How To Protect Your Windows Server

1. Refrain from Internet browsing
One of the best ways to protect your server is not to touch it unless you absolutely have to. I have seen countless instances when a person trying to fix a server launches Internet Explorer from the server console to look up the solution, forgetting that the Internet is one of the most hostile environments imaginable. Even a relatively secure machine with a modern operating system can become infected with viruses, Trojans and spyware through casual Internet surfing. You should refrain from browsing the Internet from a Windows server.

2. Install antivirus and anti-spyware protection
I do recommend installing good antivirus and anti-spyware protection on the server. Keep this software up to date and scan the machine regularly. While it's true that the server won't "catch anything" if you stay off of the Internet, you never know what may already be on the server or what might attack it if another administrator happens to go online.

3. Establish a dedicated network segment
Another great way to protect your Windows Server is to place it on its own network segment, completely isolated from the rest of the network. Then you can protect the network segment using a firewall. But don't just block traffic flowing through obscure ports. This is your server, and you know who should and should not be accessing it. Set up IP-address filtering so no one can access the server without an approved IP address.

4. Protect against outbound traffic
When you implement a firewall, pay close attention to securing outbound traffic. Most people spend lots of time protecting servers against inbound traffic, not giving much thought to the information flowing from the server. Keep in mind that most Trojans send information to a server on the Web somewhere. I recommend blocking all outbound TCP and UDP ports except for those that the server absolutely needs to communicate. That way if the server does become infected by a Trojan, you can prevent the Trojan from being able to "phone home."