Security


About this Tour

Security Basics

Password Protection

Firewall Protection

Virus Protection

Security Tips

Learn More


About this Tour

This tour provides a short introduction to security.

You may navigate through this tour using the buttons above or by clicking the links to the left.

This tour explains the following:

  • Password policies
  • Firewall protection and often-used ports
  • Anti-virus protection
  • Easily overlooked security issues

At the end of the tour, additional information about security is listed on the Learn More page, which may include links to Web resources, links to online help topics or other tours, references to the Small Business Server 2000 Planning and Installation guide, and additional reference material such as Knowledge Base articles and Microsoft Press publications.


Security Basics

Computer and network security are increasingly important in today’s high-tech environment. You should aggressively protect your network resources. Establishing password and resource access policies, network resource auditing, firewall protection, and virus protection help ensure that your networking environment remains secure and protected from viruses, hackers, and other forms of data loss.


Password Protection

Enforcing a strong password policy is one of the most important security measures you can take. Unfortunately, even if you set up demands for your users’ passwords—such as requiring special characters and upper- and lowercase letters—your users can still choose bad passwords or, worse yet, leave them written down out in the open. Educating users on the importance of secure passwords is indispensable.

  • Password Policy
  • Bad Passwords
  • Good Passwords
  • Administrator Password Tips
  • Password Tester


Password Policy

These are features of a strong password policy:

  • Frequent password changes (Every 60 days)
  • A minimum password length (at least eight characters)
  • Password history (cannot reuse the past 18 passwords)
  • Account lockout (after three bad logon attempts)
  • Lockout duration (until the administrator unlocks)


Bad Passwords

Users should not use these passwords:

  • A name or e-mail alias
  • A birth date or phone number
  • A Social Security or other government identification number
  • Personal information


Good Passwords

Passwords should contain all of the following:

  • At least eight characters
  • Both uppercase and lowercase letters
  • Numbers and special characters
  • No personal information


Administrator Password Tips

The following special considerations apply to the administrator account:

  • Use a good password (Example: diT$34ppK)
  • Log on using your own e-mail name and not “Administrator”
  • Never leave a computer unattended while logged on using an account in the Administrators group


Password Test

Type a password to test:


Firewall Protection

Small Business Server 2000 ships with Microsoft Internet Security and Acceleration (ISA) Server 2000 as its firewall solution. A firewall provides packet filtering, which prevents unauthorized data packets from either entering or leaving your network.

To control the flow of traffic, numbered ports in ISA Server are either opened or closed to incoming or outgoing information packets. To help protect your network and to tighten user access to the Internet, you should open only the firewall ports you need. Click the link below for a list of common ports and ports used by Small Business Server.

  • Common Ports


Common Ports
Port | Function
20, 21 | File Transfer Protocol (FTP)
25 | Simple Mail Transfer Protocol (SMTP) client
53 | Domain Name Service (DNS)
80 | Hyper Text Transfer Protocol (HTTP)
88 | Kerberos version 5 authentication protocol
110 | Post Office Protocol version 3 (POP3)
443 | Outlook Web Client
1230 | Exchange Instant Messaging
1755 | Microsoft Windows Media (NetShow)
3389 | Terminal Services remote administration
7070 | Real Media
8080 | ISA Server port for outgoing Web requests


Virus Protection

A computer virus is a file designed to replicate itself, erase or corrupt data files and applications, and avoid detection. In fact, viruses are often rewritten and adjusted so that they will not be detected.

Viruses are often sent as attachments in e-mail that infect a computer when the e-mail is opened. However, viruses can also be embedded in e-mail infecting files on a computer or your network without the e-mail being opened. Viruses are the No. 1 method of computer vandalism.

  • Anti-Virus Software
  • Best Practices


Anti-Virus Software

Anti-virus software is software specifically designed for the detection, prevention, and deletion of viruses. Because new virus applications are created all the time, many makers of anti-virus products offer periodic software updates to their customers.

Microsoft strongly recommends that you use anti-virus software on both client and server computers.


Best Practices
  • If you are unsure whether or not a document or file is safe, contact the person who created it
  • Configure Exchange 2000 Server to strip off executable files sent as e-mail attachments
  • Use virus-scanning software certified by the International Computer Security Association (ICSA) to detect and remove macro viruses


Security Tips

Setting a strong password policy, configuring the ISA 2000 firewall, and ensuring that your network is protected from computer viruses are a good start to securing your network. The following are a few additional things to remember when designing a security policy.

  • Disgruntled and Former Employees
  • Physical Security
  • Terminal Services
  • Auditing
  • Users


Disgruntled and Former Employees

Disgruntled and former employees can be a threat to network security. Keep the following personnel issues in mind:

  • When an employee leaves, disable all of his or her accounts and passwords
  • Don’t grant privileges automatically. If a user doesn’t need access to a particular computer, computer room, or set of files, ensure that he or she not have access
  • Train users to be alert and to report suspicious activity
  • Train supervisors to identify and respond to potential employee problems


Physical Security

It’s important to remember physical considerations when developing security policies and procedures.

  • Ensure that server rooms are locked and that floppy, CD-ROM and DVD drives have locking doors
  • Keep unauthorized users away from the power and reset switches on the Small Business Server computer
  • Don’t allow unnecessary user access to removable media
  • Regularly store backups of critical data off-site, and store your software in fireproof containers when not in use.


Terminal Services

There are ways to increase security when remotely administrating your servers using Terminal Services.

  • Make Terminal Services in remote administration mode the only management access to your Small Business Server computer
  • Limit access to the Terminal Services Client Creator utility (in the %systemroot%/system32 directory) to members of the Administrators group
  • Set a timed disconnect that closes any Terminal Services session once it becomes idle for a designated period of time


Auditing

Auditing is a way to discover a potential security breach. Auditing follows the trail left by various logs to find out who has been accessing your system and what they have been doing.

You can use tools such as the Windows 2000 Event Log, included with Small Business Server 2000, to audit events like failed logons and attempts to access resources.


Users

Make sure your users understand their role in keeping the network secure. In addition to using strong passwords, your users should:

  • "Lock" their workstations if they are away from their desks
  • Never share or give out their passwords
  • Avoid writing their passwords down


Learn More

You have now finished the Security tour. See below for additional information.

Web Sites

Small Business Server

Microsoft Security Basics

Microsoft Security

ISCA Web Site

Knowledge Base Search

Microsoft TechNet

Microsoft Press

Planning Guide

Small Business Server Planning and Installation, Chapter 9, "Security"

Planning and Installation Online

Web Articles

Windows 2000 Distributed Security

Anti-virus Software Vendors


Microsoft Press Web Links

Windows 2000 Resource Kit

Windows 2000 Security Technical Reference