http___microsoftguru.com.au_hr_tag_tmg__1.xml
1.1 2.1 2.2 2.3 2.4 2.5 3.1 4.1 4.2 4.3 4.4 4.5 4.6 5.1 6.1 6.2 6.3 7.1 8.1 8.2 8.3 8.4 8.5 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1 27.1 28.1 28.2 28.3
Hardening Security of Server- The Bottom Line Securing Servers from internal and external threat is the key aspect of managing and administering Windows Servers. If you carefully design, implement and maintain IT Infrastructure you will have a better night sleep knowing you are safe. There will not be music in the ears of oncall Engineer facing nightmare. So how you accomplish a tight security and control on IT infrastructure without compromising work environment. Here are some tips for you. Infrastructure Firewalls You must have an isolated Head Office network from branch office. You can purchase MPLS or IP WAN service from your ISP. Alternatively you can create site to site VPN using security appliance or application like Forefront TMG 2010. A better design approach would be a multi-tier firewall so that your internal server, DMZ servers and branch servers stay securely connected. You can have specific VLANs for specific servers/services/applications with correct Access Control List (ACL) in Cisco switches and routers. This will add another layer of firewall to the network. Computer based Firewalls In Windows Server 2008 and Windows Server 2012, there is built in firewall. You can configure that built-in firewall for a group of servers or individual server to provide host based firewall. Both Server 2008 and Server 2012 shipped with advanced Firewall and security configuration tools which you can administer through Group Policy object. Intrusion Detection System Another key aspect of firewall is security appliance that provide you to harden security using Intrusion Detection System (IDS) /Intrusion Protection System (IPS). These are third-party Devices or appliance. The IDS helps you monitor network traffic, logs data about the traffic, analyses the traffic based on signatures and anomalies, recognizes potential attacks, and alerts the IT staff to the perceived attack. The IPS does all that, but it also has the capability to react to the perceived attack. IPS is also capable of reacting to an attack based on your configured rules. Server Hardening- The bottom line You execute the following action to stop being hacked or take these actions to prevent hacking - Isolate Administrator Role for individual tasks similar to their job description. - Stopping and disabling all unnecessary services and applications - Renaming the Administrator account - Implement password policy using Default Domain Policy in Group Policy Object - Implement GPO to secure servers and clients - Deleting or disabling all unnecessary user accounts - Use of Service Account to run services and application instead of running services using IT Admin’s generic account and store password to safe location - Create Role Based User Account instead of using user account by user name - Requiring strong authentication and certificates to access applications - Performing regular firmware, operating system and application updates using WSUS or SCCM - Installing renowned Antivirus and Anti-Spyware program and manage them centrally - Document all system configurations and store these documents in safe location - Audit and monitor IT infrastructure regularly to prevent any misconfiguration - Use Read only Domain Controller (RODC) for branch office - Utilize great benefit of Server Core Technology reducing surface attack further - Utilize NPS, NAP and Certificate Servers to secure access to applications and services. MCP Web Site Crashed! I am shocked to the see this on Microsoft Web Site! Any clues! I am speechless!
1.1 2.1 2.2 2.3 2.4 2.5 3.1 4.1 4.2 4.3 4.4 4.5 4.6 5.1 6.1 6.2 6.3 7.1 8.1 8.2 8.3 8.4 8.5 9.1 10.1 11.1 12.1 13.1 14.1 15.1 16.1 17.1 18.1 19.1 20.1 21.1 22.1 23.1 24.1 25.1 26.1
Kaljenje Sigurnost Server-The Bottom Line Osiguranje poslužitelje iz unutarnje i vanjske prijetnje je ključni aspekt upravljanja i vođenja Windows poslužiteljima. Ako pažljivo dizajniranje, implementaciju i održavanje IT infrastrukture ćete imati bolji noćni san znajući da su na sigurnom. Tu neće biti glazba u ušima oncall inženjer prema moru. Pa kako ste ostvarili čvrstu sigurnost i kontrolu na IT infrastrukturu bez ugrožavanja radno okruženje. Evo nekoliko savjeta za vas. Infrastrukturni Firewall Morate imati izoliranu mrežu glavom s poslovnici Office. Možete kupiti MPLS ili IP WAN uslugu od ISP-a. Alternativno, možete kreirati stranice na web VPN pomoću sigurnosnog aparata ili primjenu kao Forefront TMG 2010. Bolji pristup dizajn će biti multi-tier firewall, tako da je vaše unutarnje poslužitelj, DMZ poslužitelji i područne poslužitelji ostati čvrsto povezani. Možete imati određene VLAN za određene poslužitelje / Usluge / aplikacije s ispravnom Popis Access Control (ACL) u Cisco preklopnici i usmjerivači. To će dodati još jedan sloj firewall na mrežu. Računalne firewalli U sustavu Windows Server 2008 i Windows Server 2012, tu je izgrađen u firewall. Možete konfigurirati da izgrađen-in firewall za skupinu poslužitelja ili individualne poslužitelj osigurati domaćin based firewall. Oba Server 2008 i Server 2012 isporučen s naprednim Firewall i sigurnosne konfiguracije alata koje možete upravljaju kroz Group Policy objekta. Intrusion Detection System Drugi ključni aspekt firewall je sigurnosna uređaj koji Vam kako biste poboljšali sigurnost pomoću Intrusion Detection System (IDS) / upada sustav zaštite (IPS). To su third-party Uređaji ili aparata. IDS vam pomaže da praćenje mrežnog prometa, bilježi podatke o prometu, analizira promet na temelju potpisa i anomalija, prepoznaje potencijalne napade, a upozorava IT osoblje na percipirane napada. IPS čini sve to, ali također ima sposobnost da reagira na uočenu napada. IPS je također sposoban reagirati na napad na temelju vaših konfiguriranih pravilima. Server kaljenje-dno crta Možete izvršiti sljedeće akcije da se zaustavi bitak sjeckan ili poduzeti ove akcije kako bi se spriječilo sjeckanje - Izolat administratora uloge pojedinih zadataka sličnih njihovom opisu posla. - Zaustavljanje i onemogućiti sve nepotrebne usluge i aplikacije - Preimenovanje administrator računa - Provesti lozinka politika pomoću politiku Default Domain u Group Policy Object - Provesti GPO sigurnim poslužiteljima i klijentima - Brisanje ili onemogućiti sve nepotrebne korisničke račune - Korištenje usluge račun za pokretanje usluge i aplikacije umjesto trčanje usluge korištenja IT admin je generički račun i pohraniti lozinku na sigurno mjesto - Stvaranje Role Based korisnički račun umjesto korisnički račun korisničko ime - Zahtjev za jaku provjeru i certifikate za pristup aplikacijama - Izvođenje redovito firmware, operativni sustav i aplikacije nadogradnje koristeći WSUS ili SCCM - Instalacija poznati Antivirus i anti-spyware programa i upravljati njima centralno - Dokument sve konfiguracije sustava i pohranu tih dokumenata u sigurnom mjestu - Reviziju i nadzirati IT infrastrukture redovito kako bi se spriječilo bilo loše konfiguracije - Koristite samo za čitanje Domain Controller (RODC) za podružnice - Iskoristite veliku korist Server core tehnologija smanjuje površinsku napad dodatno - Koristiti NPS, nap i certifikat Serveri osigurati pristup aplikacijama i uslugama.