Table of Contents

Cover

Title

Credits

Publisher's Note

Dedication

Acknowledgments

About the Author

Introduction

Who Should Read This Book
What Is Covered in This Book

Chapter 1: Understanding Core Security Principles

Understanding Risk
Exploring the Security Triad
Implementing a Defense-in-Depth Security Strategy
Enforcing the Principle of Least Privilege
Hardening a Server
The Essentials and Beyond

Chapter 2: Understanding Malware and Social Engineering

Comparing Malware
Protecting Against Malware
Thwarting Social-Engineering Attacks
Protecting Email
The Essentials and Beyond

Chapter 3: Understanding User Authentication

Comparing the Three Factors of Authentication
Using Passwords for Authentication
Using Smart Cards and Token Devices for Authentication
Using Biometrics for Authentication
Starting Applications with Run As Administrator
Preventing Time Skew with Kerberos
Identifying RADIUS Capabilities
Identifying Unsecure Authentication Protocols
The Essentials and Beyond

Chapter 4: Securing Access with Permissions

Comparing NTFS Permissions
Exploring Share Permissions
Identifying Active Directory Permissions
Assigning Registry Permissions
The Essentials and Beyond

Chapter 5: Using Audit Policies and Network Auditing

Exploring Audit Policies
Enabling Auditing
Viewing Audit Information
Managing Security Logs
Auditing a Network with MBSA
The Essentials and Beyond

Chapter 6: Protecting Clients and Servers

Understanding User Account Control
Keeping Systems Updated
Protecting Clients
Protecting Servers
Exploring DNS Security Issues
The Essentials and Beyond

Chapter 7: Protecting a Network

Identifying Common Attack Methods
Exploring Firewalls
Exploring Network Access Protection
Identifying Protocol Security Methods
The Essentials and Beyond

Chapter 8: Understanding Wireless Security

Comparing Wireless Devices
Comparing Wireless Security Methods
Configuring Wireless Routers
Configuring Windows 7 for Wireless
The Essentials and Beyond

Chapter 9: Understanding Physical Security

Comparing Site Security and Computer Security
Using Group Policy to Enhance Computer Security
Exploring Mobile Device Security
The Essentials and Beyond

Chapter 10: Enforcing Confidentiality with Encryption

Comparing Encryption Methods
Securing Email
Understanding EFS
Exploring BitLocker Drive Encryption
The Essentials and Beyond

Chapter 11: Understanding Certificates and a PKI

Understanding a Certificate
Exploring the Components of a PKI
The Essentials and Beyond

Chapter 12: Understanding Internet Explorer Security

Exploring Browser Settings
Comparing Security Zones
Using IE Tools to Identify Malicious Websites
The Essentials and Beyond

Appendix A: Answers to Review Questions

Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12

Appendix B: Microsoft’s Certification Program

Certification Objectives Map

Index

Appendix C: Answers to Additional Exercises

Chapter 1
Chapter 2
Chapter 3
Chapter 4
Chapter 5
Chapter 6
Chapter 7
Chapter 8
Chapter 9
Chapter 10
Chapter 11
Chapter 12

Appendix D: Optional Lab to Create a Virtual Environment

Identifying the Requirements
Configuring Windows 7 with Virtualization
Locating and Downloading an Evaluation Copy of Windows Server 2008
Creating a Virtual Machine for Windows Server 2008
Installing Windows Server 2008 on a Virtual Machine
Configuring Windows Server 2008 on a Virtual Machine
Promoting Windows Server 2008 to a Domain Controller
Applying Changes to the Domain Controller

Glossary

End User License Agreement

List of Tables

Chapter 2: Understanding Malware and Social Engineering

Table 2-1: Common Malware Types
Table 2-2: Microsoft Security Essentials Alert Levels

Chapter 3: Understanding User Authentication

Table 3-1: Characteristics of a Strong Password
Table 3-2: Domain Password Policy Elements
Table 3-3: Account Lockout Policy Elements

