| |
| |
| Dedication | |
| |
| |
| Acknowledgments | |
| |
| |
| Introduction | |
| |
| |
| |
| Security Fundamentals | |
| |
| |
| |
| Security Buzzwords | |
| |
| |
| What Does Security Mean? | |
| |
| |
| Authentication | |
| |
| |
| Access and Resource Control | |
| |
| |
| Data Integrity | |
| |
| |
| Confidentiality and Privacy | |
| |
| |
| Malicious Code | |
| |
| |
| Rights Management | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Security Protocols and Algorithms | |
| |
| |
| Why Do I Need to Know This? | |
| |
| |
| Secret-Key Encryption | |
| |
| |
| Public-Key Encryption | |
| |
| |
| Digital Signatures | |
| |
| |
| Protocols | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Windows and Exchange Security Architecture | |
| |
| |
| Learning the Right Lingo | |
| |
| |
| Authentication | |
| |
| |
| Access Control and Permissions | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Threats and Risk Assessment | |
| |
| |
| Types of Security Threats | |
| |
| |
| Models for Risk Assessment | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Physical and Operational Security | |
| |
| |
| Physical and Operational Threat Assessment | |
| |
| |
| Beefing Up Your Physical Security | |
| |
| |
| Strengthening Operational Security | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Exchange Server Security | |
| |
| |
| |
| Windows Server Security Basics | |
| |
| |
| Taking the First Step: Patch Management | |
| |
| |
| Securing What's Most at Risk: A Checklist | |
| |
| |
| Tightening Things Further | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Installing Exchange with Security in Mind | |
| |
| |
| Designing an Active Directory Structure for Exchange | |
| |
| |
| Installing Exchange | |
| |
| |
| Delegating Control | |
| |
| |
| Applying the Finishing Touches | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| SMTP Relaying and Spam Control | |
| |
| |
| Understanding Relaying | |
| |
| |
| Controlling Relaying | |
| |
| |
| Understanding Spam | |
| |
| |
| Using Exchange's Spam Control Features | |
| |
| |
| Evaluating Third-Party Antispam Products | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Content Control, Monitoring, and Filtering | |
| |
| |
| Adding Disclaimers | |
| |
| |
| Filtering Inbound and Outbound Content | |
| |
| |
| Reading Other People's Mail | |
| |
| |
| Using Message Tracking | |
| |
| |
| Searching the Store for Specific Content | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Antivirus Protection | |
| |
| |
| Understanding Virus Protection Principles | |
| |
| |
| Designing Defense in Depth | |
| |
| |
| Everything Else | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Communications Security | |
| |
| |
| |
| Securing Internet Communications | |
| |
| |
| Using TLS/SSL with SMTP | |
| |
| |
| Using IPSec | |
| |
| |
| Publishing MAPI RPCs with ISA Server | |
| |
| |
| Tunneling RPC over HTTPS | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Secure E-Mail | |
| |
| |
| Understanding the Exchange-PKI Combination | |
| |
| |
| Introducing Rights Management | |
| |
| |
| Comparing S/MIME and RM | |
| |
| |
| Planning Your S/MIME Encryption Infrastructure | |
| |
| |
| Installing Certificate Services | |
| |
| |
| Configuring and Managing Certificate Services | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Client Security | |
| |
| |
| |
| Securing Outlook | |
| |
| |
| Understanding Outlook's Security Features | |
| |
| |
| Customizing the Outlook Security Update | |
| |
| |
| Customizing Outlook Security Settings for End Users | |
| |
| |
| Setting Up RPC over HTTP | |
| |
| |
| Using S/MIME | |
| |
| |
| Using Information Rights Management | |
| |
| |
| Reaching into Outlook's Toolbox | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Securing Outlook Web Access | |
| |
| |
| Understanding Outlook Web Access | |
| |
| |
| Controlling Access to Outlook Web Access | |
| |
| |
| Using SSL with Outlook Web Access | |
| |
| |
| Improving Outlook Web Access Client Security | |
| |
| |
| Securing Outlook Web Access with Firewalls | |
| |
| |
| Publishing Outlook Web Access with ISA Server | |
| |
| |
| Applying the Finishing Touches | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Securing POP and IMAP | |
| |
| |
| Understanding POP and IMAP | |
| |
| |
| Controlling User Access to IMAP and POP | |
| |
| |
| Using POP and IMAP with SSL | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Advanced Topics | |
| |
| |
| |
| Securing Mobile Exchange Access | |
| |
| |
| Understanding Exchange's Mobility Features | |
| |
| |
| Securing OMA and EAS | |
| |
| |
| Securing Mobile Devices | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Discovery, Compliance, Archive, and Retrieval | |
| |
| |
| What, Me Worry? | |
| |
| |
| Understanding DCAR | |
| |
| |
| Building a DCAR System | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Security Logging | |
| |
| |
| Understanding Security Logging | |
| |
| |
| Using Auditing in Windows Server 2003 | |
| |
| |
| What to Audit and Why | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Security Auditing | |
| |
| |
| Understanding Security Auditing | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| The Law and Your Exchange Environment | |
| |
| |
| Assumptions | |
| |
| |
| Some Legal Principles | |
| |
| |
| Devising Network Use Policies | |
| |
| |
| Summary | |
| |
| |
| Additional Reading | |
| |
| |
| |
| Appendixes | |
| |
| |
| |
| The Ten Immutable Laws | |
| |
| |
| The Ten Immutable Laws of Security | |
| |
| |
| The Ten Immutable Laws of Security Administration | |
| |
| |
| |
| Setup Permissions Guide | |
| |
| |
| A Note About Interpreting ACL Entries | |
| |
| |
| Permissions on Objects in the Exchange Configuration Tree | |
| |
| |
| Permissions on the Server Object and Its Children | |
| |
| |
| Permissions on Other Objects in the Configuration Tree | |
| |
| |
| Permissions on Objects in the Domain Naming Context | |
| |
| |
| Permissions on File System Objects | |
| |
| |
| Index | |