Introduction

Securing a Windows Server 2003 enterprise network is hardly a small undertaking, but it becomes quite manageable if you approach it in an organized and systematic way. Before we can get into the specifics of configuring software, services, and protocols to meet an organization s security needs, we first need to determine what those needs are. In the first chapter of this book, we discuss the importance of understanding the Why? of the security design process before plunging headlong into the What? and How.

In attempting to answer that all-important Why? we open this chapter with a look at analyzing a company s business requirements for securing its network and data. This includes examining any existing security policies and procedures with an eye toward how they might be incorporated into the new design, or how they might need to change to accommodate a new security framework. This step includes technical elements such as analyzing security requirements for different kinds of data some financial or medical data might be subject to specific security or retention policies that a network administrator will need to address and more human elements such as managing user expectations of security versus usability, and designing security awareness training to transform a user base from obstacle to ally.

Once you ve determined your organization s security needs, your next questions is, Whom are we securing our data against? ( Knowing your enemy is a mantra to live by, whether you re Sun Tzu or a network security administrator.) This chapter delves into the kinds...