Chapter 4: Securing Access with Permissions

Table 4-1: Basic NTFS Permissions
Table 4-2: Advanced NTFS Permissions
Table 4-3: Identifying Permissions When Files Are Moved or Copied
Table 4-4: Share Roles
Table 4-5: Assigned Share and NTFS Permissions for the IT and Finance Groups
Table 4-6: Assigned Share and NTFS Permissions with Deny for Sally and the IT and Finance Groups

Chapter 5: Using Audit Policies and Network Auditing

Table 5-1: Audit Settings That Apply to All Servers
Table 5-2: Audit Settings That Apply Only to Domain Controllers

Chapter 6: Protecting Clients and Servers

Table 6-1: Update Types
Table 6-2: Software-Restriction Policy Additional Rules

Chapter 7: Protecting a Network

Table 7-1: Commonly used ports
Table 7-2: NAP server requirements

Chapter 8: Understanding Wireless Security

Table 8-1: IEEE 802.11 Wireless Standards
Table 8-2: Default IP Addresses and Passwords

Chapter 10: Enforcing Confidentiality with Encryption

Table 10-1: Effect on encryption when files are moved or copied

Appendix B: Microsoft’s Certification Program

Table B-1 Exam 98-367 objectives map

List of Illustrations

Chapter 1: Understanding Core Security Principles

Figure 1-1: Threats exploit vulnerabilities, creating risk.
Figure 1-2: Security triad
Figure 1-3: Defense-in-depth strategies, and the corresponding chapters in this book
Figure 1-4: DNS Server service Log On settings
Figure 1-5: Minimizing the attack surface of a server
Figure 1-6: Security Configuration Wizard service startup mode recommendations
Figure 1-7: Security Configuration Wizard security policy shown in Internet Explorer
Figure 1-8: Security Configuration Database viewed from the SCW

Chapter 2: Understanding Malware and Social Engineering

Figure 2-1: Rogueware warning
Figure 2-2: Buffer-overflow vulnerability
Figure 2-3: Three-pronged protection against malware
Figure 2-4: Microsoft Security Essentials scan options
Figure 2-5: Microsoft Security Essentials Settings page
Figure 2-6: Masked web address in an email
Figure 2-7: Junk E-mail options in Microsoft Outlook

Chapter 3: Understanding User Authentication

Figure 3-1: Domain Password Policy
Figure 3-2: Account Lockout Policy
Figure 3-3: Viewing the properties for a local user account
Figure 3-4: Unlocking a domain account
Figure 3-5: Resetting a password
Figure 3-6: Modifying the password
Figure 3-7: The warning that appears when resetting the password on a local account
Figure 3-8: Changing a password
Figure 3-9: Smart card and smart-card reader
Figure 3-10: Token used for authentication
Figure 3-11: Using Run As Administrator
Figure 3-12: RADIUS authentication protocols

Chapter 4: Securing Access with Permissions

Figure 4-1: Viewing NTFS permissions on a folder
Figure 4-2: Relationships between permissions
Figure 4-3: Viewing advanced NTFS permissions on a folder
Figure 4-4: Viewing basic file and folder attributes
Figure 4-5: Using groups to assign permissions
Figure 4-6: Inherited permissions
Figure 4-7: Windows Explorer showing child folders
Figure 4-8: Removing inheritance
Figure 4-9: Effect on permissions when files are moved or copied
Figure 4-10: Viewing share permissions
Figure 4-11: Creating a share from Windows Explorer
Figure 4-12: Active Directory Users and Computers
Figure 4-13: Active Directory permissions on the Sales OU
Figure 4-14: Delegating permissions with the Delegation of Control Wwizard
Figure 4-15: Viewing permissions in the Registry Editor
Figure 4-16: Enabling permission inheritance in the Registry

