Assigning User Rights for Windows 2000, Server 2003, and XP

Users who are logged in to a Windows 2000, Server 2003, or XP computer can be granted rights by the administrator of the computer. If the user logs in to a domain account instead of the local computer, a domain administrator can manage these rights. Rights granted to an account that resides on an individual Windows computer protect access to resources on that computer only. The security information for the computer is stored locally, in the Security Accounts Manager (SAM) database, and applies only to resources on that local system.

Accounts that are created on a domain controller can be used when assigning user rights to resources on computers throughout the domain. And, by placing users into groups, you can easily manage a number of users who need the same access to resources or the same rights. This is done by granting the rights to the group, instead of individual users. If a user needs access to resources that are not granted by the group membership, you can place the user in more than one group. Because groups enable you to simplify granting rights to users, the following discussion will concentrate on those rights.

Starting with Windows 2000, most Administrative Tools are snap-ins for the Microsoft Management Console (MMC). By using the MMC to create management tools, you'll find it easy to switch from one MMC console to the next, without having to relearn the mechanics of the particular utility. For example, when using MMC you'll find two panes on the screen. The left pane contains a tree of objects that can be managed. An Action menu presents you with functions you can perform. The right pane is used to display different kinds of information, based on the particular utility and the actions you take. The MMC allows you to create new utilities by installing a snap-in that is appropriate for the functions you need to perform. However, most of the tasks you will use to manage thecomputer or domain have already been set up as an MMC application. Other snap-ins, which are used for more sensitive operations, such as altering the Active Directory schema, must be created by installing the snap-in.

Windows NT defined certain basic rights you could grant to a user account, as well as a set of rights that were granular. The basic rights were simply combinations of these granular rights. In Windows Server 2003, rights have been divided into two categories. These are logon rights and privileges. Logon rights are few in number, and can generally be used to manage most users or groups.

These logon rights are listed here:

• Allow log on through Terminal Services—Enables a user of a computer to log on using Microsoft Terminal Services. Essentially, a Terminal Services client runs programs on a server designated to supply this service, and the Terminal Server client computer displays the GUI interface for the application. This enables you to use older computers with fewer resources (such as memory or processor speed) to be used in your network.

• Allow log on locally—Enables a user to log on locally at a workstation or server; that is, to log on sitting at the workstation or computer, not using a network connection. Generally, administrators are the only users who can log on locally at a server.

• Access this computer from a network—Enables a user to log on to the computer from the network. In other words, this gives the capability to make a network connection, such as to access a file share on the computer.

• Log on as a batch job—Allows a user to submit a batch job (using the task scheduler) that will run under the user's account. Unless you deny this right, the default allows users to submit batch jobs to run in the background. Batch jobs are used to perform specific functions at a certain time, unlike services that run in the background and respond to certain system or user

events.

• Log on as a service—Thisright allows the user to start a service using his or her account. A service is a process that runs in the background continuously.

• Deny log on as a batch job—Preventsan account from running a batch job on the computer.

• Deny log on as a service—Prevents an account from being used to run a service (a background process that runs without a GUI interface).

• Deny log on locally—Isthe opposite of the Allow log on locally right. This right overrides the Allow log on locally right.

• Deny access to this computer from network—Isthe opposite of the Access this computer from the network right. This right overrides the Access this computer from a network right.

• Deny log on through Terminal Services—Isthe opposite of the Allow log on through Terminal Services right.

Printing Protocols and Printing Languages

A printer language is not the same as a printer protocol. For example, PostScript and PCL (Printer Control Language) are languages that describe how a document is to be rendered into the final printed product by the printer. When a printer is directly connected to a printer port on a computer, the printer language is important and is used by the software driver to format the information being sent to the printer.

A printer protocol, however, is used to send the formatted job, both data and instructions compiled using the printer language, to the print device. A few protocols will be detailed here that are more specific in their use and implementation; that is, they generally are used for communicating with a printer.

Several protocols are used for network printing. Some are proprietary protocols used by only one computer or network operating system (NOS). Others, such as 1pr/lpd—which was first developed for use on Unix systems—have been implemented in many environments. Data Link Control (DLC) is an IBM protocol that has been adapted for use on many printers although it is not used much today.

