About the Authors About the Technical Editor

Transcription

1 Acknowledgments p. xiii About the Authors p. xv About the Technical Editor p. xix Foreword p. xxi Planning Platform Security p. 1 Reviewing the Gore Security Principles p. 2 Planning a Secure Platform from End to Edge and Beyond p. 4 Understanding Business Requirements p. 5 Perform Risk Analysis p. 6 Review Policies, Procedures, Standards, and Guidelines p. 7 Security Awareness Training p. 7 Determine Access Control p. 8 Secure Software Development Strategy p. 9 Network Security p. 9 Operating System Security p. 10 From End to Edge and Beyond Chapter Previews p. 11 Planning Platform Security p. 11 Planning Server Role in Windows 8 p. 12 Deploying Directory Services and Certificate Services p. 12 Deploying AD FS and AD RMS in Windows Server 2012 p. 13 Patch Management with Windows Server 2012 p. 14 Virtualization Security p. 14 Controlling Access to Your Environment with Authentication and Authorization p. 16 Endpoint Security p. 17 Secure Client Deployment with Trusted Boot and BitLocker p. 17 Mitigating Application's Vulnerabilities p. 18 Mitigating Network Vulnerabilities p. 18 Unified Remote Access and BranchCache p. 19 DirectAccess Deployment Scenarios p. 19 Protecting Legacy Remote Clients p. 20 Cloud Security p. 20 Summary p. 20 Planning Server Role in Windows Server 2012 p. 21 Server Role and Security Considerations p. 21 Using Security Configuration Wizard to Harden the Server p. 22 Using Server Manager to Add a New Role or Feature p. 36 Using Security Compliance Manager to Hardening Servers p. 43 Planning Before Hardening Your Server with SCM p. 46 Staying Up to Date with SCM p. 47 Administrator's Punch List p. 48 Summary p. 48

2 Deploying Directory Services and Certificate Services p. 49 Evolving Threats Against Certificates p. 50 Implementing Directory Services on Windows Server 2012 p. 51 Installing the Active Directory Domain Services Role p. 54 Creating a New Forest with the Windows Server 2012 Server Manager p. 56 Implementing Certificate Services on Windows Server 2012 p. 70 Planning AD CS Implementation p. 71 Installing AD CS Role p. 75 Installing AD CS Using Server Manager p. 77 Site-Aware Certificate Enrollment p. 85 Configuring CA Site p. 86 Renew with the Same Key p. 86 Validate Your Knowledge in AD CS p. 89 Administrator's Punch List p. 89 Summary p. 89 Deploying AD FS and AD RMS in Windows Server 2012 p. 91 Planning for Active Directory Federation Services p. 91 Deploying Active Directory Federation Services p. 96 Installing AD FS Role Service Using PowerShell p. 97 Installing and Deploying AD FS Using Server Manager p. 98 Troubleshooting Active Directory Federation Services p. 107 Active Directory Rights Management Services p. 110 General Considerations When Planning to Deploy AD RMS p. 111 Installing and Deploying Active Directory Rights Management Services p. 113 Validate Your Knowledge in AD RMS p. 119 Summary p. 119 Patch Management with Windows Server 2012 p. 121 Why Should You Have a Patch Management Strategy in Place? p. 121 Planning WSUS Deployment on Windows Server 2012 p. 122 Planning WSUS on Windows Server 2012 p. 124 Deploying WSUS p. 129 Managing Updates with WSUS p. 135 Configure Synchronization p. 135 Configure Target Group p. 136 Review and Approve Updates p. 138 Using Group Policy to Configure WSUS p. 140 Validating the Configuration p. 144 Administrator's Punch List p. 147 Summary p. 148 Virtualization Security p. 149 Considerations Regarding Virtualization Security in Microsoft Platform p. 150

3 Understanding and Deploying Windows Server 2012 Hyper-V Security Capabilities p. 152 ARP Poisoning/Spoofing Protection p. 152 DHCP Guard Protection p. 154 Port ACLs p. 155 Network Traffic Monitoring p. 158 Isolated Private VLAN (PVLAN) p. 163 High Availability for Virtualization Security p. 164 Beyond the Hypervisor p. 174 Scenario: Virtualization Security Considerations for a Cloud Infrastructure p. 175 Private Cloud Security p. 177 Administrator's Punch List p. 185 Summary p. 185 Controlling Access to Your Environment with Authentication and Authorization p. 187 Planning Authentication, Authorization, and Access Control p. 188 Data Classification p. 188 Data Control p. 188 Auditing p. 188 Understanding Dynamic Access Control p. 189 DAC Requirements p. 189 Planning for DAC p. 191 Planning Authentication p. 191 KDC Proxy p. 191 Resource-Based Constrained Delegation p. 192 Picture Password p. 194 Setting Up Picture Password p. 196 Logging on with Picture Password p. 197 Picture Password Management Issues p. 199 Configuring Dynamic Access Control p. 200 Summary p. 210 Endpoint Security p. 211 Considerations Regarding Endpoint Security p. 212 Planning Endpoint Security p. 212 Windows 8 Security Enhancements p. 214 Windows Defender p. 215 Windows SmartScreen p. 229 Action Center p. 234 Encrypting File System p. 235 Administrator's Punch List p. 237 Summary p. 237 Secure Client Deployment with Trusted Boot and BitLocker p. 239 Security Considerations for Mobile Users p. 240

