Microsoft® Windows® Security Resource Kit, Second Edition

Best Practices

• Clearly establish and enforce all policies and procedures. Many security incidents are accidentally created by IT personnel who have not followed or understood change management procedures or have improperly configured security devices, such as firewalls and authentication systems. Your policies and procedures should be thoroughly tested to ensure that they are practical, clear, and provide the appropriate level of security.

• Provide comprehensive training on tools to your incident response team. Ensure that you provide training to your Computer Security and Incident Response Team (CSIRT) on the use and location of tools that will be used during an incident response. Consider providing portable computers preconfigured with these ...