Session 1: Security Enhancements in Windows Vista 33

What Are the NAP Components?

Network Policy Server (NPS) is the main component in NAP and is a component of
Windows Server “Longhorn”. NPS serves as a central point where health policies can be
checked. NPS also coordinates Active Directory queries required for health policy checks.
Internet Authentication Service (IAS), found in previous versions of Windows Server,
has been replaced with NPS.
Each type of NAP enforcement requires an enforcement client (EC) on the network node
to negotiate health compliance. Each EC is specific to the type of NAP enforcement. For
example, DHCP enforcement requires a DHCP NAP EC. The required ECs are part of
Windows Vista and may also be released for Windows XP SP2.
IPsec Enforcement
IPsec enforcement limits communication on your network to computers that are
compliant with health policy requirements. This is the strongest form of NAP
enforcement.
A health certificate server and an IPsec NAP EC are required for IPsec enforcement. The
health certificate server issues X.509 certificates to clients when they are determined to
be compliant with the health policy requirements. These certificates are then used to
authenticate NAP clients when they initiate IPsec-secured communications with other
NAP clients on the network.
34 Session 1: Security Enhancements in Windows Vista
802.1X Enforcement
802.1X enforcement comprises an NPS server and an EAPHost NAP EC component.
Using 802.1X enforcement, an NPS server instructs an 802.1X access point (an Ethernet
switch or a wireless access point) to place a restricted access profile on the 802.1X client
until it performs a set of remediation functions. A restricted access profile can consist of a
set of IP packet filters or a virtual LAN (VLAN) identifier to confine the traffic of an
802.1X client. 802.1X enforcement provides strong limited network access for all
computers accessing the network through an 802.1X connection.

• Determine the health of visiting portable computers. Organizations frequently need to
allow consultants and guests access to their private networks. The portable computers
that these visitors bring might not meet network requirements and can present health
risks. You can use NAP to limit visiting portable computers to a restricted network.
36 Session 1: Security Enhancements in Windows Vista
• Verify the health of unmanaged home computers. Unmanaged home computers
provide an additional challenge to network administrators because they do not have
physical access to these computers. Lack of physical access makes enforcing
compliance with network requirements (such as the use of antivirus software) more
difficult. Verifying the health of these computers is similarly challenging. You can
use NAP to check for required programs, registry settings, or files before allowing
home computers to access the network by using a VPN connection.
Session 1: Security Enhancements in Windows Vista 37

Internet Explorer 7 Security Enhancements

Introduction
Applications that communicate on the Internet are particularly vulnerable to security
flaws because they are exposed to a wide variety of data from unprotected networks. If
any flaw is found in an Internet-facing application, hackers can quickly exploit it. Internet
Explorer 7 includes many improvements to make Web browsing more secure.
Objectives
After completing this section, you will be able to:
• Describe the threats to Internet Explorer.
• Understand Internet Explorer Zones.
• Describe how Protected Mode reduces security vulnerabilities.
• Describe how Internet Explorer 7 blocks pop-up windows.
• Understand the Phishing Filter.
38 Session 1: Security Enhancements in Windows Vista
What Are the Threats to Internet Explorer?

• Local intranet. For Windows Vista computers joined to a domain, the Local intranet
zone includes all computers that are part of the domain. For Windows Vista
computers that are not joined to a domain, the Local intranet zone is not used. The
default security level for this zone is Medium-low to allow intranet applications that
require advanced scripting options and ActiveX controls to function properly.
• Trusted sites. You must specifically add sites to the Trusted sites zone. No sites are in
the Trusted sites zone by default. You can use the Trusted sites zone for partner Web
sites that need to run advanced scripting and ActiveX controls to run properly. The
default security level for this zone is Medium.
40 Session 1: Security Enhancements in Windows Vista
• Restricted sites. You must specifically add sites to the Restricted sites zone. No sites
are in the Restricted sites zone by default. You can use the Restricted sites zone for
Web sites that you are concerned might be dangerous, or just to stop scripting on
Web pages that you find annoying. The security level for this zone is High and
cannot be lowered except by using custom settings.
Session 1: Security Enhancements in Windows Vista 41

What Is Protected Mode?

