Security Considerations for Migrating from NT to Win2K, Part 4

In "Security Considerations for Migrating from NT to Win2K, Part 3," July 2001, I discussed what public key infrastructure (PKI) and Encrypting File System (EFS) can do for Windows 2000 system security. In Part 4, I look at the additional security that IP Security (IPSec) can provide for Active Directory (AD) domains and even for individual Win2K workstations that need to connect securely to one another.

IPSec: Seamless Security
Among the security improvements you'll realize after a Win2K migration is the inclusion of IPSec services. IPSec can provide machine authentication, data authentication, data-integrity protection, data confidentiality, and antireplay protection for end-to-end network connections (e.g., client/server). IPSec can also help secure remote access connections when users dial from their client machines to remote servers over any private or public IP-based network that uses Layer 2 Tunneling Protocol (L2TP). However, IPSec isn't recommended for use in VPN applications because of the security problems inherent in transferring the data and typically weak shared keys across public connections, such as the Internet. IPSec is best suited for security connections, such as Web or Win2K Server Terminal Services connections. . . .