resource center
  See your link here
|
Computerworld -
Information security is a reactive world. The next intrusion, vulnerability or worm is always right around the corner. With critical issues arising everywhere, the typical chief information security officer and IT security organization spend most of their time reacting to outside forces rather than getting ahead of the curve.
One way out of this predicament is to establish a systems security policy and a method of ensuring compliance. Systems security policy management tools are growing in popularity. These tools automate the process of viewing and setting the configurations of a large number of systems and reporting on their configurations against a security policy to give measurable results. Improperly configured systems, including items such as permissions, user rights and operating system security parameters, cause most common security problems.
The basic process of using these tools is to continuously audit, assess and comply. That is, audit your systems against the security policy, assess the results of the audit and comply with your policy by applying settings or patches on systems that are out of compliance. Here's a step-by-step process for using these applications to implement a systems security policy:
Step 1: Choose or set up a policy.
Some products come preconfigured with industry-standard best practices templates. These templates are available as documents from operating system vendors (Microsoft Corp., Sun Microsystems Inc., IBM and Hewlett-Packard Co., for example) on how to set up their systems securely. Similar documents are available from third-party and government organizations such as the SANS Institute, the National Institute of Standards and Technology and the National Security Agency.
These documents can list hundreds of permissions and configuration parameters that should be set properly to ensure a secure system. A good systems security policy tool will have these policies as templates in an application that can be customized to the needs of the company. These documents, and the software's implementation of them, should be thoroughly reviewed and understood. The implementation should also be tested in the lab to assess the effect of locking down the systems on corporate applications.
Step 2: Identify the systems to be secured.
Some of these applications will autodiscover the systems available and will allow the user to choose from a list. Others require that a list of machines be provided. Systems security policies should be applied to the most critical servers first, and then rolled out in a phased approach that makes sense for the enterprise.
Step 3: Schedule or activate an audit.
The audit is the process that will gather data from each machine over the network. Some of the applications do this without additional software, and some require a specialized agent installed on the target system.
Step 4: Run a report and assess the results.
A good selection of reports to use out of the box or for customization is critical. These should include detailed reports, with item-by-item and machine-by-machine listings, roll-up reports with machine summaries for finding problem areas, executive summary reports with overall status reporting and high-level charts, and trend reports that can be used to illustrate progress over time.
Step 5: Comply with your policy.
Apply the needed changes or patches to systems that are out of compliance, and then begin again at Step 3. A flexible product will allow the administrator to select which changes to be applied or automatically apply all changes. Changes or patches should be tested first before being applied to production systems.
The return on investment of this approach is significant:
 | 
SecurityAdditional Resources WHITE PAPER
Enterprise flash drives provide a new Tier 0 storage layer capable of delivering high I/O performance at a very low latency. Proper use of EFDs in an Oracle environment can deliver increased performance compared to fibre channel drives. Read the recommendations for identification of the best DB components for EFDs.
 WHITE PAPER
The market for products to improve the delivery of application software over networks remains dynamic and innovative. Vendors focused on solving enterprises' most-pressing application problems have become the top players.
 WHITE PAPER
Server load balancers are a simple yet highly effective means to scale an application environment while ensuring its availability. Today's solutions should also address application performance and security. Read about the top eight criteria you should consider when choosing a server load balancer and how Citrix NetScaler meets those requirements.
White Papers & WebcastsDeath to PST Files The Tangled Web: Silent Threats & Invisible Enemies Tape Killed the IT Guy Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity BRM: What You Can Do To Reduce Risk In Challenging Times What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise? eGuide: Enterprise Security Disaster Recovery 2008: Reduced Costs and Improved Performance Computerworld Reports
White PapersSponsored Links
 
|