Protected Mode is a new feature in Internet Explorer 7 that reduces the impact of
vulnerabilities that have not been corrected. When Protected Mode is in use for an
Internet Explorer zone, Internet Explorer runs as a low integrity process. As a low
integrity process, Internet Explorer can only modify low integrity resources, which is a
very limited area.
Integrity levels are a new feature in Windows Vista that are added to the access control
list (ACL) of objects. Traditionally, objects such as files and registry keys contained only
user and group permissions in the ACL. Integrity levels have been added as an additional
security mechanism to control which processes are able to access resources.
Low Integrity Processes
Low integrity processes can only write to folders, files, and registry keys that have been

Key Points
• Internet Explorer categorizes Web sites into zones.
• Each zone has independent security settings.
• Internet Explorer 7 has a new Protected Mode which defaults to run Internet Explorer
as a low privilege process.
44 Session 1: Security Enhancements in Windows Vista
How Internet Explorer 7 Prevents Pop-Up Windows

Internet Explorer 7 includes a Pop-up Blocker to stop most pop-up windows. A pop-up
window is a small Web browser window that appears on top of the Web site you are
viewing. Pop-up windows often open as soon as you visit a Web site and are usually used
for advertising.
When a pop-up window is blocked, the message “Pop-up blocked. To see this pop-up or
additional options click here” appears in the information bar. When you click on the
information bar you can allow the pop-up window one time or permanently from that
Web site.
The default configuration of Pop-up Blocker does not stop pop-up windows that are
triggered when you click on a link. This allows many online applications to work
properly. However, you may be required to add an exception for online applications such
as banking.
Session 1: Security Enhancements in Windows Vista 45

You can configure the filtering level for Pop-up Blocker as:
• High: Block all pop-ups. This setting blocks all pop-up windows, including those that
are created by clicking a link.
• Medium: Block most automatic pop-ups. This setting blocks most pop-up windows,
but allows pop-up windows that are triggered when you click a link.
• Low: Allow pop-ups from secure sites. This setting automatically allows pop-up
windows for sites accessed with the HTTPS protocol. Non-HTTPS sites are treated
the same as when the Medium setting is selected.

If the site you are visiting is on the list of reported phishing Web sites, a warning page is
displayed. From the warning page, you can select to continue to the Web site or close the
page. If the Web site you are visiting contains characteristics common to a phishing Web
site, but is not on the list of known phishing Web sites, a warning is displayed in the
information bar.
48 Session 1: Security Enhancements in Windows Vista
Reporting Phishing Sites
Within the Phishing Filter menu, users can report a potential phishing site. Microsoft
verifies phishing sites before they are added to the list of known phishing sites. However,
if your Web site is incorrectly listed as a phishing site, you can also report the incorrect
listing to Microsoft for removal.
Session 1: Security Enhancements in Windows Vista 49

Demonstration: Configuring the Phishing Filter

In this demonstration, you will see how you can:
• Configure the Phishing Filter.

Key Points
• The Phishing Filter prevents malicious Web sites from impersonating legitimate Web
sites and stealing your personal information.
50 Session 1: Security Enhancements in Windows Vista
Data Protection Features

Introduction
Traditionally, it has been difficult to protect data that moves outside of the enterprise. As
soon as a portable computer has been stolen or a file sent via e-mail, the corporate
information technology department no longer has control over who can access the data or
what it can be used for. BitLocker Drive Encryption protects the data on portable
computers outside the enterprise. Rights management controls the use of data that is

system and the thief has full access to the data.
• Reset user passwords. A number of utilities exist that allow you to reset local user
passwords on a Windows workstation if you can boot from a floppy disk or other
removable storage.
52 Session 1: Security Enhancements in Windows Vista
• Modify system components. If the system can be started from a floppy disk or other
removable storage, replacement files for Windows components can be placed on the
hard drive. These replacement files can be low level components that allow thieves to
access data encrypted by using the Encrypting File System (EFS).

Data stored on computers in an office is better protected than portable computers because
physical access to the computers is limited. However, when computers are disposed of,
most data is easily recoverable even after reformatting disks or removing the partitions. A
number of free utilities allow you to scan disks for deleted data.