT, and includes a bidirectional parallel port driver that enables communication with many more devices. Windows 2000 includes the Plug and Play (PnP) feature. Windows 2000 supports the Win32 Driver Model (WDM) and the device driver signing feature. Lastly, Windows 2000 provides the NTFS version 5 features and security enhancements.

The Kerberos authentication protocol is the default authentication protocol used for Windows 2000, Windows XP Professional, and Windows Server 2003. Kerberos authentication was initially introduced in Windows 2000. Kerberos utilizes mutual authentication to verify the following:

Kerberos authentication offers improved security over the NTLM authentication protocol, including the following

Kerberos version 5 makes use of a 'ticket' strategy to authenticate valid network users, and provides mutual authentication between users and resources. The Kerberos authentication type is dependant on the Key Distribution Center (KDC) to issue tickets. Each network client makes use of DNS to find the closest available KDC to obtain a Kerberos ticket. The ticket usually remains active for about 8 or 10 hours. The Key Distribution Center (KDC) is a service which runs as a component of Active Directory. The Key Distribution Center (KDC) manages the database of security account information for each security principal within a domain. The KDC holds the cryptographic key which is only known by the particular security principal, and the KDC. This cryptographic key, also called a long term key, is formed from the logon password of the user, and is used when the KDC and the security principal interact. Because each domain controller in Windows Server 2003 domains operates as a KDC, fault tolerance is enabled for the domain.

Windows Server 2003 supports the NTLM authentication protocol to provide compatibility for the earlier operating systems (OSs) such as for Windows NT 4 compatibility. Secure Sockets Layer/Transport Security Layer (SSL/TLS) and digest authentication is typically used for Web applications. SSL/TLS is based on X.509 public-key certificates and enables mutual authentication between the client and server.

The Windows 2000 operating system also included support for smart cards. Smart card authentication is based on the use of smart cards and is supported in Windows 2000 and Windows Server 2003. A smart card is a security device or credit card sized hardware token which can be used to provide additional protection to applications and security protocols.

Smart cards provide the following features:

In network environments, smart cards are typically used for following purposes

Active Directory is in actual fact the most important feature introduced in Windows 2000 because it brings about a few important domain structural changes. Domains in Active Directory use the DNS domain naming structure, and not the NetBIOS naming structure used in Windows NT domains. Because of DNS, Active Directory domains are structured in a hierarchical model. Domain trees is the concept used to describe hierarchically structured groups of domains with a contiguous namespace, while the grouping of trees with a noncontiguous namespaces are called forests. You can define trust relationships among forests to facilitate communication.

With the release of Microsoft Windows Server 2003 quite a few enhancements and features were introduced that were not previously available in Windows 2000 Active Directory. These enhancements were aimed at improving the scalability, efficiency, speed and performance of Active Directory, and addressed a few deficiencies or shortcomings of the earlier version of Active Directory utilized in Windows 2000 Server. When a domain controller running Windows Server 2003 is created, a number of Active Directory basic features are immediately installed and available to the Windows Server 2003 domain controller. Certain other Active Directory features are only available when particular conditions exist in the network.

Additional Active Directory features can be enabled but is dependant on the following conditions, or factors:

Domain and forest functional levels provides the means by which you can enable additional domain-wide and forest-wide Active Directory features, remove outdated backward compatibility within your environment, and improve Active Directory performance and security.

The domain functional levels that can be set for Active Directory in Windows Server 2003 are listed below. The Windows 2000 Mixed and Windows Native domain functional levels were available in Windows 2000 to enable backward compatibility to operating systems such as Windows NT 4.0. The latter two functional levels are only available with Windows Server 2003.

The forest functional levels that can be set for Active Directory in Windows Server 2003 listed below.

How to check which domain function level is set for the domain

  1. Open the Active Directory Domains And Trusts console.
  2. Right-click the particular domain whose functional level you want verify, and select Raise Domain Functional Level from the shortcut menu.
  3. The Raise Domain Functional Level dialog box opens.
  4. You can view the existing domain functional level for the domain in Current domain functional level.

