Microsoft publishes security guides for admins
Microsoft Corp. released a guide on Friday to help systems administrators run Windows Server 2003 securely, and reannounced a similar guide for Windows 2000 on Monday.
The Windows Server 2003 Security Guide and the Windows 2000 Security Hardening Guide for Windows 2000 Professional and Server editions give instructions on how to set up the software and how to mitigate various attack types, as well as other tips, said Michael Stephenson, lead product manager for Windows Server at Microsoft.
"We felt we needed to do a better job in helping our customers to better secure their products," Stephenson said.
Microsoft found that a large majority of the security breaches its customers have suffered resulted from configuration mistakes. These included unpatched systems and unprotected admin accounts on servers, Stephenson said.
The guides walk administrators through the best practices for setting up a Windows Server system in a variety of configuration scenarios, including file server, Web server, domain controller and DNS (Domain Name System) server, Stephenson said.
Also, users are taught how to reduce the impact of various attack types and how to harden the system against those types of attacks. The guides provide details on countermeasures users can take to make their systems less susceptible. Access to the shutdown function on a domain controller should be very limited, for example.
Previously, Microsoft had released security white papers addressing specific security issues such as password management. This is the first time Microsoft has published comprehensive guides, according to Stephenson. The Windows 2000 Security Hardening Guide was first released just last month. The guides are part of Microsoft's Trustworthy Computing initiative, he said.
The next thing Microsoft will do is to automate security setup. In mid-2003, Microsoft will launch a security configuration wizard for Windows Server 2003 that will ask customers about their environment and, based on the answers, will set the configuration settings, Stephenson said.
The Windows Server 2003 Security Guide is available at http://go.microsoft.com/fwlink/?linkid=14845
The Windows 2000 Security Hardening Guide is at http://www.microsoft.com/technet/security/prodtech/windows/win2khg.asp.
IDG News Service
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