Also covered is the newest printing protocol: the Internet Printing Protocol (IPP), which was created by a working committee of the Internet Engineering Task Force (IETF). Development is underway for standards to further define this new protocol. You will find, however, that both Windows 2000/2003/XP and NetWare 6.x already support IPP. Novell even sells its iPrint as a separate product that can be used in a non-NetWare environment.

Using Ipr/lpd and the TCP Stream Protocols

TCP/IP was originally developed for the Unix operating system (OS), of which there are several flavors. Depending on the version of Unix (as well as Linux) running on a workstation or server, you will find that TCP/IP printing falls into one of two major types:

• BSD (Berkeley System Distribution) Spooling System
• SVR4 (System V, Release 4) Printing System

The BSD system uses the 1pr (line printer remote) program to send files to printers. The printers can be connected to a network, or to a computer. Whichever way, the 1pd (line printer daemon) receives these print requests and interacts with the Ipr to send the print job to the printer. The / et c/ p r int cap text file is used to set up characteristics for each printer. The SVR4 Unix system uses the 1p (line printer) program and the 1psched daemon (printer scheduler) to print files. Although the SVR4 system is considered more sophisticated because it has several utility commands for managing the system, the BSD system probably is easier to manage in a networked environment.

When using either of these methods, the actual print commands and data are sent to the printer in the payload section of a TCP/IP packet.

Although all Unix and Linux systems support TCP/IP printing, many support other protocols as well. For example, Red Hat Linux can also be configured to use SMB (Server Message Block) to connect to a Windows server (or a Unix/Linux computer configured to offer printing services using SMB).

The 1pr/lpd protocols work well, but are mostly used by older operating systems.

TCP/IP stream sockets the Unix provide yet another way to use TCP/IP to connect to a printer. Streams are a two-way communication TCP/IP session between the computer (or print server). When using TCP/IP streams, you need to specify a port (also known as a socket in Windows terminology). Thus the address of the networked printer, paired with a port number, provides a unique address so that the data exchange can be accomplished.

Data Link Control Protocol (DLC)

For all practical purposes, DLC is rarely found anymore within today's networks, although it might still be found on legacy systems. This IBM protocol was widely used during the early days of networked printing, as well as for other applications. However, more robust protocols, such as TCP/IP, have made this protocol a less desirable solution for network printing.

The DLC protocol was developed by IBM primarily for use in connecting to mainframe computers as part of its Systems Network Architecture (SNA) specifications. DLC can also be used to establish terminal sessions with AS/400 computers. In addition to the HP Jet Direct card, you will find that other vendors also make network cards for printers that can use DLC. For example, the Brother NC-600X and NC-2010h network cards both can be used for this purpose. However, you'll find that DLC no longer is present in Windows systems starting with Windows) XP.

Physical Security Measures

Preventing unauthorized access to resources means that you must first prevent unauthorized access the physical components that make up the network. This includes user workstations, servers, netwo cables and devices, and so on. After the network connection leaves your physical area, such as when you connect to an outside Internet provider, you lose control over the physical aspects of the network. At that point, you must rely on other techniques, such as encryption or tunneling, to mainta security. However, the equipment over which you have control should be closely monitored to en that no one is tampering with anything in a manner that might serve to defeat the security policy effect at your site.

Locking the Door

As silly as it might seem, the simple door lock is an often-overlooked security device. You wouldn't leave your front door at home unlocked all the time, would you? The servers in your network that hold valuable or sensitive data should not be sitting out on a desktop or in an unlocked room where anyone can access them. Routers, hubs, switches, and other devices should be similarly protected. Wiring closets and computer rooms should have a lock on them or be protected by some sort of mon itoring on a 24-hour basis. If you have a round-the-clock operations staff, you might not need to lock the computer room. But if that staff consists of only one person during any particular period, get a lock for the door! Ideally, access to these secure areas will be tracked and logged, such as through employee badge readers. With very sensitive systems, you may even want to go as far as securing physical access through biometric authorization systems. Biometric systems, though still in their infancy, can help ensure that someone cannot gain access to a secure area simply by borrowing or stealing a physical token.

Backup media, such as tapes or writable CDs, should be treated the same as live data. Don't back up a server or your own personal workstation and then leave the tape cartridge or CD lying on the desk or in an unlocked drawer.

