2. Are no more than the
minimum required services operational?
Most operating systems ship with many frequently un-needed services
enabled by default. This leaves a larger surface area for attack. Make
sure that only the services really needed to do the job are running.
Resources: Common
UNIX Services to Disable TCPview
tool for detecting network services on Windows
3. Do all accounts have
strong passwords (or are disabled)?
Weak passwords are still a major cause of system compromises. Many
applications install system accounts for their use, typically with
simple or even blank default passwords. Be careful to include
application-level accounts in this step as well, such as web servers or
database software.
4. Is access to network
services limited to those networks which require access?
By default, most network services are available to anyone on the
network. Most operating systems include built-in features to allow
restricting this availability. Third-party firewall software can also
be used.
Resouces: General
Utilities for UNIX Security (TCP-Wrappers, ipfilter, iptables, etc) Restricting
ports on Windows Server
5. Are access/event/audit
logs being generated?
By default, some operating systems do little to no logging so it will
be impossible to have any warning of unusual events such as attempts to
break into the system.
Resources: Windows
Server Event Logging
6. Are strongly-encrypted
remote login protocols being used exclusively?
Traditional network access programs such as telnet, FTP, HTTP are
plain-text protocols and passwords will travel over the network
completely unprotected. There are more recent alternatives that will
work as well in almost every case, such as SSH which comes with nearly
every UNIX distribution. Use HTTPS for web-based logins that need to be
confidential. SSH Client
for Windows (instead of Telnet): PuTTy SCP
Client for Windows (instead of FTP): WinSCP
7. Is anti-virus software
in use?
File servers in particular need this, even on UNIX systems where files
will be shared with Windows systems. CNS provides anti-virus software
to the York community free of charge.
8. Remember to avoid using
server consoles for desktop-like functionality (web browsing, opening
office documents, etc).
Web browsing and document handling are two very common vectors for
intrusions/infections.
