In the case of Windows NT and Internet services, all services are controlled through an account called "local system." This is not a normal account since one cannot log on directly to use it, but it does run with administrative privileges. Changing the accounts for each Internet service allows administrators to better control and audit each Internet service. The same concept holds true for UNIX daemons.

The key to securing the Web server is to segment the operating system, the Web server program, and the server's files on their own hard drive or partition. If a breach occurs, such segmentation will help limit a hacker's activity to specific hard drives, or even parts of hard drives, that are not essential to the rest of the system.

Securing the file transfer protocol (FTP) server is similar to securing the Web server. The FTP server should be separated from the files it downloads by using partitions. Whenever possible, FTP user accounts and access options must be separated from those used to access the Web. The FTP server should not allow access to sensitive files. Otherwise, users could gain access to Web directories and overwrite Web files. This problem has happened quite often, including an episode where U.S. intelligence agencies' Web pages were altered by hackers.

Instead of keeping the operating system, program files, and HTML files and scripts for a Web page all on the same hard drive, partition the drive several times, then place only the operating system on the primary partition.