Windows Server 2008 Security Enhancements
5 likes1,111 views
This document summarizes security enhancements in Windows Server including: - Improved identity and access control through Active Directory Federation Services, smart card authentication, and granular password policies. - Increased compliance through BitLocker drive encryption, Rights Management Services, and improved auditing. - Stronger security fundamentals through techniques like the Security Development Lifecycle, server hardening, and Next Generation Cryptography. - Enhanced threat mitigation with features like Network Access Protection, read-only domain controllers, and next generation firewalls.
Windows Server 2008 Security Enhancements
- 1. Security EnhancementNarendaWicaksonoIT Pro Advisor, Microsoft Indonesia
- 2. AgendaSecurity FundamentalsThreat and Vulnerability MitigationIdentity and Access ControlCompliance EnhancementsTechnology CoverageRead Only Domain Controller, Bit Locker, Service Hardening, Server Core, Device Installation, Next Gen firewall, NAP and Terminal Services/RDP changes, Rights management, … and more
- 3. SECURITY: FUNDAMENTALSTHREAT & VULNERABILITY MITIGATIONNetwork Access ProtectionRead-Only Domain ControllerEnhanced AuditingServer and Domain IsolationSecurity Development LifecycleWindows Service HardeningNext Generation CryptoPKI EnhancementsIDENTITY &ACCESS CONTROLCOMPLIANCE ENHANCEMENTSBitLocker™ Drive EncryptionEFS SmartcardsRights Management ServerRemovable Device ControlActive Directory Federation ServicesPlug and Play SmartcardsGranular AuditingGranular Password Control Security and Compliance
- 5. Security Development LifecycleMandated development process for Windows Server and Windows Vista Periodic mandatory security trainingAssignment of security advisors for all components Threat modeling as part of design phaseSecurity reviews and testing built into the scheduleSecurity metrics for product teamsCommon Criteria (CC) Certification
- 6. Windows Service HardeningDefense-in-Depth / FactoringDDDDDDDDReduce size ofhigh risk layersSegment theservicesIncrease # of layersService 1Service …Service 2Service…Service AService 3Service BKernel DriversUser-mode Drivers
- 7. Server CoreMinimal installation optionLow surface areaCommand line interfaceLimited set of server rolesSERVER, SERVER ROLES (for example only)TSIASWebServerSharePointEtc…SERVERWith WinFx, Shell, Tools, etc.SERVER CORE SERVER ROLESDNSDHCPFileADWVIISSERVER CORESecurity, TCP/IP, File Systems, RPC,plus other Core Server Sub-SystemsGUI, CLR, Shell, IE, Media, OE, etc.
- 8. Windows Server 2008 Services
- 9. Cryptography Next Generation (CNG) Cryptography Next GenerationIncludes algorithms for encryption, digital signatures, key exchange, and hashingSupports cryptography in kernel modeSupports the current set of CryptoAPI 1.0 algorithmsSupport for elliptic curve cryptography (ECC) algorithmsPerform basic cryptographic operations, such as creating hashes and encrypting and decrypting data
- 10. PKI EnhancementsOnline Certificate Status Protocol (OSCP)Enterprise PKI (PKIView)Network Device Enrollment Service and Simple Certificate Enrollment ProtocolWeb Enrollment
- 11. Windows Server FirewallMore ControlCombined firewall and IPsec management
- 12. Windows Server FirewallMore ControlFirewall rules become more intelligent
- 13. Windows Server FirewallMore ControlFirewall rules become more intelligent
- 14. Windows Server FirewallMore ControlFirewall rules become more intelligent
- 15. Windows Server FirewallMore ControlPolicy-based networking
- 16. Enhancing and Simplifying IPsec
- 17. Threat and Vulnerability Mitigation
- 18. Servers with Sensitive DataServer IsolationHR WorkstationManaged ComputerDomain IsolationDomain IsolationManaged ComputerActive Directory Domain ControllerCorporate NetworkTrusted Resource ServerXUnmanaged/Rogue ComputerXUntrustedServer and Domain Isolation
- 19. POLICY SERVERSe.g. MSFT Security Center, SMS, Antigenor 3rd party Fix UpServerse.g. MSFT WSUS, SMS & 3rd partyRestrictedNetworkCORPORATE NETWORKNetwork Access ProtectionWindows Server 20083Not policy compliant124MSFTNetworkPolicy Server WindowsVista ClientPolicy compliantDHCP, VPNSwitch/Router5Enhanced SecurityAll communications are authenticated, authorized & healthyDefense-in-depth on your terms with DHCP, VPN, IPsec, 802.1XPolicy-based access that IT Pros can set and controlBENEFITSIncreased Business ValuePreserves user productivity Extends existing investments in Microsoft and 3rd party infrastructure Broad industry partnership
