thuật toán Triple DES (3DES) có thể được sử dụng để mã hóa các tập tin, thay vì DESX. Đối với Windows XP Service Pack 1 và Windows Vista, các thuật toán mã hóa Advanced Encryption Standard (AES) với một khóa 256-bit được sử dụng để mã hóa các file. | Chapter 25 Document and Code Signing 665 Best Practices Configure the Unsigned Driver Installation Group Policy setting to either warn or prevent installation of unsigned device drivers. This setting ensures either that the local administrator is aware that an unsigned driver is implemented or it prevents the installation of unsigned drivers in the local operating system. Use a commercially issued Code Signing or Document Signing certificate for publicly distributed applications. If the application you sign is intended for public use acquire the Code Signing or Document Signing certificate from a commercial CA such as VeriSign. This certificate increases the assurance in the signed application because the signing certificate chains to a root CA trusted by most organizations. Use a corporate-issued Code Signing or Document Signing certificate for internal applications. There is no need to acquire a Code Signing or Document Signing certificate from a commercial organization for internal applications. All computers within the organization trust the local CA hierarchy s root CA. Increase the protection of the Code Signing or Document Signing certificate s private key by using a smart card CSP. A smart card CSP provides higher protection of the Code Signing certificate s private key by storing the private key on a two-factor hardware device. Create a custom version 2 certificate template based on the Code Signing or Document Signing certificate that requires certificate manager approval. This measure increases the assurance of the Code Signing or Document Signing certificate and allows stronger identity validation of the Code Signing certificate requestor. Note Alternatively use a registration authority to enforce the validation of the requestor s identity before the certificate is issued. Implement code signing for all macros implemented in Microsoft Office applications. This practice allows an organization to increase the macro security level to prevent the execution
