Re: Newbie General Security Question

Tech-Archive recommends: Fix windows errors by optimizing your registry

Microsoft Small Business Server and Security: It's All About Risk Management! -- TechNet Column - Security Management - December 2005:
http://www.microsoft.com/technet/community/columns/secmgmt/sm1205.mspx


Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] wrote:
Look around this newsgroup. In the years I've been manning the 2k3 newsgroup we get misconfiguration issues, we get stupid admin passwords being cracked, we don't get 'hacked'.

We do however have Secretaries downloading malware 'behind' SBS.

I'm a CPA who's data laws state that should something happen to my data I need to inform my clients.

My clients data is on a SBS box and I am very comfortable. My biggest enemy is not a 'hacker' it's the malware, it's the stupid passwords, it's me.

Robarb wrote:
Thanks for the response. I think I'm actually asking a bigger question. If I were to do the maximum I can do (like getting rid of the everyone group for my data drive), how secure is SBS? Has a hacker over the internet ever gotten through an ISA firewall (without the aid of an internal virus, etc.) and accessed data on a drive on the server without having an authorized password? If the server is healthy and uninfected in any way, has the 'permission' system proven to be completely secure?


"John C" wrote:

You have answered your own question. I suppose you could use the NTFS permissions and security as an extra step, take away the everyone group, replace with authenticated domain users and admins, etc. I am sure you will be fine, but nothing is totally secure, unless you unplug the network cable to the outside world :).

jC

"Robarb" wrote:

I have just installed and configured a brand new server with SBS SP1, ISA2004, and all updates. I am using it as an edge firewall to protect the 15 or so computers in my internal network. I have also set it up as the mail server for my internal network. I plan to eventually have it host a small publicly-accessible website which a few clients will have access to sporadically. I have also installed an internal 500GB RAID array and would like to use it as central secure storage for all the users in my internal network. The array will get automatically backed up to AIT-3 tape on a regular basis.

My question is this: How safe would the critical confidential data on the 500GB RAID array be? Can I trust SBS and ISA's frontline security to prevent unauthorized users from reaching this data from inside or the internet (the publicly-available website would be on a totally seperate hard drive within the server computer). How safe is this stuff?

All help is appreciated.

.

Relevant Pages

  • << SBS news of the week 12/6/2004>>
    ... Simply connecting to the Internet — and doing ... You would NEVER set up a server with file and printing sharing ports ... McAfee says 'Skulls' mobile security threat still low ... ISPs raise the stakes on DDoS attacks ...
    (microsoft.public.backoffice.smallbiz)
  • << SBS news of the week 12/6/2004>>
    ... Simply connecting to the Internet — and doing ... You would NEVER set up a server with file and printing sharing ports ... McAfee says 'Skulls' mobile security threat still low ... ISPs raise the stakes on DDoS attacks ...
    (microsoft.public.backoffice.smallbiz2000)
  • << SBS news of the week 12/6/2004>>
    ... Simply connecting to the Internet — and doing ... You would NEVER set up a server with file and printing sharing ports ... McAfee says 'Skulls' mobile security threat still low ... ISPs raise the stakes on DDoS attacks ...
    (microsoft.public.windows.server.sbs)
  • Re: AD Design Question
    ... "Jon" wrote in message ... What is the security ... If you have a publicly accessible machine such as an ISA Server that you may ... be using as the access point to your network from the public Internet. ...
    (microsoft.public.windows.server.active_directory)
  • RE: passwords in asp pages
    ... and using integrated security for connecting to the database- this will ... remove cleartext passwords from the files. ... grab the raw asp source from the server. ... to facilitate one-on-one interaction with one of our expert instructors. ...
    (Security-Basics)