Chapter 5: Using Audit Policies and Network Auditing

Figure 5-1: AAA of security
Figure 5-2: Audit Policy within Local Security Policy
Figure 5-3: Auditing configured on an NTFS folder
Figure 5-4: Event Viewer showing the Security log
Figure 5-5: The User Rights Assignment node of Local Security Policy
Figure 5-6: Configuring auditing with Group Policy
Figure 5-7: Configuring auditing on an NTFS folder
Figure 5-8: Configuring Directory Service Access auditing in Active Directory Users and Computers
Figure 5-9: Viewing the Security log in Event Viewer
Figure 5-10: Filtering the Security log in Event Viewer
Figure 5-11: Viewing the Security log properties
Figure 5-12: Using event subscriptions
Figure 5-13: Starting an MBSA scan
Figure 5-14: Viewing an MBSA report

Chapter 6: Protecting Clients and Servers

Figure 6-1: UAC prompting for approval to execute a task
Figure 6-2: UAC prompting for administrator credentials
Figure 6-3: User Account Control Settings page
Figure 6-4: Controlling how updates are applied
Figure 6-5: Using WSUS or SCCM to deploy updates
Figure 6-6: Configuring automatic updates with Group Policy
Figure 6-7: Configuring clients to receive updates from a WSUS server with Group Policy
Figure 6-8: Accessing an encrypted file from a share
Figure 6-9: Encrypting offline files
Figure 6-10: Viewing software restriction policy security levels
Figure 6-11: Software exceptions created as additional rules
Figure 6-12: Using VLANs to separate servers
Figure 6-13: Roles in Windows Server 2008
Figure 6-14: Dynamic update process
Figure 6-15: Dynamic update process

Chapter 7: Protecting a Network

Figure 7-1: TCP handshake process
Figure 7-2: Network Monitor capturing company secrets
Figure 7-3: Hardware-based vs. software-based firewalls
Figure 7-4: Perimeter network
Figure 7-5: Single firewall creating a perimeter network
Figure 7-6: SHV for NAP
Figure 7-7: NAP used for VPN enforcement
Figure 7-8: IPsec default policies in Group Policy
Figure 7-9: VPN connection

Chapter 8: Understanding Wireless Security

Figure 8-1: Wireless access point bridging wireless clients
Figure 8-2: Wireless router in a small network
Figure 8-3: Enabling FIPS standards for a wireless connection
Figure 8-4: 802.1X authentication
Figure 8-5: Wireless security choices on Windows 7
Figure 8-6: Viewing the Network And Sharing Center on a wireless-enabled Windows 7 system
Figure 8-7: Viewing the Security tab of a wireless connection properties page
Figure 8-8: Viewing the Connection tab of a wireless connection properties page
Figure 8-9: Changing the default password on a wireless router
Figure 8-10: Linksys wireless settings
Figure 8-11: Configuring a wireless connection in Windows 7
Figure 8-12: Configuring MAC filtering
Figure 8-13: Windows 7 Network And Sharing Center showing network connectivity

Chapter 9: Understanding Physical Security

Figure 9-1: Boundary control for a building
Figure 9-2: Computers connected with a hub
Figure 9-3: Computers connected with a switch
Figure 9-4: GPOs linked in a domain
Figure 9-5: Group Policy Management with OUs and GPOs
Figure 9-6: Group Policy Management Editor
Figure 9-7: Account Policies
Figure 9-8: Allow Log On Locally from Default Domain Controllers Policy
Figure 9-9: Deny Log On Locally from Default Domain Controllers Policy
Figure 9-10: Removable Storage Access policy settings
Figure 9-11: Denying access for all removable storage classes