How to raise the domain functional level to the Windows 2000 native domain functional level or Windows Server 2003 domain functional level

Before you can raise the domain functional level to Windows Server 2003 domain functional level, each domain controller in the domain has to running Windows Server 2003.

To raise the domain functional level for a domain,

  1. Open the Active Directory Domains And Trusts console
  2. Right-click the particular domain whose functional level you want to raise, and select Raise Domain Functional Level from the shortcut menu.
  3. The Raise Domain Functional Level dialog box opens.
  4. Use the Select An Available Domain Functional Level list to choose the domain functional level for the domain.
  5. Click Raise.
  6. Click OK.

How to check which forest functional level is set for the forest

  1. Open the Active Directory Domains And Trusts console
  2. Right-click Active Directory Domains and Trusts in the console tree, and select Raise Forest Functional Level from the shortcut menu.
  3. The Raise Forest Functional Level dialog box opens
  4. You can view the existing forest functional level for in Current forest functional level.

How to raise the forest functional level to Windows Server 2003 forest functional level

Each domain controller in the forest has to be running Windows Server 2003 before you can change the forest functional level to Windows Server 2003. When you raise the forest functional level, all domains in the forest will automatically have their domain functional level raised to Windows Server 2003.

To raise the forest functional level for a forest,

  1. Open the Active Directory Domains And Trusts console
  2. Right-click Active Directory Domains And Trusts in the console tree, and select Raise forest Functional Level from the shortcut menu.
  3. The Raise Domain Functional Level dialog box opens
  4. Click Raise.
  5. Click OK.

Understanding the Security Features of Firewalls

The method, by which you can physically secure the network, is through the usage of firewalls. While firewalls provide some level of physical security, you should bear in mind that firewalls are just barriers which make it difficult for intruders to attack the network.

Firewalls are categorized as follows:

Firewalls work by checking packets to determine whether packets should be permitted to be forwarded, or whether packets should be dropped. The main function of the firewall is to filter traffic. TCP/IP packets have an IP packet header, followed by the actual content of the packet. The IP packet header is either a TCP header or a UDP header. The TCP header or UDP header contains the IP addresses and port number of the sender (source), and the IP addresses and port numbers of the receiver (destination). A TCP header contains the following additional information as well: Sequence numbers and acknowledgment numbers, and conversation state.

As packets pass over the firewall, packets are examined according to the filtering parameters configured for the firewall to filter traffic on. The filtering parameters define which packets should be allowed to pass over the firewall. The default configuration is that firewalls typically deny all packets other than those which it has been explicitly set up to allow. In networking environments, firewalls are usually configured to block all incoming traffic, and to allow outbound traffic from the private internal network.

Packet filters are used to define the traffic types that should be denied by a firewall. You need to implement firewalls and router packet filters to secure the resources within your private network from Internet users.

When you configure IP packet filters, you can specify what traffic is allowed or denied, based on the following:

IP packet filters should be used for the purposes:

Advanced firewalls include a number of additional security features, including:

Understanding Perimeter Networks

The main role of a perimeter network, also called demilitarized zone (DMZ), is to provide an additional layer of protection for the internal private network when a server on the perimeter network is compromised. The perimeter network typically hosts Web services that are extended to Internet clients.

A perimeter network usually consists of the following elements:

A perimeter network is either a single firewall configuration, or back to back firewall configuration:

Web Content servers and front end servers usually reside in the perimeter network. A perimeter network can be further segmented:

Understanding Windows Server 2003 Security Settings

Auditing enables you to determine which activities are occurring on your system. Through auditing, administrators can collect information associated with resource access and usage on your system. You can audit system logon, file access, object access, as well as any configuration changes. When an event or action takes place that is configured for auditing, the action or event is written to the security log. Security auditing events are written to the security log of the system, and can be accessed from Event Viewer.

