Active Directory Rights Management Services

Following the invention of the computer, people started to transform analog data into digital formats. It also transformed the way that people accessed data. If someone is in possession of valuable documents, they can put them in a safe, or in any other secure place. In order to access this valuable data, someone needs to physically be there. Digital data is completely different. Even without physically being there, someone could steal valuable data from a computer infrastructure. This is why data security and data governance are so important when it comes to digital data. When the wrong people have access to the wrong data, the consequences can have an impact on people, organizations, or even countries.

The famous WikiLeaks phenomenon is a good example of this. WikiLeaks got access to state secrets, and some of that data was in digital format, such as emails and scanned files. Someone with authority over that data had passed it to WikiLeaks...

What is AD RMS?

Microsoft took their first approach to information rights management (IRM) by introducing Windows Rights Management Services (Windows RMS) with Windows Server 2003. This was fully compliant with Federal Information Processing Standard (FIPS) 140-1. The updated version of Windows RMS was renamed AD RMS and reintroduced with Windows Server 2008. It continued to grow with features and was included in later versions. Microsoft also released Azure Information Protection (AIP), which can be used in hybrid/cloud-only environments to protect confidential data.

As I stated earlier, AD RMS is not the solution for all data security requirements in an organization. There are other areas we need to secure along with data, such as networks, identities, roles, and permissions; traditional perimeter-based defense is no longer valid when it comes to the protection of data and identities. We have to embrace the zero-trust security approach to fight against modern threats. We need...

AD RMS components

AD RMS has its own role services and related components that need to work together in order to maintain a healthy AD RMS environment:

• Active Directory Domain Services (AD DS)
• The AD RMS cluster
• Web server
• SQL Server
• The AD RMS client
• Active Directory Certificate Service (AD CS)

Let's look into each of these components in detail.

Active Directory Domain Services (AD DS)

AD RMS is one of the AD role services. AD RMS can be installed only in an AD DS environment. As a part of the setup, a service connection point (SCP) will need to be published via AD. It will help users to discover the service URLs for the AD RMS environment.

The AD RMS cluster

The AD RMS cluster is a single RMS server or a group of servers that share certificates and licensing requests from their clients. Even though it is named cluster, it is different from a typical Windows failover cluster. The failover cluster needs at least...

How does AD RMS work?

By now, we know the components of AD RMS and their responsibilities. In this section, we are going to learn in detail how all these components work together in order to protect sensitive corporate data.

Before we start the data protection process, we need a healthy AD RMS cluster, AD RMS clients (author and recipient), and a reliable connection between these components. Once these prerequisites are fulfilled, the data protection process will go through three main stages: protecting the author's content, publishing the protected content, and accessing the protected content (recipient).

Let's assume Peter is trying to protect a document using AD RMS. He is going to send it to Adam, but he does not want him to edit or print it. This is the first time he is going to use AD RMS. In an AD RMS environment, the user, Peter, will be referred to as an information author. In his first authentication into the AD RMS cluster, a rights account certificate...

How do we deploy AD RMS?

AD RMS deployment topologies are a bit different from other AD role service deployments. Other AD role service deployment topologies are mostly focused on high availability or scalability. But AD RMS deployments are more about addressing different types of business requirements. Let's look into these topologies in detail.

Single forest-single cluster

This is the most commonly used deployment topology. In this setup, AD RMS operations will be limited to an AD forest. The deployment will only have one AD RMS cluster to process certificates and licensing requirements. The cluster can contain any number of servers, and load balancing is handled at the cluster level. If it has multiple servers, the AD RMS cluster should use a Microsoft SQL Server database, instead of WID. This deployment model will not consider extending data protection to non-corporate networks.

The following table lists the advantages and disadvantages of a single forest-single...

Azure Information Protection (AIP)

AIP is a cloud-based solution that helps to discover, classify, and protect sensitive data in a cloud or hybrid environment. AIP uses labels to classify data. Once data has been classified, we can protect the data using policies.

Data classification

A famous quote from former US Secretary of State Dean Rusk is "If you protect your paper clips and diamonds with equal vigor, you'll soon have more paper clips and few diamonds." On that particular occasion, he was talking about national security, but when it comes to data protection, the same statement is true. If we need to protect sensitive data, first we need to identify sensitive data. In an infrastructure, this sensitive data can be in different formats and in different locations, such as applications, network shares, and devices. Once sensitive data is identified, we can protect it using relevant services and policies. This is why data classification is so important. AIP...

Summary

Data protection is crucial in modern infrastructures, as more and more analog data is being transformed into digital data. There are different laws, products, technologies, and methodologies to improve data protection in infrastructures.

AD RMS is Microsoft's solution that can be used to manage the operational behavior of confidential data in an infrastructure.

In this chapter, we learned about AD RMS and its related characteristics. Then, we moved on to understanding how AD RMS works, and how it protects data.

After that, we looked at different AD RMS deployment topologies. Later, we worked on AD RMS installation, configuration, and testing.

AIP is a cloud-native service that can be used to protect sensitive data in a cloud or hybrid environment. In this chapter, we learned about the differences between AIP and AD RMS. Last but not least, we also learned how AIP protects sensitive data.

This ends the third part of this book. The fourth part of...