CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)

Reporting Incidents to Third Parties 1 2 3.5.1  OS/NOS Hardening

Automatic Enforcement of Baselines

Some security auditing products take the idea of baselines one step further by allowing you to specify rules for your desired system configurations (and other security controls) within the auditing product, so that the tools can automatically scan for deviations from those baselines and report them to you.

One idea, which can’t be repeated often enough, to those who are in the process of “tightening the screws” is the importance of testing and re-testing new configurations to make sure that you haven’t “broken” any critical network/system functionality as you’ve worked to increase security. It’s somewhat sad to report this, but the software world is replete with packages (not named, to protect the guilty) that contain functions that just won’t work if file system security is tightened, ordinary users aren’t assigned rights normally reserved for administrative users, etc. This is the kind of situation you want to discover on a Saturday morning, with a crew of volunteer users and a nice brunch delivery expected at 11am (so that the users can take a break, and your team can frantically work to adjust small things that didn’t work properly during the first few hours of testing), not on the day that the company is trying to close the month. If you discover that you seem to be running one of these packages that just don’t play nicely with a locked-down system, contact the vendor to see if they have any solutions or workarounds to the issue you find. If not, management needs to know about it, because a choice needs to be made, balancing security exposure with the importance of that package to the organization.

In the following sections, we look at the process of “hardening” (making resistant to attack) various types of server functionality typically available within an organization’s network. Starting with the underlying OS/NOS level, since an application server won’t be secure if the OS on which it runs is not secure, we continue by looking at common services often made available over the Internet such as web, email and ftp, and services generally used internally such as DHCP and directory services.

Reporting Incidents to Third Parties 1 2 3.5.1  OS/NOS Hardening