Microsoft® Windows® Security Resource Kit, Second Edition

Securing Certificate Services

To prevent the likelihood of these threats, you can take the following measures:

• Implement physical security measures.

• Implement logical security measures.

• Modify CRL and CA certificate publication points.

• Enable CRL checking in all applications.

• Manage permissions of certificate templates.

• Implement role separation.

Implementing Physical Security Measures

Physical security measures prevent attackers from gaining physical access to the computer running Certificate Services. When an attacker gains physical access to a computer, any number of attacks can take place. Physical security measures can include the following:

• Creating a three-tier hierarchy that deploys the root CA and the second-level CAs (also referred to ...