PLANNING A SECURE BASELINE INSTALLATION CHAPTER 8

SELECTING COMPUTERS & OPERATING SYSTEM Selecting appropriate operating system is essential for your network. You should first start preparing a list of hardware requirements for each role your computers have to fill based on the hardware product supported by your OS. You should also have policies regarding how long the organization is expected to use the computers & how frequent the OS & application will be upgraded.

Understanding computer roles Computers have different capabilities & are used for a variety of tasks. Its crucial to understand what tasks the computers will perform & what components they need before you start selecting computers for your network.

Understanding the servers role Servers typically have faster processors, more memory & more disk space than workstations. The application it runs, defines the servers role. Most common server roles are as follows; Backup server Database server Domain controller Email server File & print server Web server

Understanding desktop workstation’s role Desktop workstations can have a wide range of functionality from simple system designed for 1 or 2 applications to high powered computers performing complex graphic, video and Computer Aided Design function. The basic function of a desktop on a network is to access server applications or files stored on servers so that the user can work with the data.

Creating hardware specifications Creating hardware specifications before evaluating computers for your network enables you to decide which components a computer needs to fulfill a particular role. Administering a large fleet of computers is the easiest when you define your computer’s role & standardize the hardware & software needed.

Server hardware specification You must consider the requirements & the capabilities of the applications that the server will run when you create the hardware specification. Computers marketed as servers have: more robust power supplies integrated components Sufficient amount of RAM & processor speed Supports multiple processors Requirements for fault tolerance

Desktop hardware specification Objective in creating desktop hardware specification is to design system suitable for a wide variety of tasks. Ideal situation = single computer design suitable for all users on your network Order large number of identical computer & get good deals Technician would have to familiarize with only one hardware configuration. For high security, users can use smart cards to authenticate themselves when they log on.

Selecting operating system Selecting OS for your network computers must be coordinated with developing your hardware specifications. Several other important factors; Application comparability – capable of running the applications you need. Support issues – cost involved in retraining technical personal if you change to different OS Security features – must have the security features your organizations requires. Cost – cost is always a factor when selecting an OS.

High-level security planning A security framework is a logical structured process by which your organization performs tasks like the following; Estimating security risks Specifying security requirements Selecting security features Implementing security policies Designing security deployments Specifying security management policies.

Creating a security design team To determine which people in your organization are going to be responsible for designing, implementing & maintaining the security policies. Organizations will assemble a team or committee responsible for security design. A well balanced team consists of people who can answer ; What are the organizations most valuable resources? What are the potential threats? What resources are most at risk? What security features are available? Etc etc

Mapping our a security life cycle Creating a security framework is not a one time project, but an ongoing concern. A security life cycle consists of basic phases; Designing a security infrastructure Implementing security features Ongoing security management.

Designing security infrastructure Security issues can have a major effect on many elements of your network design. The design phase begins with identifying the resources that need protection & evaluating the threats to those resources. Additional security products such as firewalls, smart card readers / biometric devices.

Designing security infrastructure Typical security plans includes implementations of the following principles; Access control – granting specific levels of access based on users identity Auditing – administrator monitors system & network activities over extended period. Authentication – verification of users identity before providing access to secured resources Encryption – protection of data thru cryptographic application Firewalls – system designed to prevent unauthorized access to private network from outside.

Implementing security features Implementation plan consists of a procedure & timetable for the process of evaluating, purchasing, installing & configuring security hardware & software products. Some softwares contain mechanism that enable users to enforce your policies.

Ongoing security managements As for technical staffs, security management means regular checking of audit logs & other resources as well as monitoring individual systems & network traffic for signs of intrusion. Administrators must also update the security software products as needed

Evaluating security settings File system permissions Basic security tools that enables you to specify which users & groups are given access to a specific folder/drive & what degree of access they have. Share permissions Consists of an access control mechanism that enables you to specify which users & groups are permitted to access a shared resource over network & the level of access they should have

Evaluating security settings Registry permissions Installing applications & configuring OS setting modifies registry elements. Specifies who has the permission to access the registry & to what extend he can access & modify it. Use registry editor

Evaluating security settings Account policy setting Enforce password history Maximum & minimum password age Maximum & minimum password length Password meet complexity requirements Account lockout threshold.

Evaluating security settings Audit policies Specifying the activities that the system should record in a log. Audit account logon events Audit account management Audit directory service access Audit logon events Audit policy change Audit system events.