Business Continuity and Disaster Recovery for InfoSec Managers

7.5 Hardening Systems 203

Chapter 7

 Establishing an effective configuration management process that

monitors for vulnerabilities in hardware and software and estab-

lishes a process to install and test security patches

 Maintaining up-to-date antivirus definitions and intrusion detec-

tion attack definitions

 Providing effective oversight of service providers and vendors to

identify and react to new security issues

 Senior management should require periodic security self-assessments

and reviews to provide an ongoing assessment of policy compliance

and ensure prompt corrective action of significant deficiencies.

 Security personnel should have access to automated tools appropriate

for the complexity of the organization systems. Automated security

policy and security log analysis tools can significantly increase the

effectiveness and productivity of security personnel.

7.4.2 Updating

Organizations should evaluate the information gathered to determine the

extent of any required adjustments to the various components of their

security program. The organization will need to consider the scope,

impact, and urgency of any new threat. Depending on the new threat or

vulnerability, the organization will need to reassess the risk and make

changes to its security process (e.g., the security strategy, the controls

implementation, or the security testing requirements). Organizational

management confronts routine security issues and events on a regular

basis. In many cases, the issues are relatively isolated and may be addressed

through an informal or targeted risk assessment embedded within an exist-

ing security control process.

For example, the organization might assess the risk of a new operating

system vulnerability before testing and installing the patch. More systemic

events, such as mergers, acquisitions, new systems, or system conversions,

however, would warrant a more extensive security risk assessment. Regard-

less of the scope, the potential impact and the urgency of the risk exposure

will dictate when and how controls are changed.

7.5 Hardening Systems

Many organizations use commercial off-the-shelf (COTS) software for

operating systems and applications. A COTS system generally provides

more functions than are required for the specific purposes for which it is

204 7.5 Hardening Systems

employed. For example, a default installation of a server operating system

may install mail, Web, and file-sharing services on a system whose sole

function is a Domain Name Server (DNS). Unnecessary software and ser-

vices represent a potential security weakness. Their presence increases the

potential number of discovered and undiscovered vulnerabilities present in

the system.

Additionally, system administrators may not install patches or monitor

the unused software and services to the same degree as operational software

and services. Protection against those risks begins when the systems are con-

structed and software is installed, through a process that is referred to as

“hardening” a system. When deploying off-the-shelf software, management

should harden the resulting system. Patching issues are discussed in further

detail later in this chapter.

System hardening is important because file and database servers used to

store an organization’s critical information resources must be kept strictly

confidential. Servers also store information used for management deci-

sions or customer billing, which demands a high level of integrity.

Authentication servers store information about user accounts and pass-

words. Any disclosure from an authentication server could compromise all

of the information on a network. Public servers (such as Web servers) are

used by an organization to represent itself to the public. The integrity of

the information on those servers is critically important to maintain the

image desired by corporate management and to satisfy customers. Web

servers used by customers for electronic commerce must be available and

reliable to prevent loss of revenue. Servers that provide essential services

for employees of your organization must be reliably available; otherwise,

people could be unable to work. As you can see, the reasons for hardening

systems are many, and all are quite valid. Hardening includes the actions

shown in Figure 7.1.

After deployment, the COTS systems may need updating with current

security patches. Additionally, the systems should be periodically examined

to ensure the software present on the systems is authorized and properly

configured.

7.5.1 Management of the Hardening Process

Most organizations today require an environment that is highly secure,

available, scalable, and manageable. One of the first steps in achieving this

optimum environment is to implement security hardening services for your

corporate servers. This involves some key activities and the generation of