IN THIS CHAPTER, you’ll start learning the details of Windows security features and specific steps to make Windows computers more secure.

As in any complex endeavor, it is important to understand the concepts of information systems security before you start making changes and placing controls. Poorly placed security controls can often do more harm than good. A control that is too permissive to be effective does not increase security. Likewise, a control that is too stringent can often reduce usability and increase user frustration. It is important to always keep security goals in mind as you design and implement controls. Always follow the time-tested strategy of:

• Think

• Plan

• Design

• Implement

• Evaluate

Follow these steps in order, and you will avoid many of the frustrations encountered from poorly planned actions. The first step in designing and implementing an effective access control strategy is considering the most important access control goals. This chapter will cover access control design strategies and the steps necessary to implement and evaluate them.