Chapter 10: Enforcing Confidentiality with Encryption

Figure 10-1: Encrypting data with symmetric encryption
Figure 10-2: Encrypting a secret key with asymmetric encryption
Figure 10-3: Decrypting a secret key with asymmetric encryption
Figure 10-4: Viewing the public key in a certificate
Figure 10-5: Hashing algorithms create hashes.
Figure 10-6: SHA-1 hashes displayed on Microsoft TechNet
Figure 10-7: Sender process when encrypting email
Figure 10-8: Recipient process when decrypting email
Figure 10-9: Encrypting an email with Microsoft Outlook
Figure 10-10: Senderâ€™s process when digitally signing email
Figure 10-11: Recipientâ€™s process when verifying a digital signature
Figure 10-12: Encrypting a folder with EFS
Figure 10-13: BitLocker Drive Encryption in the Control Panel
Figure 10-14: Using the BitLocker To Go Reader

Chapter 11: Understanding Certificates and a PKI

Figure 11-1: Viewing a certificate
Figure 11-2: Creating an HTTPS session
Figure 11-3: Viewing the CRL
Figure 11-4: Checking the validity of the certificate
Figure 11-5: Error from a certificate
Figure 11-6: Viewing the Trusted Root Certification Authorities store
Figure 11-7: Viewing the purposes of a certificate
Figure 11-8: Viewing the details of a certificate
Figure 11-9: Viewing the certificate path
Figure 11-10: A certificate chain
Figure 11-11: A single CA in a certificate chain
Figure 11-12: Enterprise CA in Windows Server 2008

Chapter 12: Understanding Internet Explorer Security

Figure 12-1: Internet Explorer
Figure 12-2: IE ESC display
Figure 12-3: Enabling or disabling IE ESC
Figure 12-4: Viewing settings for cookies
Figure 12-5: Viewing a privacy policy summary
Figure 12-6: Modifying the Pop-up Blocker settings
Figure 12-7: Enabling InPrivate Filtering
Figure 12-8: Starting an InPrivate Browsing session
Figure 12-9: Deleting browser history
Figure 12-10: Managing add-ons in IE
Figure 12-11: Resetting IE to the default state
Figure 12-12: IE advanced security settings
Figure 12-13: Viewing the security zones
Figure 12-14: Viewing security settings for the Internet zone

Appendix D: Optional Lab to Create a Virtual Environment

Figure D-1: Selecting Windows Virtual PC
Figure D-2: Locating Windows Virtual PC
Figure D-3: Locating the Windows Server 2008 download
Figure D-4: Creating the virtual machine
Figure D-5: Adding a virtual hard disk
Figure D-6: Virtual Machines console
Figure D-7: Configuring the virtual DVD to use the Windows Server 2008 .iso image
Figure D-8: Viewing the warning about the mouse pointer
Figure D-9: Selecting Windows Server 2008 Enterprise (Full Installation)
Figure D-10: Entering the Administrator password
Figure D-11: Initial Configuration Tasks window
Figure D-12: Configuring virtual PC networking for the internal network.
Figure D-13: Configuring the NIC with a static IP address
Figure D-14: Changing the computer name
Figure D-15: Creating a new domain in a new forest
Figure D-16: Dynamically assigned IP address warning
Figure D-17: Dcpromo promoting a server to a domain controller
Figure D-18: Applying changes to the virtual machine

Copyright © 2011 by Wiley Publishing, Inc., Indianapolis, IndianaPublished simultaneously in CanadaISBN: 978-1-118-01684-8ISBN: 978-1-118-11454-4 (ebk.)ISBN: 978-1-118-11457-5 (ebk.)ISBN: 978-1-118-11456-8 (ebk.)

No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, mechanical, photocopying, recording, scanning or otherwise, except as permitted under Sections 107 or 108 of the 1976 United States Copyright Act, without either the prior written permission of the Publisher, or authorization through payment of the appropriate per-copy fee to the Copyright Clearance Center, 222 Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600. Requests to the Publisher for permission should be addressed to the Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030, (201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: The publisher and the author make no representations or warranties with respect to the accuracy or completeness of the contents of this work and specifically disclaim all warranties, including without limitation warranties of fitness for a particular purpose. No warranty may be created or extended by sales or promotional materials. The advice and strategies contained herein may not be suitable for every situation. This work is sold with the understanding that the publisher is not engaged in rendering legal, accounting, or other professional services. If professional assistance is required, the services of a competent professional person should be sought. Neither the publisher nor the author shall be liable for damages arising herefrom. The fact that an organization or Web site is referred to in this work as a citation and/or a potential source of further information does not mean that the author or the publisher endorses the information the organization or Web site may provide or recommendations it may make. Further, readers should be aware that Internet Web sites listed in this work may have changed or disappeared between when this work was written and when it is read.