- 20. Read-Only Domain ControllerRead-Only Copy of AD DatabaseCan Hold all Directory Objects & AttributesMaintains Read-Only Copy of DNS ZonesHUB Writeable DC Secure LocationUnidirectional ReplicationNo Local Changes – Pull from Upstream OnlyControlled Replication - Limits Bandwidth UseCredential HandlingCan Cache User Passwords (Explicitly Set)Admin Knowledge of Accounts if CompromisedRODC May Only Issue Local Auth TicketsBranchAdministrative Role SeparationManagement Delegated to Local UserNo Enterprise or Domain DC Membership Read-Only DC Read-Only DNS One-way Replication Credential Cache Local Admin Role
- 21. How RODC WorksAS_Req sent to RODC (request for TGT)12RODC: Looks in DB: "I don't have the users secrets"3HubBranchForwards Request to Windows Server "Longhorn" DC37Windows Server "Longhorn" DCRead Only DCWindows Server "Longhorn" DC authenticates request4425Returns authentication response and TGT back to the RODC51RODC gives TGT to User and RODC will cache credentials66At this point the user will have a hub signed TGT7
- 22. Read-only DC Mitigates Stolen DCAttacker Perspective
- 23. Read-only DC Mitigates Stolen DCHub Admin Perspective
- 24. Improved AuditingMore GranularitySupport for many auditing subcategories: Logon, logoff, file system access, registry access, use of administrative privilege, Active DirectoryCaptures the Who, the What, & the WhenFrom and To Values for Objects or AttributesLogs All – Creates, Modifies, Moves, DeletesNew Logging InfrastructureEasier to filter out “noise” in logsTasks tied to events: When an event occurs tasks such as sending an Email to an auditor can run automatically
- 25. Identity and Access Control
- 26. Active Directory Federation ServicesFull implementation of a ‘claims-based’ architecture based on WS-FederationFully integrated with Active DirectorySupports group, role and rules-based modelsPartner Value AddBMC, Centrify & Quest: Multi-platform supportBusiness BenefitsEnables new models for cross-company single sign-on systems Facilitates single-sign across Windows and non-Windows environmentsReduces the risk of unauthorized access by eliminating the need for cross-company synchronization of user and rights information
- 27. Authentication ImprovementsPlug and Play Smart CardsDrivers and Certificate Service Provider (CSP) includedLogin and credential prompts for User Account Control all support Smart CardsNew logon architectureGINA (the old Windows logon model) is gone Third parties can add biometrics, one-time password tokens, and other authentication methods with much less coding
- 28. Granular Policy ControlAllows to set Password Policies on Users and/or Groups (different from the domain‘s Password Policies)Big Win for Customers:Requirements for different Password Policies do not result in deploying multiple domains anymoreNew Object-Type in Active Directory, the Password Settings ObjectPassword Settings are configured using those Objects in the Password Settings Container
- 30. AD Rights Management ServicesAD RMS protects access to an organization’s digital filesAD RMS in Windows Server "Longhorn" includes several new featuresImproved installation and administration experienceSelf-enrollment of the AD RMS clusterIntegration with AD FSNew AD RMS administrative rolesSQL ServerActive DirectoryRMS Server132Information AuthorThe Recipient
- 31. BitLocker™ Drive Encryption Full Volume Encryption Key (FVEK)Encryption Policy Group Policy allows central encryption policy and provides Branch Office protectionProvides data protection, even when the system is in unauthorized hands or is running a different or exploiting Operating SystemUses a v1.2 TPM or USB flash drive for key storage
- 32. Information ProtectionWho are you protecting against?Other users or administrators on the machine? EFSUnauthorized users with physical access? BitLocker™Some cases can result in overlap. (e.g. Multi-user roaming laptops with untrusted network admins)
- 33. Removable Device Installation ControlBenefits:Reduced Support CostsReduced Risk of Data TheftScenarios:Prevent installation of all devicesAllow installation of only allowed devicesPrevent installation of only prohibited devices
- 34. Learning curriculumHands on labSample codesVideosSlidesE-CertificationOnline Assessment
- 35. eBooks in Bahasa
- 38. © 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.