One of the things you have to deal with when operating a network firewall is to allow only the traffic inbound and outbound that you want. That’s the entire point of having a firewall — to control (and perhaps log and report on) traffic moving into and out of your network. In order to do that, you need to understand some characteristics of that traffic.

Web traffic is easy. If you want to allow outbound Web traffic, you configure your firewall to allow TCP ports 80 and 443 outbound (80 is typically used for unencrypted traffic, while 443 is usually used for encrypted, or SSL protected traffic). If you want to allow Internet users access to your Web servers, you allow TCP ports 80 and 443 inbound to the IP address of your Web server.

There are other “simple” protocols that require only a single port inbound or outbound. For example, SMTP mail traffic uses only TCP port 25. If you want to send mail out, allow TCP port 25 outbound. If you want to accept incoming SMTP mail to your mail server, allow inbound TCP port 25.

But not all protocols are that simple, and that’s when the issue of “opening a port” comes into play. For example, consider FTP. In order to make the outbound connection to the FTP server, you need to allow outbound TCP port 21. However, in order to receive data, the FTP server will need to open a new connection inbound on a port negotiated between the FTP client (or firewall) and the FTP server.

So, in this example, what port do you open? What does it mean to “open a port”? In reality, it means nothing, because the term “open a port” implies that a port is bidirectional, which is it not. When you “open a port”, you allow inbound or outbound connections, so there’s directionality. Also, do you open it to all hosts, or just to a particular host? What about source IP address? Does the inbound or outbound port require that there be a specific source IP address?

The next time someone tells you to “open a port”, ask them:

1. Open it in what direction? Inbound or outbound?

2. Open it to a specific host (IP address) or all IP addresses?

3. Is there a specific source port that should be allowed?

By asking these questions, you’ll have a more secure firewall configuration and you won’t inadvertently allow traffic into or out of your network that could cause you to be compromised.

HTH,

Tom

Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
GET THE NEW BOOK! Go to http://tinyurl.com/2gpoo8
Email: tshinder@isaserver.org
MVP — Microsoft Firewalls (ISA)

Regulatory compliance looms large on the minds of IT Pros and business decision makers. One mistake could cost you your job, your reputation and maybe your liberty. Compliance is a process that includes people, processes, and documentation — and software. What software can you use to help you reach and maintain regulatory compliance requirements? Here’s a list of software categories and some suggestions of Microsoft software that can help you meet the requirements for each category:

Identity Management Solutions
Being able to identify resources by type and function and employees by their job roles makes compliance much easier. Identity management solutions can manage the provisioning, transfer, and removal of employees from your corporate systems. The chosen system should tie into all other systems as a means to identify all legitimate systems users for a company. This helps in precisely identifying who is involved in each business process. Consider Windows Server 2008 Identity Lifecycle Manager, Active Directory Federation Services and Active Directory for Identity management.

Change Management Solutions
Change management solutions provide a formal means to manage changes to corporate resources. For example, any time a customer record, spending limit, business process, or computer configuration gets modified, it could go through a submission, reviewer, and approver process that is recorded for auditing purposes. In that manner, a company will be able to determine why resources are in the state they are. Consider System Center Operations Manager and System Center Configuration Manager.

Document Management Solutions
Document management solutions manage the life cycle of a document, including such features as change management, access control, versioning, backup, and retention policies. These solutions help companies achieve SOX, HIPAA, and GLBA requirements for restricting access to documents that may contain sensitive customer or financial data. Consider SharePoint Server and Windows Rights Management Services

Risk Management Solutions
A great risk management solution will help companies prioritize and monitor the deployment of compliance projects. Developing corporate policies are valuable only when they are placed into practice. Tracking compliance is key to reducing risks that could negatively affect the company. Check out the Secuirty Risk Management Guide http://www.microsoft.com/technet/security/guidance/complianceandpolicies/secrisk/default.mspx

Business Process Management Solutions
Business process management (BPM) applications help provide end-to-end visibility and control over all segments of complex, multi-step information requests or transactions that involve multiple applications and people in one or more organizations. In terms of regulatory compliance, BPM helps ensure transaction security, reliable service and availability, and service level refinement. Consider BizTalk Server.

