In this section, we will go back to basics when it comes to securing Windows Server and we'll start
off with SMB security.
SMB one is dead and we really should stop using it.
The first reason, which is a really compelling reason to stop using SMB version one, is that only
versions of Windows that require SMB V1 are all end of support.
And when I say end of support, they have been end of support by a number of years.
For example, when you look at Windows Server 2003, it has been end of support in July 2015.
Windows Server 2000 has been end of support in July 2010.
Many samba and Linux distributions like Ubuntu have also retired SMB version one.
And consider this.
If you are using Windows ten, Windows ten would not work with any end of support version of Windows
or SMB.
Microsoft simply will not support it.
The next reason is that SMB V1 is not safe.
When you use SMB one, you lose key protections that are offered by the later SMB protocol versions.
For example, consider prior authentication integrity.
This protects against security downgrade attacks as well as secure dialect negotiation.
And those two are available in SMB three.
What about encryption, which prevents inspection of data on the wire in any type of man in the middle
attacks?
And then, of course, we've got things like insecure guest authentication, blocking and better message
signing, which are all available from SMB version two upwards.
SMB version one is also not efficient.
So not only do you lose key predictions, you also lose key performance and productivity optimization
for end users.
For example, you lose out on larger reads and rights, which are all available from SMB version two
upwards.
So what is the way forward?
Instead of adding another dialect to SMB, it was decided that a major new version of SMB was needed.
And this is where SMB, V2 and V3 was born.
SMB version two has now actually become SMB version three.
This is more of a marketing move since SMB three still uses the RMS SMB two protocol specification.
And if you look at a bit of history, you'll note that SMB three was originally SMB version 2.2.
So what makes SMB version two and three more secure?
While the start off with you have the encryption capabilities.
SMB encryption provides end to end encryption of data and protects the data from eavesdropping on untrusted
networks.
You also have the ability to make use of SMB signing.
This helps to secure communications and data across the network.
There is a feature within Windows which digitally signs SMB communications between devices and the packet
layer.
When you enable this, SMB signing allows the recipient of the SMB communication to authenticate who
they are and confirm that the data is genuine.
This, of course, helps to safeguard against attacks such as the man in the middle attack.
Most, if not all, of these settings can be enabled either via PowerShell or via group policy.