4 Data Breaches: A Growing Problem p. 240 Consequences of a Data Breach p. 242 Protecting Against Data Breaches p. 243 Understanding the Trusted Boot Process p. 243 How UEFI Enables Secure Boot p. 244 Windows 8 and UEFI p. 245 Windows 8 Boot Hardening Features p. 246 Understanding BitLocker Full Volume Encryption p. 248 FVE vs. File/Folder Encryption p. 249 How BitLocker Works Together with Other Technologies to Protect Mobile Users p. 249 How BitLocker Works p. 250 Deploying BitLocker p. 252 Troubleshooting, Recovery, and Repair p. 265 Summary p. 265 Mitigating Application's Vulnerabilities p. 267 Living in the World of Apps p. 267 Windows App Store Security p. 268 Browser Protection p. 270 A Sandbox Called AppContainer p. 270 SmartScreen p. 272 The Old Friends Are Still Here: UAC and AppLocker p. 276 Harderiing Application Environment p. 278 Extra Tools p. 285 SDL Threat Modeling Tool p. 285 Attack Surface Analyzer p. 287 Enhanced Mitigation Experience Toolkit p. 288 Security Tools Community Edition p. 288 Summary p. 288 Mitigating Network Vulnerabilities p. 289 Understanding Windows Firewall with Advanced Security p. 290 Evolution of the Windows Firewall p. 291 Deploying and Managing the Windows Firewall with Advanced Security p. 294 What Is New in Windows 8 and Windows Server 2012 p. 294 Configuring the Windows Firewall with Advanced Security p. 295 Controlling the Windows Firewall Through Group Policy p. 309 Managing the Windows Firewall with PowerShell and Netsh p. 318 Troubleshooting the Windows Firewall with Advanced Security p. 320 Protecting the Windows Endpoint with IPsec Rules p. 324 Configuring IPsec Rules on Windows Firewall with Advanced Security p. 325 Common Deployment Scenarios p. 330 Host Firewall with Network Location Awareness p. 330

5 Server and Domain Isolation with Windows Firewall and IPsec p. 331 Using SMB Encryption to Protect Data Traversing the Network p. 331 Enabling SMB Encryption p. 332 Under the Hood p. 338 Summary p. 339 Unified Remote Access and BranchCache p. 341 The Evolving Remote Access Landscape p. 342 New Capabilities in DirectAccess p. 349 DirectAccess and RRAS Better Together p. 349 Simplified DirectAccess Management p. 350 Deploy DirectAccess Without a PKI p. 350 Say Goodbye to IPv6 and Hello to IPv4 p. 351 Put the DirectAccess Server Behind Your Firewall p. 353 Real High Availability p. 354 Multiple Domains Made Easy p. 354 NAP Integration p. 355 One-Time Password Support p. 355 Split Tunnel or Forced Tunneling? It Is Your Choice p. 356 Improved IP-HTTPS Performance and Authentication Support p. 357 Force Manage Out Only p. 357 DirectAccess at Multiple Sites p. 358 Support for Server Core p. 359 DirectAccess Remote Domain Offline Join p. 359 DirectAccess and Windows To Go p. 360 DirectAccess Reqmrements and Planning p. 361 What is BranchCache? p. 362 Overview of BranchCache Deployment p. 364 Content Server Configuration p. 365 Hosted Cache Server Configuration p. 375 Preloading the Hosted Cache Servers p. 376 Configure the Clients p. 377 Administrator's Punch List p. 379 Summary p. 380 DirectAccess Deployment Scenarios p. 381 The Simplified DirectAccess Server Test Lab p. 384 Create a Security Group for DirectAccess Clients on DC1 p. 387 Install the Unified Remote Access Server Role on EDGE1 p. 389 Run the Getting Started Wizard on EDGE1 p. 391 Setup and Test Client1 for DirectAccess Connectivity p. 408 Overview of Traditional DirectAccess Single Server Deployment p. 419 Administrator's Punch List p. 436

6 Summary p. 437 Protecting Legacy Remote Clients p. 439 Virtual Private Networking with Windows Server 2012 p. 440 Brief History of Windows VPN Protocols p. 440 The RRAS Unified Server Role p. 444 Deploying a VPN Server on Windows Server 2012 via the GUI p. 445 Installing Remote Access Services on Windows Server 2012 via PowerShell p. 475 Deploying Network Access Protection (NAP) Through Network Policy and Access Servicesp. 476 NAP Overview p. 477 Deploying NAP on Windows Server 2012 p. 479 Summary p. 489 Cloud Security p. 491 General Considerations for Cloud Security (SaaS) p. 491 Cloud Security Readiness Tool p. 494 General Considerations for Cloud Security (IaaS) p. 497 Network Security p. 497 Compute Security p. 504 Guest Compute Security p. 504 Host Compute Security p. 505 Building a Private Cloud with Windows Server 2012 p. 506 Summary p. 510 Index p. 511 Table of Contents provided by Blackwell's Book Services and R.R. Bowker. Used with permission.