Project Management Solutions
Project management solutions apply knowledge, skills, tools, and techniques to a broad range of activities to help meet the requirements of the particular project. Organizations use project management solutions to help implement projects, ensure operation reliability, and maintain compliance programs. Consider Microsoft Project and Project Server.

Network Security Solutions
Network security solutions constitute a broad solution category designed to address the security of all aspects of the network for the organization, including firewalls, servers, clients, routers, switches, and access points. Many regulations require organizations to take steps to provide appropriate security for the IT environment. Because network security is a critical element to overall information security, it is important for regulatory compliance. Consider the ISA Firewall and the IAG SSL VPN Gateway. Also, consider IPSec domain isolation and NAP. Also, Terminal Services Gateway.

Host Control Solutions
Host control solutions control the operating systems in servers and workstations. Host control is fundamental to all of the core security control categories, such as confidentiality, integrity, and availability. Consider Group Policy and System Center Configuration Manager. Also, consider Forefront Client Security.

Malicious Software Prevention Solutions
Malicious software prevention solutions include Antivirus, antispyware and antispam solutions, as well as rootkit detectors. Without applications that you can use to help detect, monitor, and remove malicious software, there is an increased risk that sensitive corporate information in your organization could be compromised or destroyed. Consider Forefront Client Security for centralized management of Antivirus and anti-spyware. Also, consider Forefront Security for Exchange and Forefront Security for SharePoint.

Application Security Solutions
Application security combines good development practices with specific software security and involves key application controls that auditors focus on as they examine critical business systems. Consider the Microsoft SDL http://msdn2.microsoft.com/en-us/library/ms995349.aspx

Messaging and Collaboration Solutions
Messaging and collaboration programs provide a large productivity improvement for teams engaged in achieving compliance objectives, and they add to the overall efficiency of the organization. Collaboration applications can range from integrated document programs, such as Microsoft® Office to portals, instant messaging, online presentation software, and peer-to-peer programs. Consider Outlook 2007 and Exchange 2007

Data Classification and Protection Solutions
Data classification and protection deals with how to apply security classification levels to the data either on a system or in transmission. Data classification is important to compliance because it informs users about what levels indicate the relative importance of the data, how they must handle the data, and how they must safeguard and dispose of it. Consider Chapter 4 of the Regulatory Compliance Planning Guide http://www.microsoft.com/technet/security/guidance/complianceandpolicies/compliance/rcguide/4-11-00.mspx?mfr=true

Authentication, Authorization, and Access Control Solutions
This control objective is critical to helping to meet the requirements of the core security principles of confidentiality, integrity, and availability. Authentication usually involves a user name and a password, but it can include additional methods to demonstrate identity, such as a smart card, retina scan, voice recognition, or fingerprints. Authorization focuses on determining if someone, after the person is identified, is permitted to access requested resources. Access is granted or denied depending on a wide variety of criteria, such as the network address of the client, the time of day, or the browser that the person uses. Consider NTFS and Share Permissions, ADFS, AD DS, ISA Firewalls, IAG SSL VPN gateways, Smartcard support in Windows Vista, ad EFS.

Training Solutions
Regulatory compliance demands that organizations address security and compliance training. Security and compliance training solutions in most organizations are typically modifications of existing training software solutions. This training should cover corporate and departmental compliance. Consider www.mslearning.com

Physical Security Solutions
Physical security solutions secure physical access and control of the systems and workstations in your organization. Consider Brinks Security.

Vulnerability Identification Solutions
Vulnerability identification solutions provide tools that you can use to help test for vulnerabilities in your organization’s information systems. Regularly monitoring computers and servers for vulnerabilities in the organization is extremely important because it provides a controlled platform on which to run business application software. A compromised environment is not under control, making it unsuitable to run business software that is compliant. Consider the MBSA and Forefront Client Security. Also, System Center Operations Manager.

