Security Properties pg 621

1
Security Properties (pg 621)

• Authentication is the process of reliably
  determining the genuine identity of the
  communicating computer or user. (You are who you
  say you are.)
• Integrity is the correctness of data as it was
  originally sent. (Makes sure no one intercepts
  and modifies data during transmission.)
• Confidentiality ensures that data is disclosed
  only to intended recipients.
• Anti-replay ensures that datagrams are not
  retransmitted. (Makes sure no one intercepts and
  captures data to be modified and re-used later.)

2
Cryptography (pg 622)

• Cryptography is a set of mathematical techniques
  for encrypting and decrypting data.
• Cryptography uses keys in conjunction with
  algorithms to secure data. (A key is a value
  used to encrypt or decrypt information.)
• The algorithm provides the infrastructure in
  which the key is applied.
• A number of well-known cryptographic algorithms
  support security operations.
• Microsoft Windows 2000 supports public key
  cryptography.
• A secret key is used in much the same way as a
  public key.

3
Public Key Cryptography (pg 623)

• Public key cryptography- uses public and private
  keys for encryption
• Data encryptions
• To transmit secure data
• sender gets recipients public key and uses it
  to encrypt data and then sends it to recipient
• recipient receives data and decrypts using its
  own private key
• Digital message signing (typically used during
  e-mail correspondence) Transmission method is
  opposite of data encryption.
• sender uses his/her own private key to encrypt
  message
• recipient receives message and decrypts using
  senders public key

4
Secret Keys (pg 625)
5
Certificates (pg 626-628)

• A digital certificate is a set of data that
  completely identifies an entity. (similar to a
  notary public)
• The recipient of the message can use the senders
  public key to verify that the sender is
  legitimate.
• A Certificate Authority (CA) issues certificates
  after the authority has verified the entitys
  identity.
• The Windows 2000 certificate-based processes use
  the X.509 standard.
• At a minimum, certifications should contain
  certain specific attributes which are listed on
  page 627
• Certificates can expire and become invalid. (pg
  628)
• The Certificate Authority (CA) can revoke a
  certificate for any reason.
• The CA maintains a certificate revocation list
  (CRL).

6
CA Hierarchy (pg 628)

• CAs can certify other CAs which is called
  chaining.
• The chaining of CAs provides several benefits
• flexibility
• distributed administration
• security policies

7
Microsoft Certificate Services (pgs 628-629)

• Enables an organization to manage the issuance,
  renewal, and revocation of digital certificates
• Allows an organization to control the policies
  associated with issuing, managing, and revoking
  certificates
• Logs all transactions
• Features
• Policy independence
• Transport independence
• Adherence to standards
• Key management

8
Processing a Certificate Request (pg 632)
9
Enrolling Certificates
10
CA Certificates (pgs 634-635)

• The CA validates the identity of the individual
  requesting the certificate and then signs the
  certificate with its own private key.
• A client application checks the CA signature
  before accepting a certificate.
• A self-signed CA certificate is also called a
  root certificate.
• You can install Certificate Services by using
  Add/Remove Programs in Control Panel.
• Certificate Services supports four Certificate
  Authority types (pg 636).

11
Administering Certificate Services (pg 636)
Certification Authority snap-in is used to
perform many administrative tasks pg 637).
12
Secure Channel (SChannel) Authentication Package
(pg 645)
13
Smart Cards

• Smart cards can be used to store a users public
  key, private key, and certificate.
• To use a smart card, a computer must have a smart
  card reader.
• A smart card contains an embedded microprocessor,
  a cryptography coprocessor, and local storage.
• Windows 2000 supports PK-based smart card logon
  as an alternative to passwords for domain
  authentication.

14
Authenticode

• Ensures accountability and authenticity for
  software components on the Internet
• Verifies that the software hasnt been tampered
  with and identifies the publisher of the software
• Allows software publishers to digitally sign any
  form of active content

15
Encrypting File System (EFS)

• EFS is an extension of NTFS that provides strong
  data protection and encryption for files and
  folders.
• The encryption technology is based on use of
  public keys and runs as an integrated system
  service.
• The encrypting users public key is used in the
  encryption process.
• Encryption and decryption are done transparently
  during the I/O process.
• EFS supports encryption and decryption of files
  stored on remote NTFS volumes.

16
Data Protection

• EFS uses a combination of the users public key
  and private keys as well as a file encryption
  key.
• Windows 2000 uses the Data Encryption Standard X
  algorithm to encrypt files.

17
Data Recovery

• The Encrypted Data Recovery Policy is used to
  specify who can recover data in case a users
  private key is lost.
• For security, recovery is limited to the
  encrypted data it is not possible to recover
  users keys.

18
Encrypted Backup and Restoration

• Members of the Backup Operators group do not have
  the keys necessary for decryption.
• Encrypted data is read and stored in the backup
  as an opaque stream of data.