The main types of events which you should audit are listed below:

You can define audit polices for the local computer, a domain controller, a domain or an organization unit (OU).

The audit policies that you can configure with Windows Server 2003 are listed here:

For each of the above mentioned event categories, you can choose between three values when you enable auditing. These values in turn determine the condition for which an audit entry would be created:

An important management tool for administrators of Windows Server 2003 is the Event Log. Event Viewer stores events that are logged in a system log, application log, and security log. You can access Event Viewer from the Administrative Tools folder.

The maximum size of the Event Log, Event Log performance, and other attributes are controlled by the following Event Log policies:

You can enable the Security Options policies to secure certain server components from a number of threats and accidents. Through Security Options policies, you can secure specific server components. A few Security Options policies which you should consider activating are listed below:

Services can be defined as system programs, processes or routines running in the background that performs a specific operation within the operating system. Administrators need to monitor services and also change the configuration of services when necessary. When the Windows Server 2003 operating system installs, some services are automatically installed with the operating system. These services are usually set with the Automatic startup type. This means that the service starts automatically when the operating system starts or boots. The startup type specified for the service controls when and how the service starts.
A few services that have the Automatic startup type configured are Automatic Updates, DHCP Client, DNS Client, IPSec Services, Remote Procedure Call (RPC), Server, Security Accounts Manager, and System Event Notification.

For those services that have the Automatic startup type configured, you can use System Services policies to disable those services which a specific server does not require. A few services for which you can configure the startup type as Disabled (if the server does not require the service) are Application Management, Distributed File System, Distributed Transaction Coordinator, Fax Service, ClipBook, Indexing Service, Internet Connection Sharing (ICS), and Smart Card.

Restricted Groups contains groups for specific security restrictions. You can configure Restricted Groups to ensure that group memberships remain defined as it was specified. Restricted Groups policies ensure that the Members attributes and Members Of attributes remain consistent. You configure Restricted Groups policies by adding a policy and then specifying the members of the policy.

Account Policies include attributes for password policy, account lockout policy and Kerberos policy. Password policy determines settings for passwords for domain user accounts, and local user accounts. You can implement strong password policies by using the following security policy settings located in the Password Policy node in Account Policies:

Account lockout policies should be implemented if your environment is particularly vulnerable to threats arising from passwords which are being guessed. Implementing an account lockout policy basically ensures that the account of a user is locked after an individual has unsuccessfully tried for several times to provide the correct password. The important factor to remember when defining an account lockout policy is that you should implement a policy that permits some degree of user error, but that also prevents unauthorized usage of your user accounts.

The following password and account lockout settings are located in the Account Lockout Policy area in Account Policies:

How to Plan a Security Framework

A security framework can be defined as the process used when the organization has to perform the activities listed below:

Most organizations use a security design committee or team to determine the security needs of the organization and to deploy security policies which can meet these requirements.

A security design committee/team includes individuals that are knowledgeable on the following factors:

A typical security life cycle is made up of the following steps:

Because the security requirements of organizations differ, you have to determine which security features, tools and policies are needed by the specific organization whose server security you are planning. From the discussions so far, it becomes evident that identifying the security requirements of the organization is a task requiring quite some analysis. One of the initial steps to identifying the security requirements of the organization is to determine which security weaknesses or vulnerabilities currently exist, the threats to which the mission critical resources of the organization is exposed, and the resources which are mainly at risk to being compromised.

There are a number of different risks that have an impact on an organization. Some of the primary threats which you should address are listed here:

Once the risk which your organization is vulnerable to is determined, you have to determine which resources and assets of the company could become affected by each identified risk/threat.

Assets and company resources can be categorized as follows:

To secure company assets and resources from all identified security risks, you have to determine which security configurations can match the security requirements of the organization.



Top 5 Free Networking Tools

Bookmark Planning Server Security

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.