Monitoring and Reporting Solutions
Monitoring and reporting solutions collect and audit logs that result from authentication and access to systems. These solutions are either designed to collect specific information based on compliance to certain regulations, or use existing logs built into operating systems or software packages. Consider System Center Operations Manager.

Disaster Recovery and Failover Solutions
In the event of a natural or man-made disaster, the information systems for the organization must return to an operational state as quickly as possible. Many regulations and standards explicitly require disaster recovery and failover solutions. Consider Windows Server 2008 Failover Clustering and NLB. Also, consider Microsoft Data Protection Manager.

Incident Management and Trouble-Tracking Solutions
Incident management and trouble-tracking solutions use customized systems that manage specific business processes from beginning to end. Several regulations and standards specifically require organizations to use incident management and trouble-tracking solutions. Consider SharePoint Server.

HTH,

Tom

Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
GET THE NEW BOOK! Go to http://tinyurl.com/2gpoo8

Email: tshinder@isaserver.org
MVP — Microsoft Firewalls (ISA)

If you spend much time reading the network security trade journals and newsletters, you might be aware that many of the hardware vendors out there are pushing something called NAC, which means Network Access Control. The goal of these hardware vendors is to provide a mechanism to insure that only healthy client machines should be allowed to connect to the network. Client health, of course, is based on software configuration.

So, if you’re going to choose a solution that’s designed to control access to the network basis on software status and configuration, do you really think hardware vendors are the best solution? It would make sense to use a solution created by a company who only does software. It would be even better if that company is the one that makes the operating system you use on over 95% of the computers on your network.

Well, there is such a solution — Microsoft’s upcoming Network Access Protection or NAP. When Windows Server 2008 comes out next year, you will be able to control who can access your network, or parts of your network, based on the current software status and configuration of the machines connecting to the network. Who better than Microsoft to create a software solution to a software problem?

NAP will work with Windows XP SP3 and Vista clients and it will allow you to control those clients access to the network based on their operating system configuration, AV status and AS status. Third party software makers will be able to hook into the NAP infrastructure, so that you can further extend the required security and software configuration on the client before allowing them onto your network. The best thing is, the client side agent is built into Vista and Windows XP SP3 — no need for third party agents that can be the cause of the classic “finger-pointing” game when things go haywire.

Another nice thing is that there will be Linux and Mac support. From what I hear, Microsoft is creating the Linux piece and ISVs will work on the Mac NAP client. Nice! In addition, NAP will work together to Cisco hardware to work together to Cisco NAP solutions.

I’ve been using NAP for a few months now on my Windows Server 2008 beta network and it’s a dream come true. No longer do I need to worry about customers and guests connecting to my WAP and infecting my network. They just have no access, period. And what’s even better, I can still allow them access to the Internet using NAP controls without having to do anything fancy on my firewalls to support these guests.

I highly recommend that you give the Windows Server 2008 NAP a try. There’s plenty of information on NAP on the Microsoft NAP site at http://technet.microsoft.com/en-us/network/bb545879.aspx

Also, the NAP Team Blog is a great place to get inside information about NAP. Check that out at: http://blogs.technet.com/nap/

HTH,

Tom

Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/2gpoo8
Email: tshinder@isaserver.org
MVP — Microsoft Firewalls (ISA)

In Windows Vista, you have BitLocker protection that enables you to secure the contents of your hard disks against anyone who might try to read the data on disk. However, there might be times when you want to make sure that nobody can possibly retrieve data from your hard disk. While BitLocker is an extremely effective measure, it’s still possible that someone will be able to get your PIN or password and USB key. For example, someone might threaten your life or the lives of loved ones if you don’t give them what they need to access your hard disk.

If you need bullet-proof protection against data leakage, the best way to do it is to destroy your hard disk. But that’s hard to do — suppose you’re at the airport and you can’t let snooping authorities inadvertently leak information about your next IPO, or attorney/client information, or doctor/patient information, or PII stored on your hard disk that could get you into major regulatory compliance issues if you give over your encryption keys.