For general information on our other products and services or to obtain technical support, please contact our Customer Care Department within the U.S. at (877) 762-2974, outside the U.S. at (317) 572-3993 or fax (317) 572-4002.

Wiley also publishes its books in a variety of electronic formats and by print-on-demand. Not all content that is available in standard print versions of this book may appear or be packaged in all book formats. If you have purchased a version of this book that did not include media that is referenced by or accompanies a standard print version, you may request this media by visiting http://booksupport.wiley.com. For more information about Wiley products, visit us at www.wiley.com.

Library of Congress Cataloging-in-Publication Data is available from the publisher.

TRADEMARKS: Wiley, the Wiley logo, and the Sybex logo are trademarks or registered trademarks of John Wiley & Sons, Inc. and/or its affiliates, in the United States and other countries, and may not be used without written permission. Microsoft and Windows are registered trademarks of Microsoft Corporation, Inc. All other trademarks are the property of their respective owners. Wiley Publishing, Inc., is not associated with any product or vendor mentioned in this book.

10 9 8 7 6 5 4 3 2 1

Introduction

Attacks on computers have become as common as computers themselves. Criminals have discovered that they can separate money from uninformed users with very little work and, often, with very large paydays. IT professionals must include sound security practices when maintaining any network today.

The first step is to understand the risks. Once you understand the risks, the security controls implemented to protect the computers and networks from these risks make a lot more sense. This book covers the basics of security in a Microsoft IT environment and is geared toward preparing you for one of the three certification exams in the Microsoft Technology Associate (MTA) Information Technology (IT) Professional track.

The MTA certification is a new certification level. It includes three separate tracks: IT Professional, Developer, and Database. The IT Professional track is for individuals pursuing work as administrators. The Developer track is for individuals pursuing work as programmers and software engineers. The Database track is for individuals pursuing work as database administrators and database developers.

The MTA IT Professional series includes three certifications:

Networking Fundamentals This is the first certification in the MTA IT Professional track. It lays a solid foundation of basic networking knowledge needed for the other MTA certifications and also for the more advanced Microsoft Certified Technology Specialist (MCTS) and Microsoft Certified IT Professional (MCITP) tracks. You earn this certification by taking and passing exam 98-366.

Security Fundamentals Security Fundamentals is the second certification in the MTA IT Professional track. It builds on the knowledge learned in the Networking Fundamentals certification and adds fundamental security knowledge needed by administrators. IT administrators in any environment need to be aware of the risks associated with IT systems. You earn this certification by taking and passing exam 98-367, covered by this book.

Windows Server Administration Fundamentals This certification builds on the knowledge gained in the Networking Fundamentals and Security Fundamentals certifications. It digs deeper into knowledge and skills needed by Windows Server administrators. You earn this certification by taking and passing exam 98-365.

Each of these certifications can serve as a stepping-stone to Microsoft’s next levels of certification: Microsoft Certified Technology Specialist (MCTS) and Microsoft Certified IT Professional (MCITP).

Who Should Read This Book

This book is for current or aspiring professionals seeking a quick grounding in the fundamentals of security in a Microsoft environment. The goal is to provide quick, focused coverage of fundamental security skills. If you have a basic understanding and want to expand your knowledge into security, this book is for you. It will help you grasp many fundamental security concepts and how they apply to Microsoft systems. Also, you can use the knowledge gained from this book as a foundation for more advanced studies.

