Hardening Windows Server 2008 – Part 2

Bitlocker Encryption

In Windows 2008 server, Bitlocker drive encryption can be used to encrypt and therefore protect the operating system and data files stored on the hard disk. Bitlocker encryption will prevent unauthorized users from accessing your sensitive data on a drive which has been misappropriated. This is also important from compliance  perspective where data privacy and security are critical requirements.

To access the data protected by bit locker, a USB flash drive that stores the encryption key (created by Bitlocker) needs to be inserted into the USB port before system startup. Bitlocker also offers an optional feature which allows for integrity verification of system boot files so that any unauthorized changes such as malicious modification of boot files can be detected. However, for this feature to work, Bitlocker needs a computer system that has TPM (Trusted Platform Module) and TCG (Trusted Computing Group) compatible BIOS.

BitLocker Drive Encryption requires two different hard disk partitions to function properly:

  1. OS Volume: This volume is encrypted and stores OS (operating system) files and any other information/data which needs to remain confidential or in accessible to unauthorized users.
  2. System Volume: This volume contains the unencrypted boot information which is used by Bitlocker and needs to be at least 1.5 GB in size.

Bitlocker provides for full volume encryption and has to be installed and enabled before it can be used. To install BitLocker, go to Server manager > click on the Add New Features option > select Bitlocker Drive Encryption as shown below

hardening windows server

Fig 1: Installing Bitlocker

Alternatively, type the following at a command prompt: ServerManagerCmd -install BitLocker –restart to Install and enable Bitlocker.

Continues…

Hardening Windows Server 2008 – Part I

Windows Server 2008 provides a wealth of methods for hardening the operating system against a malicious attack.

Server Core installation

Windows Server 2008 and Windows Server 2008 R2 operating systems offer a secured installation option called “Server Core installation” .Selecting this option installs only the minimal components which are required for running a specific server role. This is very important from reducing the ‘attack service area’. Apart from the security aspect, a minimal installation will also decrease overhead in administering and maintenance activities.

Note that the server core installation for Windows Server 2008 does not include the Graphical User Interface functionality and also doesn’t support ASP.NET and .NET Framework. However, in Windows Server 2008 R2 the Server Core includes the .Net Framework

For detailed procedures related to Windows Server 2008 Server Core installation, visit Server Core Installation Option of Windows Server 2008 Step-By-Step Guide.

Hardening the Windows Server using the Security Configuration Wizard ( SCW)

Security configuration wizard simplifies much of the security policy configuration on the OS installation and can be installed by using the “add and remove windows components”.  It offers multiple XML profile templates which offer customized security policy implementation depending on the role that your server will perform.

hardening windows server
Fig 1: Security Configuration Wizard (SCW)


SCW allows for disabling unused ports and services which are not required by your server role and also cleans up the windows firewall rule base by allowing for deletion of unused firewall rules and modification of existing rules. One can also alter the registry settings through SCW and configure the protocols that your Windows 2008 server deployment will use to communicate with earlier versions of Windows. 

Continues…

IIS 7.5 and IIS 7.0 Security Best Practices – Part I

In this series of two articles, we will review some key hardening mechanisms for a corporate intranet hosted IIS 7.5 or IIS 7.0 web server running on Windows server 2008. These best practices would mitigate the risk of unauthorized access to the IIS 7.5 or IIS 7.0 installation.

Microsoft IIS 7 has an inherently stronger security design as compared to its predecessors. A default installation of IIS 7 , will only provide minimal functionality and any additional one, if needed, will have to be explicitly selected and installed by the user.

This ‘minimal installation by default’ approach reduces the ‘attack surface area’ of our website. The less functionality one installs, the less exposed one is to attack from hackers and malicious code.

Let’s dive into some of the key security best practices that we can implement to strengthen IIS 7 security:

Secure Windows Server Installation

If the underlying OS is vulnerable, it will also render the IIS web server installation vulnerable to unauthorized access. Therefore, for optimal security, and if viable, we may wish to run IIS 7 out of a secure Windows 2008 installation. In Windows Server 2008 or Windows Server 2008 R2 environment, this can be achieved by deploying Server Core Installation.

Essentially, the server core option installs only the minimal components which are required for running a specific server role. This is very important from reducing the ‘attack service area’ perspective that we discussed earlier. Apart from the security aspect, a minimal installation will also decrease overhead in administering and maintainance activities.

A server running a Server Core installation of Windows Server 2008 supports various server roles such as DNS server, Web server, File server etc. For an exhaustive list of supported roles, visit: http://go.microsoft.com/fwlink/?LinkId=99832

Note that the server core installation does not include the Graphical User Interface functionality .Therefore, to manage it locally you can use the command shell or do the same remotely through MMC ( Microsoft Management Console) installed on another system. Additionally, since ASP.NET and .NET Framework related features are not supported by the server core installation, therefore if any of your web applications use these features you should not go for this type of installation.

For detailed procedures on installing (IIS) web server role with a Windows Server 2008 Server Core installation, visit Server Core Installation Option of Windows Server 2008 Step-By-Step Guide.

Configuring The Authentication Mechanism

If you don’t need public access to your website, you can leverage Windows authentication mode to restrict access to authorized individuals. Configuring windows authentication on your web server integrates it with Windows and Active Directory Domain Services .Each individual who wishes to access to your website will need to authenticate to your web server/integrated Active directory first.
Continues…