Windows Server 2012 Security from End to Edge and Beyond: Architecting, Designing, Planning, and Deploying Windows Server 2012 Security Solutions

685 Pages·2013·18.39 MB·English

by  Thomas W Shinder

Windows Server 2012 Security from End
to Edge and Beyond
Architecting, Designing, Planning, and
Deploying Windows Server 2012 Security
Solutions
Thomas W. Shinder
Yuri Diogenes
Debra Littlejohn Shinder
Richard Hicks
TECHNICAL EDITOR
Table of Contents
Cover image
Title page
Copyright
Acknowledgments
About the Authors
About the Technical Editor
Foreword
Chapter 1. Planning Platform Security
Chapter Points
Reviewing The Core Security Principles
Planning A Secure Platform From End To Edge And Beyond
From End To Edge And Beyond Chapter Previews
Summary
Chapter 2. Planning Server Role in Windows Server 2012
Chapter Points
Server Role And Security Considerations
Using Server Manager To Add A New Role Or Feature
Using Security Compliance Manager To Hardening Servers
Administrator’s Punch List
Summary
Chapter 3. Deploying Directory Services and Certificate Services
Chapter Points
Evolving Threats Against Certificates
Implementing Directory Services On Windows Server 2012
Implementing Certificate Services On Windows Server 2012
Installing Ad Cs Role
Site-Aware Certificate Enrollment
Renew With The Same Key
Validate Your Knowledge In Ad Cs
Administrator’s Punch List
Summary
Chapter 4. Deploying AD FS and AD RMS in Windows Server 2012
Chapter Points
Planning For Active Directory Federation Services
Deploying Active Directory Federation Services
Troubleshooting Active Directory Federation Services
Active Directory Rights Management Services
Summary
Chapter 5. Patch Management with Windows Server 2012
Chapter Points
Why Should You Have A Patch Management Strategy In Place?
Planning Wsus Deployment On Windows Server 2012
Deploying Wsus
Managing Updates With Wsus
Using Group Policy To Configure Wsus
Administrator’s Punch List
Summary
Chapter 6. Virtualization Security
Chapter Points
Considerations Regarding Virtualization Security In Microsoft Platform
Understanding And Deploying Windows Server 2012 Hyper-V Security Capabilities
High Availability For Virtualization Security
Beyond The Hypervisor
Scenario: Virtualization Security Considerations For A Cloud Infrastructure
Administrator’s Punch List
Summary
Chapter 7. Controlling Access to Your Environment with Authentication and
Authorization
Chapter Points
Planning Authentication, Authorization, And Access Control
Understanding Dynamic Access Control
Planning Authentication
Configuring Dynamic Access Control
Summary
Chapter 8. Endpoint Security
Chapter Points
Considerations Regarding Endpoint Security
Windows 8 Security Enhancements
Administrator’s Punch List
Summary
Chapter 9. Secure Client Deployment with Trusted Boot and BitLocker
Chapter Points
Security Considerations For Mobile Users
Understanding The Trusted Boot Process
Understanding Bitlocker Full Volume Encryption
Summary
Chapter 10. Mitigating Application’s Vulnerabilities
Chapter Points
Living In The World Of Apps
Browser Protection
The Old Friends Are Still Here: Uac And Applocker
Extra Tools
Summary
Chapter 11. Mitigating Network Vulnerabilities
Chapter Points
Understanding Windows Firewall With Advanced Security
Deploying And Managing The Windows Firewall With Advanced Security
Protecting The Windows Endpoint With Ipsec Rules
Common Deployment Scenarios
Using Smb Encryption To Protect Data Traversing The Network
Summary
Chapter 12. Unified Remote Access and BranchCache
Chapter Points
The Evolving Remote Access Landscape
New Capabilities In Directaccess
Directaccess Requirements And Planning
What Is Branchcache?
Overview Of Branchcache Deployment
Administrator’s Punch List
Summary
Chapter 13. DirectAccess Deployment Scenarios
The Simplified Directaccess Server Test Lab
Create A Security Group For Directaccess Clients On Dc1
Install The Unified Remote Access Server Role On Edge1
Run The Getting Started Wizard On Edge1
Setup And Test Client1 For Directaccess Connectivity
Overview Of Traditional Directaccess Single Server Deployment
Administrator’s Punch List
Summary
Chapter 14. Protecting Legacy Remote Clients
Chapter Points
Virtual Private Networking With Windows Server 2012
Deploying Network Access Protection (Nap) Through Network Policy And Access Services
Summary
Chapter 15. Cloud Security
Chapter Points
General Considerations For Cloud Security (Saas)
General Considerations For Cloud Security (Iaas)
Building A Private Cloud With Windows Server 2012
Summary
Index
Copyright
Acquiring Editor: Chris Katsaropoulos
Editorial Project Manager: Benjamin Rearick
Project Manager: Punithavathy Govindaradjane
Designer: Alan Studholme
Syngress is an imprint of Elsevier 225 Wyman Street, Waltham, MA 02451, USA
Copyright © 2013 Elsevier, Inc. All rights reserved.
No part of this publication may be reproduced or transmitted in any form or by
any means, electronic or mechanical, including photocopying, recording, or any
information storage and retrieval system, without permission in writing from the
publisher. Details on how to seek permission, further information about the
Publisher’s permissions policies and our arrangements with organizations such
as the Copyright Clearance Center and the Copyright Licensing Agency, can be
found at our website: www.elsevier.com/permissions.
This book and the individual contributions contained in it are protected under
copyright by the Publisher (other than as may be noted herein).
Notices
Knowledge and best practice in this field are constantly changing. As
new research and experience broaden our understanding, changes in
research methods or professional practices, may become necessary.
Practitioners and researchers must always rely on their own experience
and knowledge in evaluating and using any information or methods
described herein. In using such information or methods they should be
mindful of their own safety and the safety of others, including parties
for whom they have a professional responsibility.
To the fullest extent of the law, neither the Publisher nor the authors,