Microsoft Corp. has released the first of what will be several OS-specific guides to securing Windows machines.
The guides are a result of the internal work that the company has been doing to improve the security of its products. Much of the content comes directly from lessons learned during the security push Microsoft began last year in which the companys developers pored over lines of code in the Windows product line, looking for security vulnerabilities and other errors.
“Securing Windows 2000 Server” addresses a wide range of topics, from patch management to auditing and intrusion detection to hardening the base server configuration. The guide also includes sections on more in-depth subjects such as securing the domain infrastructure and hardening specific server roles.
Microsoft, based in Redmond, Wash., plans to release similar guides for its other operating systems later this year. While the goal of the document is the same as other guides to securing Windows 2000, its format differs greatly from third-party efforts. Most other such guides are simply lists of which services to turn off and what settings should be applied for a desired level of security.
The document uses as a running example a fictitious company, Contoso Ltd., and its efforts to secure its Windows 2000 environment. It goes into deep detail on every step of the process and explains the reasoning and consequences for each decision the company makes.
The Microsoft guide is available here.
Read more security stories:
Search for more stories by Dennis Fisher.
Find white papers on security.