This book is focused on the objectives of the Microsoft Technology Associate (MTA) Security Fundamentals certification. This is one of the certifications in the MTA IT Professional series. It’s best if you start with the Networking Fundamentals topics, covered in Microsoft Windows Networking Essentials (Wiley, 2011). You can then move into the Windows Server Administration Fundamentals MTA certification.

You can read more about the MTA certifications and MTA exam certification paths at www.microsoft.com/learning/en/us/certification/mta.aspx.

What You Will Learn

You will learn the essentials of security in a Microsoft environment. This book covers all the objectives of the Microsoft Technology Associate Security Fundamentals exam (exam 98-367).

Details on this exam, including the objectives, are available at www.microsoft.com/learning/en/us/exam.aspx?ID=98-367.

Prerequisites

This book is focused on the 98-367 exam, which is the second Microsoft exam in the MTA IT Professional series. The first exam is Networking Fundamentals (98-366), and it’s expected that you have the knowledge tested in that exam, although you don’t need to have taken and passed that exam.

The Networking Fundamentals exam (and the associated knowledge) does provide a solid foundation, and there simply isn’t enough room in this book to include basic networking knowledge. However, when a networking topic is important, this book does provide some key information to remind you about the underlying networking concepts. For a more detailed look at networking essentials, consult Microsoft Windows Networking Essentials (Wiley, 2011).

What You Need

Because this book is focused on providing you with only the essentials, the biggest requirement is a desire to learn. You aren’t expected to have a lot of knowledge about or experience in security before starting the book. It starts with the basics in Chapter 1 and steadily builds on the knowledge through the end of the book.

Ideally, you’ll have some hardware that you can use. Because this is a Microsoft book focused on Microsoft technologies, it would be good to have a system running Microsoft Window Server 2008 or Windows Server 2008 R2.

If you’re running another operating system, such as Windows 7, you can create a virtual server running Windows Server 2008. I have included an optional lab for this book, which you can download at www.sybex.com/go/securityessentials. It will lead you through the following steps:

Configuring Windows 7 with virtualization
Locating and downloading an evaluation copy of Windows Server 2008
Creating a Virtual PC machine for Windows Server 2008
Installing Windows Server 2008 on a virtual machine
Promoting Windows Server 2008 to a domain controller

What Is Covered in This Book

Microsoft Windows Security Essentials is organized to provide you with the knowledge needed to master the basics of security in a Microsoft environment.

The objectives for this book are primarily focused on Microsoft Windows Server 2008. Although Microsoft Windows Server 2008 R2 does include a lot of under-the-hood enhancements, there aren’t many differences covered in this book. Unless specific differences are mentioned, the topics apply equally to both Windows Server 2008 and Windows Server 2008 R2. Occasionally, I mention both to remind you; but to avoid repetition, I often just refer to Windows Server 2008, implying both Microsoft Windows Server 2008 and Microsoft Windows Server 2008 R2.

Chapter 1, “Understanding Core Security Principles” Most security principles can be traced back to the security triad of confidentiality, integrity, and availability. This chapter introduces these concepts along with basics of risk and the importance of implementing a defense-in-depth strategy.

Chapter 2, “Understanding Malware and Social Engineering” One of the most common threats to computers today is malicious software, or malware. Malware comes in many forms, such as viruses, worms, and Trojan horses. It’s important to understand how serious the threat is and what you can do to protect computers and networks. Additionally, attackers often use social-engineering tactics to trick users into giving up valuable data. This chapter covers how to thwart those attacks, plus how to safeguard email.

Chapter 3, “Understanding User Authentication” One of the primary methods of ensuring security is to restrict access to known users. This requires users to authenticate themselves, or prove their identity by providing credentials. Authentication is commonly classified using three types or three factors of authentication: something you know, something you have, and something you are. This chapter helps you understand these factors, including their strengths and weaknesses.

