Internet Informations

Computer Security Standards
 Pick your OS:  Windows        Unix        Linux


These
pages contain system standards for servers and workstations. Such standards will provide an understanding of
what departments should be doing in protecting computer systems against attack.
                          
                          
                              
                    

Windows Workstation Standards

• Physical Security - Enable workstation screen lock
• Set BIOS password
• Do not save sensitive/mission critical data on a workstation
• Unbind unnecessary protocols, such IPX, NetBIOS, etc. Bind only TCP/IP
• No services, such as IIS, should be running on a workstation, .
• Must implement virus protection software
  • Regularly update virus definitions
  • Centrally managed Antivirus software is highly recommended
• Do not share folders on a workstation
• Run the latest compatible OS version
• Install the latest compatible service packs and security patches when available
• Use SSH or similar rather than Telnet
• Make frequent backups of your data
  • Periodically test backups for integrity
  • Store backups offsite on a monthly basis
• Do not login as an administrator on a regular basis. Administrator account should be used only for administrating the system.

Windows Server Standards

• Physical Security
• Set BIOS password
• All sensitive data must be stored on NTFS partition
• Change passwords or disable all default accounts
• Unbind unnecessary protocols, such as IPX/SPX, NetBIOS, etc. Bind only TCP/IP
• Turn off all unnecessary services, such as SMTP, NTP, Simple TCP/IP Services, etc.
• Must implement virus protection software
  • Regularly update virus definitions
  • Centrally managed Antivirus software is highly recommended
• Shared folders must have unique permissions for individual users
• Run the latest compatible OS version
• Install the latest compatible service packs and security patches when available
• System administrator must be on security mailing list(s) and applies fixes and upgrades in a timely manner
• Use SSH or similar rather than Telnet
• Make frequent backups of your server
  • Periodically test backups for integrity
  • Store backups offsite on a monthly basis
• Create and protect emergency repair disks
• Turn on auditing, such as account logging - failed and successful
• Review security event logs on a regular basis
• Turn off auto run for CD-ROM
• Monitor the audit logs
• Clock synchronized to a central UCF time server
• Use of Cracking tools to notify users of easily guessed passwords that were found
• Consider using a host based intrusion detection system (IDS), such as Zone-Alarm
• Disable floppy disk drives and hide drive letters
• Enable audits of backups and restores
• Restrict anonymous logon.
• No null user sessions should be allowed
• Rename the administrator account
• Encrypt the SAM password database with 128-bit encryption (syskey.exe for NT) if appropriate
• Establish procedures and guidelines for responding to incidents
• Disable POSIX and OS2 subsystems if appropriate

Unix Server Standards

• Physical Security
• Set BIOS password
• Email to postmaster@ and root@ go to a real person
• NFS shares are not exported to the world
• Change passwords or disable all default accounts
• Remove etc/hosts.equiv
• No accounts with null passwords
• Edit /etc/inetd.conf (or equivalent) to remove all unnecessary services. Specifically disable: uucp, systat, netstat, echo, discard, daytime, chargen, sprayd, rexd, finger, ftp, telnet, etc.
• Run the latest compatible OS version
• Install all vendor recommended service and security patches
• System administrator on security mailing list(s) applies fixes and upgrades in a timely manner
• Running the latest version of sendmail. You may consider using Postfix, Qmail, or Exim
• Use SSH or Kerberos instead of telnet or rlogin
• .rhosts files removed nightly by a script
• Rotate logs and accounting files (/var/adm/{acct,pacct}, /etc/wtmp) to keep a few weeks worth on line (/usr/lib/newsyslog )
• Make frequent backups of your server
  • Periodically test backups for integrity
  • Store backups offsite on a monthly basis
• Clock synchronized to a central UCF time server
• Use of Cracking tools to notify users of easily guessed passwords that were found
• sendmail configured to deny relaying, EXPN, VRFY, and DEBUG
• Mount all user partitions and /tmp and /var with "nosuid" option
• Install tcp-wrappers to help control and log access
• Install/run identd to help determine source of problems
• Use tripwire or other IDS package to detect changes to important files. Download Tripwire
• Regularly use other intrusion detection tools: Snort, Satan, Saint, COPS, Tiger, SHADOW, (Commercial: ISS, Cybercop)
• System administrator actively monitors for probes, and alerts responsible parties
• Establish procedures and guidelines for responding to incidents

Linux Server Standards

• Physical Security
• Set BIOS password
• NFS shares are not exported to the world
• Change passwords or disable all default accounts
• Remove etc/hosts.equiv
• No accounts with null passwords
• Edit /etc/inetd.conf (or equivalent) to remove all unneeded services
• Run the latest compatible OS version
• Installing all vendor recommended security patches
• System administrator on security mailing list(s) applies fixes and upgrades in a timely manner
• Running the latest version of sendmail. You may consider using Postfix, Qmail, or Exim.
• Use SSH or Kerberos for telnet or rlogin
• .rhosts files removed nightly by a script
• Make frequent backups of your server
  • Periodically test backups for integrity
  • Store backups offsite on a monthly basis
• Clock synchronized to a central UCF time server
• Use of Cracking tools to notify users of easily guessed passwords that were found
• sendmail configured to deny relaying, EXPN, VRFY, and DEBUG
• Mount all user partitions and /tmp and /var with "nosuid" option
• Consider using tcp-wrappers to help control and log access
• Install/run identd to help determine source of problems
• Use tripwire or other IDS package to detect changes to important files. Download Tripwire
• Regularly use other intrusion detection tools: Snort, Satan, Saint, COPS, Tiger, SHADOW, (Commercial: ISS, Cybercop)
• System administrator actively monitors for probes, and alerts the Network Security Team (NST)
• Establish procedures and guidelines for responding to incident