Uninterruptible Power Supply (UPS)

Keeping data secure can mean keeping it out of the hands of those who are not permitted to view it. It also can mean keeping the data safe from corruption. As more and more business-critical information is being committed to electronic form, it is important to take steps to be sure that it is not unintentionally compromised. A good UPS will p for itself the first time you have to spend daysreconstructing a database or reinstalling programs that become unusable due to a power outage or another problem of this sort.

Most computer operating systems have features that will work with a UPS so that the UPS can perform an orderly shutdown when it detects that power has been lost. If you are using a battery-backu UPS that has only a limited supply of power, an orderly shutdown can save a lot of problems when compared to a system crash.

Disposing of Hardware and Media in a Secure Manner

When you upgrade your network and bring in new workstations or servers, it is a generous thing to give employees, or an organization such as a school, your old equipment if it is still usable. However, you should establish a policy which dictates that all hard disks are to be erased and, when appropriate, a legal copy of the operating system reinstalled on it. If you leave important information on a computer you give away, don't be surprised when you see it again.

There is also the legal aspect to this. If you give away an old computer system, do you have the legal right to keep the software packages and install them on a new system? Probably not, unless you have a site license or another license that allows you to do so. For that reason, do not give away a computer that has applications installed on it unless you intend to give away the software packages also.

Disposing of used floppy disks, backup tapes, and tape cartridges also poses a potential security threat. It is better to destroy these information carriers than to give them away without being absolutely sure that you have purged them of any recoverable information. A bulk magnetic eraser can be a good security tool to use before disposing of this kind of stuff.

The Two Sides of Security

Locking the computer-room door is a preventive measure intended to keep out those who have no business being there. Preventive measures should be taken for software access mechanisms also. However, no matter how good you are at putting into place the access control mechanisms to protect resources, there is always going to be someone who will try, and possibly succeed, in breaking through. For this reason, you also must be able to keep audit trails of events on the network so that you can determine whether someone is trying to break your security, or whether indeed they have done so.

Before the Fact: Controlling Access

Controlling access to the network is done by several common mechanisms:

• User accounts and passwords

• Physical identifiers

• Resource protections

In many operating systems, the concept of a resource owner is important in this scheme. For example, OpenVMS and Windows 2000/Server 2003/XP keep track of the user who creates a resource, such as a file. That owner is able to change the protections applied to the file and can grant others the permissions needed to use the file. To a lesser degree, the same can be said for Unix/Linux operating systems.

Identifying Users

In a homogeneous network in which only one user account and password is required for access to permitted resources throughout the network, system management is not usually a complicated matter. Windows 2000/XP and Server 2003 allow for the creation of areas of control, called domains, that operate as security boundaries. Users in a domain can be granted access to resources on any computer, either server or workstation, that the network administrator wants to give them. In addition, trust relationships can be established between domains when administrators cooperate, making it possible for the user to still use only one username and password to connect to resources throughout the network. From Windows 2000 and more recent Windows versions, group policies can be used to further control access to important resources

Forged Email

Email is probably the most popular application used on the Internet. All people can have an email account, whether or not they have a computer at home. You can sign up for email accounts at several sites, such as Microsoft's Hotmail or Yahoo's email service, and use a computer at your school, at a library, or even at work to access the account.

Email messages, like Trojan horse programs, aren't always what they seem to be. Just because the FROM line contains the name of someone you know doesn't mean that the email actually came from that person. It's a simple matter when configuring an email account to use any name you want. And with the online email services that don't require you to use an email client (these services typically use an HTML interface—a Web browser), it can be difficult to determine where an email actually originated.

There are even programs freely available on the Net that allow you to create bogus email messages that appear perfectly normal in all respects. Although any intelligent person would probably not, in this day and age, open an email attachment from someone they do not know, they most likely would open an attachment from a friend. After all, if you can't trust your friends...

The problem is that email is easily forged and can be used to get a program into your network. As a rule, delete spam and other email from sources you don't recognize.

One of the more insidious things that can be done through email has occurred with alarming frequency in recent years. Worm viruses spread through email can read your address book, replicate themselves by mailing a copy of the virus code to everyone in your address book, and then start wreaking havoc on your system! About the only thing you can do in this situation is to disconnect the computer (or computers) from the network and clean out the mail store with a good virus program. If you have a mail server in your network, disconnect it and do the same. Until you've assured yourself that every computer in your network is free of such worm viruses, don't reconnect to the Internet, or any other part of your corporate network.

