Lab 11-1: Providing Application-Layer Security for Contoso Ltd.

Lab Objectives

This lab prepares you to plan the design application-layer security by meeting the following objectives:

• Design an SMB signing solution
• Design a digital signature solution for e-mail security
• Design an encryption solution for e-mail security
• Design SSL security for applications

About This Lab

This lab looks at the planning that Contoso Ltd. must do to ensure that security is deployed at the application layer to meet the organization's security needs. You need to make decisions on the configuration and deployment of the technologies that are required to meet the company's objectives.

Before You Begin

Make sure that you've completed reading the chapter material before starting the lab. Pay close attention to the sections where the design decisions were applied throughout the chapter for information on building your administrative structure.

Scenario: Contoso Ltd.

Contoso Ltd., an international magazine sales company, wants to use application-layer security in several future endeavors. Application-layer security is being considered to restrict data transmissions to members within a project team, protect e-mail messages, and secure a subscription and back issue ordering Web site.

Planning a New Publication

Contoso is currently in the research stage for a new magazine that will focus on the entertainment industry in North America. The Seattle office will handle all the work on the publication.

The magazine's project team consists of 20 employees led by the executive editor at the Seattle office. Of the 20 employees, 18 currently have Windows 2000 Professional desktops or laptop computers. The two summer interns are using older desktop computers running Windows 95.

Management has decided that only members of the project team should be able to connect to the project server named PHOENIX. Access to the PHOENIX server must be protected so that only members of the project team can connect to it. On a previous project, a former employee renamed his desktop computer to match the name of another server and gained access to documents that project members saved to their computers. This occurrence must be prevented in the new magazine project.

Taking Over a Competing Publisher

Contoso has been approached about buying a small U.S. publisher named Lakes & Sons. Both companies have agreed to the takeover, and the lawyers are drafting the final agreement.

Because information about the takeover has been reported in the local press, management is concerned that there is an internal leak. The article reported the impending takeover and discussed the possibility that Lakes & Sons would drop several titles after the takeover was completed.

Management can't determine if a staff member leaked the information or whether someone outside the organization intercepted an e-mail message regarding the takeover. Management wants to ensure that all future e-mails sent to the lawyers are protected against modification and inspection as the e-mail messages cross the Internet.

Establishing an E-Business

Contoso wants to offer subscription services and back-issue ordering services for all their magazine titles. Contoso sees two separate types of clients who will connect to their external web site (ww.contoso.tld).

• Frequent visitors. Frequent visitors will establish a relationship with Contoso by joining the Contoso Club, which involves acquiring a digital certificate for authentication with the Contoso Web site. The digital certificate allows the customer to order subscriptions and back issues without providing any additional information. All required information will be provided during the certificate request process. The customers will be allowed to update their profile information (address, credit card, phone number) by accessing a profile Web page.
• One-time visitors. Through market research, Contoso has learned that some infrequent visitors to the Web site also want to purchase back issues of Contoso magazines. Contoso will make one-time purchases possible by having the customer input all required information, such as mailing address and credit card, and make the order directly over the Internet.

The Web site must be protected so that all visitors can be sure that any information entered into the site will be kept confidential. When a visitor accesses the Web site and wants to order a subscription or purchase a back issue, the visitor is offered the choice of logging on with the Contoso Club membership by using a digital certificate or accessing a secured Web page where the transaction can be completed by using a Web form.

Contoso wants to reduce the time it takes to revoke a customer's certificate. In the past year the company processed more than $10,000 worth of fraudulent sales that should have been rejected but weren't because certificate revocation was too slow.

Exercise 1: Planning SMB Signing for Contoso Ltd.

This exercise looks at the security design required to implement SMB signing to meet the requirements defined by Contoso for the new magazine project. The answers to these questions can be found in the appendix.

1. What application-layer security solution can you use to ensure that both the client and the server are mutually authenticated?
   
   
   
2. Are there any barriers that prevent the implementation of SMB signing to protect communications with the PHOENIX server?
   
   
   
3. With the current network configuration, how must SMB signing be configured for the PHOENIX server?
   
   
   
4. How should the Windows 2000–based computers be configured to allow access to the PHOENIX server yet not prevent access to other servers on the network?
   
   
   
5. What would be the best way to deploy the computer accounts in Active Directory to meet the security requirements for SMB signing?
   
   
   
6. If the Windows 95 computers were upgraded to Windows 98, how would this affect your design?
   
   
   
7. In addition to SMB signing, what other security should you consider at the PHOENIX server to restrict access to the project data?
   
   
   

Answers

Exercise 2: Designing Secure E-Mail for Contoso

This exercise looks at the security design required to implement secure e-mail for Contoso. The answers to these questions can be found in the appendix.

1. If e-mail sent to the lawyers' office is to be secured, what must you determine first to ensure that secure e-mail can be exchanged?
   
   
   
2. If the CA hierarchy that Contoso uses to issue certificates is self-hosted, what issues must you consider in the secure e-mail project?
   
   
   
3. If the certificates issued to Contoso employees are from an internal CA, what methods can be used to distribute the public keys associated with the certificates to the lawyers?
   
   
   
4. If the certificates issued to the lawyers are from a public CA, what method can be used to distribute the public keys associated with the certificates to the lawyers?
   
   
   
5. How will public keys be obtained for secure e-mail messages exchanged between employees of Contoso?
   
   
   
6. How should e-mail from Contoso to the lawyers be sent to meet security objectives?
   
   
   

Answers

Exercise 3: Planning a Secure Web Site

This exercise looks at the security design required for the subscription and back-issue pages on Contoso's Web site. The answers to these questions can be found in the appendix.

1. Do you need to apply SSL encryption to the entire Contoso Web site?
   
   
   
2. What can you do at the Contoso Web site to ensure that only strong encryption is used to secure the SSL-protected Web forms?
   
   
   
3. Where should you acquire the Web server certificate for the Contoso Web site?
   
   
   
4. For customers who want to authenticate by using digital certificates, from where should the certificate be acquired?
   
   
   
5. What must you include in the infrastructure design to support the customer certificates?
   
   
   

Answers