tailieunhanh - Microsoft Press mcts training kit 70 - 647 enterprise administrator phần 9

Hướng dẫn người sử dụng để mã hóa thư mục thay vì các tập tin cá nhân. Mã hóa các tập tin nhất quán ở cấp độ thư mục đảm bảo rằng các tập tin không bất ngờ được giải mã. Các phím tư nhân có liên quan đến giấy chứng nhận phục hồi cực kỳ nhạy cảm. | 452 Chapter 10 Designing Solutions for Data Sharing Data Security and Business Continuity Instruct users to encrypt folders instead of individual files. Encrypting files consistently at the folder level ensures that files are not unexpectedly decrypted. The private keys that are associated with recovery certificates are extremely sensitive. These keys must be generated either on a computer that is physically secured or their certificates must be exported to a .pfx file protected with a strong password and saved on a disk that is stored in a physically secure location. Recovery agent certificates must be assigned to special recovery agent accounts that are not used for any other purpose. Do not destroy recovery certificates or private keys when recovery agents are changed. Agents are changed periodically. Keep them all until all files that might have been encrypted with them are updated. Designate two or more recovery agent accounts per organizational unit OU depending on the size of the OU. Designate two or more computers for recovery one for each designated recovery agent account. Grant permissions to appropriate administrators to use the recovery agent accounts. It is a good idea to have two recovery agent accounts to provide redundancy for file recovery. Having two computers that hold these keys provides more redundancy to allow recovery of lost data. Implement a recovery agent archive program to make sure that encrypted files can be recovered by using obsolete recovery keys. Recovery certificates and private keys must be exported and stored in a controlled and secure manner. Ideally as with all secure data archives must be stored in a controlled access vault and you must have two archives a master and a backup. The master is kept on-site while the backup is located in a secure off-site location. Avoid using print spool files in your print server architecture or make sure that print spool files are generated in an encrypted folder. EFS does take some CPU .