Security best practices
Because the computer on which Microsoft Internet Security and Acceleration (ISA) Server 2004 is running is often the primary interface to the External network, we recommend that you secure the computer itself. Follow these best practices:
- Install critical updates for the operating system.
- Install critical updates for ISA Server. The latest updates are available on the ISA Server Web site.
- Ensure that the ISA Server computer is and storage are in physically secure locations. Physical access to a server is a high security risk. Physical access to a server by an intruder could result in unauthorized access or modification as well as installation of hardware or software designed to circumvent security. To maintain a secure environment, you must restrict physical access to the ISA Server computer.
- Apply the principle of least privilege principle —a user should have the minimum privileges necessary to perform a specific task. This helps to ensure that, if a user account is compromised, the impact is minimized by the limited privileges held by that user. Administrators should use an account with restrictive permissions to perform routine, nonadministrative tasks and use an account with broader permissions only when performing specific administrative tasks. Bear this in mind when you assign ISA Server administrative roles. For more information, see Administrative roles.
- Carefully determine who should have permission to log on to the ISA Server computer. Then, configure the logon rights accordingly. See the Windows help for more information.
- Apply the principle of reduced attack surface—disabling services and functions not critical to the task at hand. Disable ISA Server features that you do not use. Configure a system policy suited specifically to your network needs, disabling unnecessary functionality. For more information on system policy, see System policy.
- Do not run unnecessary applications and services on ISA Server computer.
- When requested to present credentials, be sure to use strong passwords. A password is considered strong if it provides an effective defense against unauthorized access. A strong password does not contain all or part of the users account name, and contains at least three of the four following categories of characters: uppercase characters, lowercase characters, base 10 digits, and symbols found on the keyboard (such as !, @, #).
RADIUS server configuration recommendations
- If you are using a RADIUS server for authentication, create a connectivity verifier that monitors the server status. Configure the alerts so that an appropriate action is taken when the RADIUS server is not functioning. For more information on connectivity verifiers, see Connectivity verifier.
- It is recommended that untrusted users should not have access to the network between a RADIUS server and ISA Server. If untrusted users must have access, then it is recommended that you use IPSec on this network.
Logging and alerting recommendations
- Review the logs regularly and carefully, checking for suspicious access and usage of network resources.
- Configure alerts to send notifications to adminsitrators. Implement a rapid response prcedure.
- Use the log maintenance feature wisely, to ensure that the disk on which log information is stored does not become full. For more information on the log maintenance feature, see Log storage format.
- Configure the Log Storage Limits alert definition to stop the ISA Server services. In this way, you only allow access when the access can be appropriately audited. For more information on alerts, see Alerts.
- It is recommended that you save the logs to a separate NTFS disk partition for maximum security. Furthermore, only Administrators of the ISA Server computer should have access to the logs.
- When you save log information to a SQL database, it is recommended that you use Windows authentication (and not SQL authentication).
- If you are logging the information to a remote database, it is recommended that you configure encryption and data signature for the log information being copied to the remote database.
- For maximal security, it is recommended that you configure IPSec for the communication between the ISA Server computer and SQL Server.
- It is recommended that if log information cannot be saved for any reason, you should lock down the ISA Server computer. To do so, configure an alert definition for the Log Failure event which stops the Firewall service. For instructions, see Add an alert definition.
Additional Recommendations
In addition, follow the security recommendations for the operating system running on the ISA Server computer. Study and apply the security practices described in the following documentation.
- For Windows 2000, see the Security Operations Guide for Windows 2000.
- For Windows Server 2003, see the Windows Server 2003 Security Guide.
