"Attacks against vulnerabilities that can be repaired by patching represent less than a third of hacking attacks. When the U.S. Department of Defense did studies on the matter, it found that these attacks accounted for only 30 percent of hacking. In contrast, attacks against configurations, essentially poor system hardening, accounted for 70 percent of successful attacks..."
-Ira Winkler, author of "Spies Among Us" and global security strategist with CSC Consultin.
Large organisations have been the first to adapt to this new era of creating, implementing and maintaining security settings policies. Small to medium-sized enterprises (SMEs) are slowly recognising the importance of these policies on their own, or are being encouraged by large business partners to do so. Depending on the size of your organisation, you may already be struggling with this or will soon be tasked with it.
Common security settings can include making changes to systems to restrict or control remote access of a desktop, changing permissions on directories to enable or disable access, or enabling or disabling services such as FTP and remote login. Luckily, there are many guides available from security experts, like NSA, NIST, CIS, CSE and Microsoft, on how to configure and maintain security settings policies. Unfortunately, these recommendations can be extremely lengthy and tedious to review. Organisations, especially SMEs, may not have the time or dedicated resources needed to evaluate and thoroughly understand all of the information to create policies appropriate for their environment and different machines. For example, access to servers should be tightly controlled, whereas workstations may have less strict access policies. Similarly, you may want to have different settings for your laptops to encrypt data despite performance overheads.
Although necessary, creating these tighter security policies can sometimes come at a cost. They may break your existing applications or inconvenience users by changing accustomed usage behavior. To avoid these issues, try running reports against a single expert's recommendations and compare them against the current setting on the computers in your organisation. Or, begin by creating a policy with a few required settings you understand and enforce them. I like to suggest the following steps:
1. Create a policy with a few settings configured (perhaps a single setting)
2. Assign the policy to a set of computers
3. Deploy the settings
4. Run reports to verify compliance to the designated policy
5. Assess how the new settings are impacting the users and address individual issues
6. Go back and add a few more settings and repeat the process
Of all these tasks, developing a security policy is the hardest part. There are various tools available in the market to assist you with this process that I encourage you to explore and compare. Review the guides, as they may provide you the information in a more organised form to compare the experts' opinions and recommendations. Whatever tools you employ, remember that going beyond patch management is a critical factor in protecting and hardening your systems.
- Vijay Adusumilli is a senior product manager for St. Bernard Software.
.jpg&h=146&w=240&c=1&s=0)