Password Protection and SecurlD and Smart Cards

Passwords and usernames have been the traditional method for authenticating a user to a computer operating system. There are much better methods you can use for environments that demand a high degree of security, such as smart cards and SecurlD cards.

Smart card devices are synchronized with software that runs on the host computer. To log on, the user simply consults the password code, which changes at regular intervals, generated by the smart card. Because the application on the host computer is operating to change the account password using the same algorithm as the smart card, a user's account password can be different every time she logs in. As long as the smart card and the application on the computer are kept in sync, it becomes very improbable for someone to "steal" your password. And most smart cards have passwords that can be used only one time. This means that even if someone happens to glance at the current password on your smart card, after you've used the password to log in, it can't be reused and abused.

SecurlD cards are based on digital certificates and require the user to enter a PIN for their use.

Build Your Digital Command Canter Part 1

The popularity of Star Trek is based, in part, upon our fascination with advanced technology. We're excited when Captain Picardorders his crew to take The Enterprise to another galaxy with the simple command "Make it so." In the distant future, it seems, we'll be able to entertain our merest whim by pushing a button or by telling a computer what we want done. Powerful machines will do the rest.

To succeed at digital marketing, you need to build your own version of The Starship Enterprise. You need to develop a digital command center in your company to communicate on a day-by-day basis with your customers and prospects. Unlike a traditional marketing department — often far removed from direct contact with customers — a digital marketing department must be hardwired to Customers. E-mail messages, for example, must be read and replied to Within hours, if not minutes, and your Web site content may need to be updated and changed daily. In addition, your customer database should be constantly churning with new information uploaded from your salespeople, your customer service representatives, and your customers.

Integration in the Digital Economy

To gather, store, process, and distribute digital information, you need to integrate your company into the digital economy. In the next three to five years, you will need the following capabilities in your company.

• Every computer is connected over a network using highspeed cable. This network includes an internal e-mail system that allows for the sending and receiving of Internet e-mail messages.
• Everyone involved in your company — employees, customers, and suppliers — are able to communicate by e-mail with everyone else in your company. As bandwidth becomes greater, you can upgrade your e-mail capability to include video-mail and live video-conferencing.
• Employees and contract workers are able to work at home, or at satellite offices, as easily as if they were in the office. Note: In the digital world, you may not have an office; your entire operation may run over a central server that electronically connects your organization.
• Your internal computer network is connected directly to the Internet over high-speed telephone or cable lines. This means every computer on your network is connected to the Internet at all times. In fact, it means your computer network is actually part of the Internet.
• You have security measures in place which restrict access to private corporate information on your network. One solution is to set up an Internet fire wall.
• Your marketing presentations, internal communications, and training courses exist in a multimedia format which combines text, graphics, sound, and video. You have software that allows for the easy development of multimedia content.
• You have one or many different types of online servers running on your network. This includes one or more Web servers, a BBS network server, and online database servers. Each of these servers are available to selected people within your organization over an Intranet, or outside your organization by way of the Internet.
• As an alternative to internal online servers, you can lease space with service bureaus. For example, you can rent space on a Web site that is halfway around the world. You can update its content as if the server was in your office. You may use a service bureau to set up and run your online BBS system. Remember, you don't need to buy expensive digital equipment in order to use it — you can rent it as well.
• Your customers access information about your business using a variety of digital communications tools including the telephone, fax, e-mail, the World Wide Web, interactive kiosks, and CD-ROM, and perhaps also through some sort of virtual reality (VR) device. Ideally, your customers are able to purchase your products and services electronically.
• You have an extensive database on all your customers and prospects. This database is relational in structure. All your digital communications and your digital marketing promotions are aimed at increasing the size, quality, and complexity of this database.
• All your computer systems are compatible. In the computer industry, this is known as "Open Systems Architecture." This means all your corporate information is accessible, no matter what type of computer is used. As well, your information should be accessible through all digital devices, not just computer-related ones.
• Your employees are fully fluent in the ways of basic digital technology. Everyone in your organization knows how to use the three major types of software programs: word processing, spreadsheet, and database. They are comfortable creating _and viewing multimedia content. They understand the basic concepts of the Internet, and can find the information they need on it.

In order to succeed at digital marketing over the long term, you need to set up this type of infrastructure within your company. However, man didn't get to the moon in one day. So take it one step at a time. Here's an explanation of how to take the first steps: