Review: Much to like in Windows Server 2008

1 2 3 4 5 6 7 8 Page 5
Page 5 of 8


The need for drive encryption has been a popular topic in a lot of security channels lately, and in both Windows Vista and Windows Server 2008 Microsoft has risen to the call by developing a feature called BitLocker.

BitLocker is designed especially for scenarios where a thief may gain physical access to a hard drive. Without encryption, the hacker could simply boot another operating system or run a hacking tool and access files, completely bypassing the NTFS file system permissions. The Encrypting File System (EFS) in Windows 2000 Server and Windows Server 2003 went a step farther, actually scrambling bits on the drive, but the keys to decrypt the files weren't as protected as they should have been. With BitLocker, the keys are stored within either a Trusted Platform Module chip on board your system, or on a USB flash drive that you insert upon boot up.

BitLocker is certainly complete: when enabled, the feature encrypts the entire Windows volume including both user data and system files, the hibernation file, the page file and temporary files. The boot process itself is also protected by BitLocker -- the feature creates a hash based on the properties of individual boot files. So if one is modified and replaced by, for example, a Trojan file, BitLocker will catch the problem and prevent the boot. It's definitely a step up from the limitations of EFS, and a significant improvement to system security over unencrypted drives.

Device installation control

Another security problem plaguing business everywhere is the proliferation of the USB thumb drive. No matter how securely you set your permissions on your file servers, no matter how finely tuned your document destruction capabilities are and no matter what sort of internal controls you have on "eyes-only" documentation, a user can simply pop a thumb drive into any open USB port and copy data over, completely bypassing your physical security.

These drives often contain very sensitive information that ideally should never leave the corporate campus. But they're just often found on key chains that are lost, inside computer bags left unattended in an airport lounge or in some equally dangerous location. The problem is significant enough that some businesses have taken to disabling USB ports by pouring hot glue into the actual ports. Effective, certainly, but also messy.

In Windows Server 2008, an administrator will have the ability to block all new device installs, including USB thumb drives, external hard drives and other new devices. You can simply deploy a machine and allow no new devices to be installed. You'll also be able to set exceptions based on device class or device ID -- for example, to allow keyboards and mice to be added, but nothing else. Or you can allow specific device IDs, in case you've approved a certain brand of product to be installed, but no others. This is all configurable via Group Policy, and these policies are set at the computer level.

Windows Firewall with advanced security

The Windows Firewall version included with Windows Server 2003 Service Pack 1 was exactly the same as that included in Windows XP Service Pack 2. Microsoft bundled that firewall with Service Pack 1 as a stopgap measure -- deploy this firewall now, they said, so you will be protected, and we will work to improve the firewall in the next version of Windows.

That time is here. The new Windows Firewall with Advanced Security combines firewall and IPsec management into one convenient MMC (Microsoft Management Console) snap-in. The firewall engine itself has been rearchitected to reduce coordination overhead between filtering and IPsec. More rules functionality has been enabled, and you can specify explicit security requirements such as authentication and encryption very easily.

Settings can be configured on a per-Active Directory computer or user group basis. Outbound filtering has been enabled; there was nothing but internal filtering in the previous version of Windows Firewall. And finally, profile support has been improved as well -- on a per-computer basis, there is now a profile for when a machine is connected to a domain, a profile for a private network connection and a profile for a public network connection such as a wireless hotspot. Policies can be imported and exported easily, making management of multiple computers' firewall configuration consistent and simple.

1 2 3 4 5 6 7 8 Page 5
Page 5 of 8
7 inconvenient truths about the hybrid work trend
Shop Tech Products at Amazon