11 SECURITY PLANNING AND ADMINISTRATIVE DELEGATION Chapter 6

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION2 NAMING STANDARDS  Determine the standard for creating user account names  First initial, last name  First name, last initial, and so on  Naming standards document  Defines how user logon names should be created  Part of appropriate planning for Active Directory  Determine the standard for creating user account names  First initial, last name  First name, last initial, and so on  Naming standards document  Defines how user logon names should be created  Part of appropriate planning for Active Directory

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION3 WAYS TO SECURE USER ACCOUNTS  Education of users  Strong passwords  Smart cards  Biometrics  Education of users  Strong passwords  Smart cards  Biometrics

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION4 EDUCATING USERS  Use strong passwords  Keep passwords secure  Don’t write down passwords on paper or leave them in visible places.  Don’t share passwords.  Don’t save passwords to your computer.  Use strong passwords  Keep passwords secure  Don’t write down passwords on paper or leave them in visible places.  Don’t share passwords.  Don’t save passwords to your computer.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION5 STRONG PASSWORDS  Combination of at least 7 Upper and lower case letters, numbers, and symbols.  At least one character of each type  Alternate characters make passwords extra secure  When changing passwords, vary them by more than one character.  Don’t use your username, real name, or company name.  Don’t use words from the dictionary.  Combination of at least 7 Upper and lower case letters, numbers, and symbols.  At least one character of each type  Alternate characters make passwords extra secure  When changing passwords, vary them by more than one character.  Don’t use your username, real name, or company name.  Don’t use words from the dictionary.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION6 SMART CARD AUTHENTICATION

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION7 ENTERPRISE CERTIFICATION AUTHORITY REQUIRED

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION8 SMART CARD BENEFITS: INCREASED SECURITY  Keystroke loggers cannot capture passwords because users will not be typing them.  Password complexity is not something you have to teach or enforce upon your users.  Users will not be writing passwords on paper or sharing them.  Security risks related to password cracking or remote attacks are greatly reduced.  Keystroke loggers cannot capture passwords because users will not be typing them.  Password complexity is not something you have to teach or enforce upon your users.  Users will not be writing passwords on paper or sharing them.  Security risks related to password cracking or remote attacks are greatly reduced.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION9 SMART CARD CONSIDERATIONS  Additional software and administration.  Certification authority (CA)  Internet Information Server (IIS) to distribute smart cards  Need smart card readers for client computers.  Users could lose or forget their smart cards.  Users may be tempted to write their PIN on their smart card.  Additional software and administration.  Certification authority (CA)  Internet Information Server (IIS) to distribute smart cards  Need smart card readers for client computers.  Users could lose or forget their smart cards.  Users may be tempted to write their PIN on their smart card.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION10 ENABLING A USER ACCOUNT FOR SMART CARD AUTHENTICATION

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION11 ADMINISTRATOR ACCOUNT SECURITY  Strong password (rotate frequently).  Cannot hide the default administrative account from the experienced hacker (RID of 500).  Don’t use for daily tasks; you can use the Run As utility to increase privilege when required.  Allows you to use another user’s credentials without a log off event  Must be logged on interactively  Requires secondary logon service  Strong password (rotate frequently).  Cannot hide the default administrative account from the experienced hacker (RID of 500).  Don’t use for daily tasks; you can use the Run As utility to increase privilege when required.  Allows you to use another user’s credentials without a log off event  Must be logged on interactively  Requires secondary logon service

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION12 ORGANIZATIONAL UNIT (OU) STRUCTURE  Representing the company model  Delegation of administrative control  Group Policy  Hide objects within Active Directory  Representing the company model  Delegation of administrative control  Group Policy  Hide objects within Active Directory

