ºÝºÝߣ

Editor's Notes

• #11: Most information security systems follow three basic security principles: confidentiality, integrity, and availability. Confidentiality refers to limiting information access and disclosure to authorized users. For server systems, you can implement confidentiality by various measures, including authentication mechanisms, system hardening techniques, encryption, and access control lists. Integrity refers to the fact that information has not been changed, that it is the original information. This includes data integrity. For server systems, this means ensuring that data cannot be modified by malicious users. For example, you can implement integrity on computers running Windows 2000 Server and Windows Server 2003 by using NTFS permissions and digital signatures using Encrypting File System. Availability refers to the provision of ready access to information resources. It is crucial that people and other systems within an organization always have access to server-based business systems and data.
• #28: A security strategy for an organization is most effective when data is protected by more than one layer of security. A defense-in-depth security strategy uses multiple layers of defense so that if one layer is compromised, it does not necessarily follow that your entire organization will be compromised. A defense-in-depth strategy increases an attacker’s risk of detection and reduces an attacker’s chance of success. To minimize the possibility of a successful attack against your organization’s servers, you need to implement the appropriate level of defense at each layer. There are many ways to protect each individual layer by using tools, technologies, policies, and best practices. For example: Policies, procedures, and awareness layer – Security education programs for users Physical security layer – Security guards, locks, and tracking devices Perimeter layer – Hardware and/or software firewalls, and virtual private networks with quarantine procedures Internal network layer – Network segmentation, IP Security (IPSec), and network intrusion detection systems Host layer – Server and client hardening practices, patch management tools, strong authentication methods, and host-based intrusion detection systems Application layer – Application hardening practices and antivirus software Data layer – Access control lists and encryption This session focuses on securing your Windows-based servers. Security methods and practices discussed in this session relate primarily to the application, host, and internal Network layers. However, it is important to keep in mind that server security should form only part of the overall security strategy of your organization.