19
Fault Tolerance

• The processes of encryption and decryption are
  automatic and transparent to users and
  applications.
• You can encrypt a file or folder in Windows
  Explorer and from the command prompt.
• If an operation cannot be completed, it is
  completely undone.
• Example power outage during encryption
  operation, EFS undoes operation.

20
EFS Encryption
21
EFS Decryption
22
EFS Recovery
23
Cipher Command-Line Utility (pg 653)

• The cipher command-line utility allows you to
  encrypt and decrypt files from a command prompt.
• The cipher command includes a number of
  parameters.

24
IP Security (IPSec) ( 658)

• IPSec protects sensitive data on a TCP/IP
  network.
• The computer initiating communication
  transparently decrypts the data by using IPSec.
• The destination computer transparently decrypts
  the data before passing it to the destination
  process.
• IPSec ensures that any TCP/IP-based communication
  is secure from network eavesdropping.

25
Example of IPSec Communication
26
Kerberos Protocol in Windows 2000 (pg 663)

• Kerberos is the default authentication provider
  in Windows 2000 and the primary security
  protocol.
• Kerberos verifies the identity of the user and
  the integrity of the session data.
• Kerberos operates as a trusted third party to
  generate session keys and grant ticketsfor
  specific client/server sessions.
• When the Kerberos service issues a ticket, it
  contains a number of components (pg 664).
• The expiration period of a ticket is defined by
  the domain policy.

27
Kerberos Terminology

• Principal
• Realm
• Secret key
• Session key
• Authenticator
• Key distribution center (KDC)
• Privilege attribute certificate (PAC)
• Ticket
• Ticket granting ticket (TGT)

28
Features of the Kerberos Protocol

• Mature open standard
• Faster connection authentication
• Mutual authentication
• Delegation of authentication
• Transitive trust

29
Kerberos Authentication Process (pg 668)
30
Kerberos Delegation (pg 670)
31
Local Interactive Logon (pg 671)
32
Domain Interactive Logon (pg 671)
33
Security Configuration (pg 674)

• The Security Configuration and Analysis snap-in
  can be used to directly configure local system
  security.
• You can import security templates and apply them
  to the group policy object (GPO) for the local
  computer.

34
Security Analysis

• The state of the operating system and
  applications is dynamic.
• Regular analysis enables an administrator to
  track and ensure an adequate level of security.
• The Security Configuration and Analysis snap-in
  enables quick review of security analysis
  results.
• You can use the Secedit command-line utility to
  analyze a large number of computers.

35
Group Policy Snap-In

• Through the use of GPOs in Active Directory
  services, administrators can centrally apply the
  security levels required to protect enterprise
  systems.
• The Group Policy snap-in allows you to configure
  security centrally in the Active Directory store.
• The security settings allow group policy
  administrators to set policies.

36
Windows 2000 Auditing (pg 682)

• Auditing is the process of tracking both user
  activities and Windows 2000 activities on a
  computer.
• An audit entry in the Security log contains
  several types of information.
• You can use an audit policy to define security
  events.

37
Planning an Audit Policy

• You must determine the computers on which to set
  up auditing.
• Auditing is turned off by default.
• You can audit a number of events (pg 683).
• You must determine whether to audit the successes
  and failures of events.
• Follow the recommended guidelines when
  determining an audit policy.

38
Configuring Auditing

• You can implement an audit policy based on the
  role of the computer in the Windows 2000 network.
• You must follow specific requirements to set up
  auditing (pg 685).
• Setting up auditing is a two-part process (pg
  685).

39
Setting an Audit Policy (pg 686)
40
Auditing Access to Files and Folders

• You can set up auditing for files and folders on
  NTFS partitions.
• Once you set up an audit policy, you enable
  auditing for specific files and folders and
  specify which types of access, by which types of
  users or groups, to audit.

41
Auditing Access to Active Directory Objects

• You must configure an audit policy and then set
  auditing for specific objects.
• To enable auditing of access to Active Directory
  objects, enable the appropriate policy in the
  Group Policy snap-in.
• To enable auditing for specific Active Directory
  objects, use the Active Directory Users and
  Computers snap-in.

42
Auditing Access to Printers

• Enable the Audit Object Access policy, and then
  enable auditing for the specific printer.
• You can set up auditing on a printer in the
  properties for that printer.

43
Using Windows 2000 Logs (pg 689)

• There are three types of logs Application,
  Security, and System
• When you first start Event Viewer, it
  automatically displays all events that are
  recorded in the selected log.
• You can use the Find command to search for
  specific events.
• You can archive event logs and compare logs from
  different periods.
• You can configure the properties of individual
  audit logs.
• Archiving Security logs allows you to maintain a
  history of security-related events.
• You can use Event Viewer to save a log file,
  clear all events, or open a log file.