So how do you destroy you hard disk without creating a nuisance? You use a “Dead on Demand ENHANCEDHARDDRIVE” by Ensconce Data Technology. These work by imbedding a destructive chemical inside the disk casing (assumed to be some sort of acid) that physically destroys the hard disk platters. There’s no way data will ever be retrieved after the platters are destroyed by acid! Ensconse claims that no other component of the computer will be harmed. So, as long as you have a disk image handy in a safe location, you can just get a new disk and apply the image to it and you’re good as new!

For more information, check out: http://www.deadondemand.com/products/enhancedhdd/

HTH,

Tom

Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/2gpoo8
Email: tshinder@isaserver.org
MVP — Microsoft Firewalls (ISA)

I’ve got a real treat for you! An eight part Web cast series given by one of the most knowledgeable security presenters in the business — Kai Axford. I guarantee that you’ll learn something that you can use after watching each of these sessions.

TechNet Webcast: 2008 Defense in Depth Security Series (Part 1 of 8): Why Does Security Matter? (Level 200)

Monday, January 7, 2008

11:30 A.M.–12:30 P.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 2 of 8): All Bark and No Bite (Level 200)

Tuesday, January 8, 2008

11:30 A.M.–12:30 P.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 3 of 8): Gates, Guards, and Guns (Level 200)

Wednesday, January 9, 2008

9:30 A.M.–10:30 A.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 4 of 8): Living on the Edge (Level 200)

Thursday, January 10, 2008

11:30 A.M.–12:30 P.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 5 of 8): Keeping Your House in Order (Level 200)

Monday, January 14, 2008

11:30 A.M.–12:30 P.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 6 of 8): Save the Box, Save the Network (Level 200)

Tuesday, January 15, 2008

11:30 A.M.–12:30 P.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 7 of 8): If You Build It (Securely), They Won’t Come (Level 200)

Wednesday, January 16, 2008

11:30 A.M.–12:30 P.M. Pacific Time

TechNet Webcast: 2008 Defense in Depth Security Series (Part 8 of 8): If a Terabyte Falls in the Middle of the (Active Directory) Forest (Level 200)

Thursday, January 17, 2008

11:30 A.M.–12:30 P.M. Pacific Time

HTH,

Tom

Thomas W Shinder, M.D.
Site: http://www.isaserver.org/
Blog: http://blogs.isaserver.org/shinder/
Book: http://tinyurl.com/2gpoo8
Email: tshinder@isaserver.org
MVP — Microsoft Firewalls (ISA)

Welcome to my new blog here on www.windowsecurity.com! My name is Dr. Tom Shinder and you might know me from my years over at www.isaserver.org. For the last ten years of my work life, I’ve dedicated myself to consulting and writing about Microsoft networking and security topics. During the last decade, I’ve had the opportunities to write on my own, or in collaboration with others, over 30 books on planning, installing, operating and securing Microsoft networks.

In this blog, and in the articles I’ll publish on www.windowsecurity.com, I’ll focus on Microsoft security technologies and products and how you can use those products and technologies to help secure your network and reach the ever increasing regulatory compliance issues that you’ll encounter over the coming years. I think you’ll be amazed at how Microsoft has changed from a company that paid relatively little attention to security in the past to one that has one of the most comprehensive security product and technology portfolios in the computer software industry today.

Another thing about this blog is that I’ll try to orient toward the MS network admin who isn’t planning on become the security expert in his organization. This means that I’ll focus on things that you can do to defend and protect your network now. I won’t try to turn you into a hacker, and I won’t try to educate you into the hacker’s mindset. Instead, I hope to provide you with the tools, technologies and methodologies that you can use to protect yourself from the bad guys, without trying to teach you how to become one of the bad guys.

I’m looking forward to working with all of you in the years to come and hope that we’ll have some active and professional discussions on this blog. We can all learn something from each other and ideally I’ll learn more from all of you than you learn from me! Just about everything I know I’ve learned from someone else, so let’s hope that positive trend continues on this blog.

I’ve configured to blog to notify me when you post a reply and I’ll try to reply ASAP after your post.

Thanks!