Security Design in a Windows 2003 Environment

CIS 288 Designing a Secure Network Framework

Objectives
Analyze Business Requirements for Security Design Determine Requirements for Securing Data Analyze existing Current Security Practices Design a Framework for Implementing Security Analyze Technical Constraints when Designing Security

Analyzing Business Requirements for Security Design

Organizations will make an investment in network security to protect their data and resources, or assets, from anything that might damage those assets, or threats. Quantitative losses and Qualitative losses Analyzing Existing Security Policies and Procedures
Physical Policies Technical Policies Administrative Policies

 Acceptable Use Policies Privacy versus Security

Analyzing Business Requirements for Security Design (continued)

When considering your companys privacy policy, remember that IT and security professionals themselves can sometimes introduce risks to the privacy of information because of their nearly unlimited access to network data and resources

Determining Requirements for Securing Data

When securing data, a common phrase that you should be familiar with is CIA, which stands for:
Confidentiality Integrity Availability

The CIA triad makes up all the principles of network security design

Analyzing Current Security Practices

A step that is commonly overlooked in designing any network is examining where a company or network is at currently. Your evaluation of current security practices should extend not only to administrative policies issued by IT or Human Resources, but also any technical measures that are already in place or lacking. Using Resultant Set of Policy

Designing a Framework for Implementing Security

Designing a secure network framework can be broken into four conceptual pieces. They include: Attack prevention Attack detection Attack isolation Attack recovery STRIDE model Risk Management Incident Response

Analyzing Technical Constraints when Designing Security

While it would be ideal to design a security system using all of the latest and greatest technology, budgetary constraints can often limit the scope of a network security design. Before you can begin planning a Windows Server 2003 implementation, you need to determine if your existing computer and networking hardware will support this new technology. Bandwidth requirements are not quite as critical from a security standpoint

 Identifying Technology Limitations Analyzing Interoperability Constraints

Analyzing Technical Constraints when Designing Security (continued)

The introduction of other operating systems and services, such as Unix, DNS and MIT Kerberos, presents unique challenges when creating your security design. Finally, when supporting non-Microsoft clients such as Macintosh, you need to ensure that the clients have a common protocol installed so that they can communicate with the Windows network, and that this protocol meets your organizations security requirements.

Summary
Analyzing Business Requirements for Security Design Determine Requirements for Securing Data Current Security Practices Designing a Framework for Implementing Security Analyzing Technical Constraints when Designing Security