In your opinion, which network faces the biggest security risk today: the small office with multiple power users or large corporation with a large LUA base?
The unmanaged networks. I have seen very well managed and very secure networks in both small and large organizations, and I have seen poorly managed and very insecure networks in both as well. It is not really a matter of size but of how much time and effort is put into the security aspects of it. One of the largest weaknesses seems to be training. Security today is about end-points. The attacks are against people far more prevalent than those against technology and vulnerabilities. We need to, as an industry, understand how to push the security out to the assets that we are trying to protect. In the past we have centralized security because it was a way to centralize management of security. The challenge now is to de-centralize security, while still permitting centralized management. This is a non-trivial task, but it must be done. As a starting point, I dare every IT manager to start analyzing the risks to his or her network, and specifically, what it is they want the network to be used for. Once you understand what it is you want the network to provide you have a chance to work on making it provide that and nothing else. To me, that is the most important thing we can do. A properly staffed IT group, with adequate training and resources to train its users, an organizational mandate to protect the organization's assets, and a keen understanding of the business they serve will build a network that is adequately secured regardless of the size of the network. Windows Server 2008 certainly provides some very powerful technologies to help you manage security in your network, but while that is a necessary component, it is insufficient by itself. At a very base level, it is about the people and the processes you have, more than about the technology. Technology will help, but it is just a tool that your people will implement using a process that helps or hurts.
About the Author
Jesper Johansson, Ph. D. in Management Information Systems, has 20 years experience in information technology security. He is a security architect for a large e-commerce company, responsible for application security strategy across the range of properties and services. Prior, he was a security manager for Microsoft Corporation. He is author of several TechNet Magazine security articles and is a co-author of two other security books, Protect Your Windows Network and Windows Vista Security. When he is not working on information security, he teaches scuba diving.
The Windows Server Security Team designs, develops, tests, and supports Windows Server security solutions for Microsoft.