Ensuring Security and Policy Enforcement

Do users and computers connecting to your network comply with your company’s security policy requirements? Is there any way to enforce that this is indeed the case? Yes, there is. In addition to standard policy enforcement mechanisms such as Group Policy and Active Directory authentication, Windows Server 2008 also includes the new Network Access Protection (NAP) platform. NAP provides a platform that helps ensure that client computers trying to connect to your network meet administrator-defined requirements for system health as laid out in your security policy. For example, NAP can ensure that computers connecting to your network to access resources on it have all critical security updates, antivirus software, the latest signature files, a functioning host-based firewall that’s properly configured, and so on. And if NAP determines that a client computer doesn’t meet all these health requirements, it can quarantine the computer on an isolated network until remediation can be performed or it can deny access entirely to the network. By using the power of NAP, you can enforce compliance with your network health requirements and mitigate the risk of having improperly configured client computers that might have been exposed to worms and other malware.

Want to find out more about NAP? Turn to Chapter 10, “Implementing Network Access Protection,” where I have a comprehensive description of the platform and how it’s implemented using Windows Server 2008 together with Windows Vista.

And if you really want to enhance the security of your servers, try deploying the Windows server core installation option of Windows Server 2008 instead of the full installation option. The Windows server core installation option has a significantly smaller attack surface because all nonessential components and functionality have been removed. Want to learn about this installation option? Turn to Chapter 6, “Windows Server Core,” for a detailed walkthrough of its capabilities and tasks related to its management.