Introduction/refresher course on Windows security

Question

Can someone point me to a blog or recommend a book with an introduction (or refresher course) to Windows security.

I am not a newbie programmer, actually have more than 10 years of experience, with a roughly half of that time been spent doing server side development for Windows. But security is still a "gray area" to me, so almost every time when I need to configure a service or a web site etc - I would have to go to MSDN or Wikipedia or, have to admit that, just resort to "trial-and-error change the settings and check if it works now" approach.

Can you recommend a book or a place on the web where all Windows related security infrastructure (transport layer security, user security, etc) explained and various available technologies/security options compared.

I am not after a very detailed "security internals" type of thing, because at my line of work I don't need to configure a production code, god forbid, just some basics so I would not need to go to Wikipedia when I see a "digest" to find out "what is this digest for? (message, usertoken, etc), what (certificate, certficate hash, etc) has been used to create the digest, etc" and feel less ignorant.

Thank you.

Answer 1

These Getting Started Guides might help:

UAC: http://technet.microsoft.com/en-us/library/cc709691(v=ws.10).aspx

Windows Advanced Firewall: http://technet.microsoft.com/en-us/library/cc748991(v=ws.10).aspx

Answer 2

I recommend the Security Now podcast especially if you have some commute time. There is over 400 hours of of security information.

http://www.grc.com/securitynow.htm For an episode guide and transcripts.

GRC also has some good security tools and info.

http://twit.tv/sn Is the main site.

Answer 3

you can check this website http://www.windowsecurity.com/ , and also there are videos from pluralsight about windows security but they are a bit outdated ,sans institute also offers a good course and it can be found here https://www.sans.org/security-training/securing-windows-77-mid , search amazon for this book .NET-Developers-Guide-Windows-Security it is also very useful.

Answer 4

I agree the request is far too vague. But to get you started here is an older but still applicable general security practices overview from sans: http://www.sans.org/reading_room/whitepapers/bestprac/system-administrator-security-practices_657

And here is a book that should be exactly what you're looking for, as I feel you should look more towards the proper secure system administration area for now, then move onto the more detailed intricacies of security management. Also it's from Syngress publishing whom I tend to trust generally (non-affiliated): http://www.amazon.com/Security-Microsoft-Windows-System-Administrators/dp/1597495948

Answer 5

I've been slightly thrown off by the 'Windows' part of the question, but I think you're asking for some generic security info...?

Comptia offer a generic security certification. You might want to look into books related to studying for that or just check the exam objectives and check out the different topics.

However that isn't specific to Windows. There are a lot of things related to 'Windows Security'. There are some Microsoft Technet articles here that might be useful. (I've found their checklists to be quite useful)