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION13 DELEGATING ADMINISTRATIVE RESPONSIBILITY  OUs can help to decentralize administrative control.  You can give certain users or groups permissions to perform specific tasks within particular OUs.  Reset passwords.  Create and delete user accounts.  OUs can help to decentralize administrative control.  You can give certain users or groups permissions to perform specific tasks within particular OUs.  Reset passwords.  Create and delete user accounts.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION14 IMPLEMENTING GROUP POLICIES  Covered in greater depth in the following chapters.  Allows you to subdivide the organization based on the controls you’d like to implement.  Subdividing reduces the amount of Group Policy processing that computers must perform.  Faster user logons  Quicker computer startups  Covered in greater depth in the following chapters.  Allows you to subdivide the organization based on the controls you’d like to implement.  Subdividing reduces the amount of Group Policy processing that computers must perform.  Faster user logons  Quicker computer startups

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION15 HIDING OBJECTS  Can prevent users from seeing objects inside OUs to which they do not have Read access  Modify the Access Control List (ACL) on the OU  In order to see the OU ACL, you must enable Advanced Features on the View menu.  Remove Read permission to Authenticated Users.  Set appropriate permissions for the users you’d like to see the object.  Can prevent users from seeing objects inside OUs to which they do not have Read access  Modify the Access Control List (ACL) on the OU  In order to see the OU ACL, you must enable Advanced Features on the View menu.  Remove Read permission to Authenticated Users.  Set appropriate permissions for the users you’d like to see the object.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION16 CREATING AN OU STRUCTURE  Limit the number of nested OUs.  Three to five layers are typical.  Most agree that ten or more layers are excessive.  Book icon.  First-level OUs are directly below the domain.  Limit the number of nested OUs.  Three to five layers are typical.  Most agree that ten or more layers are excessive.  Book icon.  First-level OUs are directly below the domain.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION17 PYRAMID OU STRUCTURE Location1 AccountingProduction Location3 SalesMarketingAdministration Location2 cohowinery.com

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION18 FLAT OU STRUCTURE AccountingLocation1 2 3ProductionSalesMarketingAdministration cohowinery.com

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION19 USING OUs TO DELEGATE ACTIVE DIRECTORY MANAGEMENT TASKS  Compartmentalizes administration  Limit the number of administrators that have access to the entire domain or forest  Limit the scope of administrative control  Reset passwords.  Create and manage user accounts.  Create computer accounts.  Limits the scope of errors  Compartmentalizes administration  Limit the number of administrators that have access to the entire domain or forest  Limit the scope of administrative control  Reset passwords.  Create and manage user accounts.  Create computer accounts.  Limits the scope of errors

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION20 DELEGATION OF CONTROL WIZARD

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION21 VERIFYING AND REMOVING DELEGATED PERMISSIONS  Cannot use the Delegation Of Control Wizard to remove permissions  Must modify the ACL of the OU  Need to be sure Advanced Features is enabled on the View menu  Security tab is then visible.  You can modify permissions for users and groups.  Cannot use the Delegation Of Control Wizard to remove permissions  Must modify the ACL of the OU  Need to be sure Advanced Features is enabled on the View menu  Security tab is then visible.  You can modify permissions for users and groups.

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION22 MOVING OBJECTS BETWEEN OUs  Drag and drop from one location to the other in Active Directory Users And Computers  Move menu option  Dsmove  Movetree  Drag and drop from one location to the other in Active Directory Users And Computers  Move menu option  Dsmove  Movetree

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION23 PERMISSIONS  Those assigned directly to the OU remain  Those inherited are removed and replaced with permissions inherited from new parent OU or domain  Those assigned directly to the OU remain  Those inherited are removed and replaced with permissions inherited from new parent OU or domain

Chapter 6: SECURITY PLANNING AND ADMINISTRATIVE DELEGATION24 SUMMARY  Examples of naming standards.  User account security.  Passwords  User education  Smart cards  Reduce use of privileged accounts by using the Run As utility.  What should you consider when designing an OU structure?  What wizard can you use to delegate control? What is a limitation of this wizard?  Name several ways to move objects from one OU to another.  Examples of naming standards.  User account security.  Passwords  User education  Smart cards  Reduce use of privileged accounts by using the Run As utility.  What should you consider when designing an OU structure?  What wizard can you use to delegate control? What is a limitation of this wizard?  Name several ways to move objects from one OU to another.