Chapter 4, “Securing Access with Permissions” Permissions are the primary method used to restrict access to resources in a Microsoft domain. You can assign permissions to NTFS drives, shares, Active Directory objects, and the Registry. This chapter covers the many types of permissions and how some of these permissions interact with each other.

Chapter 5, “Using Audit Policies and Network Auditing” Auditing provides administrators with an easy method of tracking activity on systems. You can track when users access files, shut down systems, create or modify accounts, and much more. Windows Server 2008 includes multiple categories of auditing that you can manipulate, and you’ll learn about them in this chapter.

Chapter 6, “Protecting Clients and Servers” In this chapter, you’ll learn common techniques used to protect clients and servers, including User Account Control. Additionally, this chapter covers the importance of keeping every system in an organization up to date. You’ll also learn about many of the server roles, including some specific security steps used to protect them.

Chapter 7, “Protecting a Network” Attackers are out there, constantly trying to attack networks. In this chapter, you’ll learn some of the common well-known attack methods and techniques to protect a network. You’ll learn about network-based firewalls and how they provide network isolation for an internal network. This chapter also covers Network Access Protection (NAP), a new technology in Windows Server 2008 used to inspect clients for health and isolate unhealthy clients.

Chapter 8, “Understanding Wireless Security” Wireless networks have become quite popular in recent years. They’re relatively inexpensive and don’t require you to run cables for connectivity. However, security for wireless networks had a rough start. If you don’t use up-to-date technologies, your wireless networks will be highly vulnerable to attacks. This chapter covers many current wireless security standards and protocols.

Chapter 9, “Understanding Physical Security” One of the basic security steps you can take is to restrict physical access to systems. Most organizations use a variety of methods to enforce physical security, such as locked doors, cipher locks, guards, and more. You can also use Group Policy to enhance physical security by restricting access to systems. The Deny Log On Locally Group Policy setting prevents users from logging onto a computer, and a Removable Storage Access policy can restrict what users can do with different types of removable devices including USB flash drives. In addition to specific Group Policy settings, this chapter provides a big picture view of how Group Policy works. You’ll also learn about mobile-device security.

Chapter 10, “Enforcing Confidentiality with Encryption” A key part of the security triad (confidentiality, integrity, and availability) is confidentiality. The two primary ways of encrypting data are via symmetric or asymmetric encryption. You can also provide one-way encryption with hashing functions. This chapter covers many of the generic encryption methods along with some specific Microsoft methods such as Encrypting File System (EFS) and BitLocker Drive Encryption.

Chapter 11, “Understanding Certificates and a PKI” A Public Key Infrastructure (PKI) includes all the pieces required to issue, use, and manage certificates. Certificates (also called public-key certificates) are used for a wide variety of purposes to provide different types of security. This chapter explains the details of certificates and explores the components of a PKI.

Chapter 12, “Understanding Internet Explorer Security” Internet Explorer (IE) is the primary web browser used on Windows Server 2008 and Windows 7. Because it’s so common to use the Internet to research and do regular work, it’s important to understand some of the security risks and some of the security mechanisms that help protect users. This chapter covers many of the browser settings, the different security zones, and some of the IE tools used to identify malicious websites.

Appendix A, “Answers to Review Questions” This appendix includes all of the answers to the review questions found in “The Essentials and Beyond” section at the end of every chapter.

Appendix B, “Microsoft’s Certification Program” This appendix maps the objectives in the MTA Security Fundamentals exam (exam 98-367) to the specific chapters where each objective is covered.

I have created an online glossary as well as provided the suggested or recommended answers to the additional exercises included at the end of each chapter. You can download these at www.sybex.com/go/securityessentials.

Sybex strives to keep you supplied with the latest tools and information you need for your work. Please check its website at www.sybex.com/go/securityessentials, where we’ll post additional content and updates that supplement this book if the need arises. Enter security essentials in the Search box (or type the book’s ISBN—978-1-118-01684-8), and click Go to get to the book’s update page.