Free Management Security Assess= ment MSA Executive Analysis Scorecard Prioritized Action http://video.google.com/videoplay?docid=3D-41744491= 0876190163&q=3Drushinek+Accounting
(888)ITISJo= b.Net - Information Technology Information Systems Job Network specializing in Managemnt Baseline Security Analysis (MBSA) Vulnerability Assessment http://video.google.com/videoplay?docid=3D-2199987= 895572940206&q=3Drushinek+Accounting
(888)Nets-E= xpert.Org - the Network of Experts Organization providing Expert Witness Testimony and Computer Litigation Support Services email@Nets-Expert.Org h= ttp://video.google.com/videoplay?docid=3D5240188564675855151
(305)6384-3= 97 http://video.google.com/videoplay?docid=3D-4470389= 520639706819&q=3Drushinek+Accounting
Dr. A, &=
; S.
Rushinek, Ph.D. U. of Miami Professor, eMail@OnAFree.com
,
Accounting =
and
Computer Information Systems Dept.,
Free_Management_Secur=
ity_Assessment_MSA_Executive_Analysis_Scorecard_Prioritized_Action
|
|
|
e-Mail: ARsuh@OnTri= al.Org The On Trial Expert Witness Testimony & Computer Litigation team Dr. A. Rush (305)668-7425 |
http://www.onafree.com/default=
.aspx
http://www.onafree.com/Quiz%20Engine%20=
Projects/1Free%20Managemnt%20Baseline%20Security%20Analysis%20(MBSA)%20Vuln=
erability%20Assessment%20Trustworthy%20Computing%20Scanner.htm
This report contains =
the
following sections:
qExecutive Summary
wIntroduction
wBackground: Assessment Process and Scope
wSituation Analysis
wScorecard
wSecurity Initiatives
qAssessment in Detail
wAreas of Analysis
wInfrastructure
wApplications
wOperations
wPeople
qPrioritized Action List
qAppendices
wQuestions and Answers
wGlossary
wInterpreting the Graphs
A Microsoft partner c=
an
review this report with you and help with developing a detailed action plan=
for
implementing the recommendations. If you do not have an existing relationsh=
ip
with a Microsoft partner, you may wish to view a list of Microsoft Partners=
for
Security Solutions at http://directory.microsoft.com/mprd/.
The Microsoft Security Assessment Tool is designed to help =
you
determine the level of risk your computing infrastructure faces and the ste=
ps
you have taken to mitigate that risk, and to off=
er
suggestions of additional steps you can take to help further reduce your le=
vel
of risk. It is not a replacement for an audit by a professional security
consultant.
Use of the Microsoft Security Assessment Tool is governed by the terms of t=
he
End-User License Agreement (EULA) which accompanied the software, and this
report is subject to the exclusions, disclaimers, and limitations of liabil=
ity
contained in the EULA.
This report is for informational purposes only. Neither
Microsoft Corporation, its suppliers, or partners make any
representation or warranty of any kind, whether express or implied, concern=
ing
the Security Assessment Tool, or the use, accuracy, or reliability of the
results of the Assessment and information contained in this report.
Executive Summ= ary
Introduction
This Microsoft Securi=
ty
Assessment Tool is designed to assist you with identifying and addressing
security risks in your computing environment. The tool employs a holistic
approach to measuring security strategy by covering topics across people,
process, and technology. Findings are coupled with recommended mitigation
efforts, including links to more information for additional guidance if nee=
ded.
These resources may assist you in learning more about the specific tools and
methods that can help increase the security of your environment.
This summary section =
is
intended to give IT and senior managers a snapshot of the company's overall
security posture. Detailed findings and recommendations can be found in the
detailed report following.
Background: Assessment Process and Scope
The assessment is des=
igned
to identify the business risk of your organization and the security measures
deployed to mitigate risk. Focusing on common issues in this market segment,
the questions have been developed to provide a high-level security risk
assessment of the technology, processes, and people that support the busine=
ss.
Beginning with a seri=
es of
questions about your company's business model, the tool builds a Business R=
isk
Profile (BRP), measuring the risk of doing business your company must face =
due
to the industry and business model chosen. A second series of questions are
posed to compile a listing of the security measures your company has deploy=
ed
over time. Together, these security measures form layers of defense, provid=
ing
greater protection against security risk and specific vulnerabilities. Each
layer contributes to a combined strategy for defense-in-depth. This sum is
referred to as the Defense-in-Depth Index (DiDI). The BRP and DiDI are then
compared to measure risk distribution across the areas of analysis
(AoAs)—infrastructure, applications, operations, and people.
In addition to measur=
ing
the alignment of security risk and defenses, this tool also measures the
security maturity of your organization. Security maturity refers to the
evolution of strong security and maintainable practices. At the low end, few
security defenses are employed and actions are reactive. At the high end,
established and proven processes allow a company to be more proactive, and
respond more efficiently and consistently when needed.
Risk management
recommendations are suggested for your environment by taking into considera=
tion
existing technology deployment, current security posture, and defense-in-de=
pth
strategies. Suggestions are designed to move you along a path toward recogn=
ized
best practices.
This
assessment—including the questions, measures, and
recommendations—is designed for midsize organizations that have betwe=
en
50 and 500 desktops in their environment. It is meant to broadly cover area=
s of
potential risk across your environment, rather than provide an in-depth ana=
lysis
of a particular technology or process. As a result, the tool cannot measure=
the
effectiveness of the security measures employed. To that end, this report
should be used as a preliminary guide to help you focus on specific areas t=
hat
require more rigorous attention, and should not replace a focused assessmen=
t by
trained third-party assessment teams.
Situation Analysis
This section graphica=
lly
represents the concepts described above for your organization, based on the
answers you provided. As a reminder:
- BRP is a measure of the r=
isk
related to the industry and business model of the company
- DiDI is a measure of the
security defenses used across people, process, and technology to help
mitigate identified risks to the business
- Security Maturity is a me=
asure
of the organization's ability to effectively use the tools available to
create a maintainable security level across many disciplines
[See Appendices
for additional information on these terms and how to interpret the graphs.]=
Results:
|
Areas of Analysi=
s |
Risk-Defense Distribution |
Security Maturity |
|
Infrastructure |
|
|
|
Applications |
|
|
|
Operations |
|
|
|
People |
|
|
Risk-Defense Distribution
This chart indicates
differences in the Defense-in-Depth score, organized by Area of Analysis. B=
ased
on your answers to the risk assessment and as depicted in the chart below, =
it
appears that additional focus is needed to shore up security measures in so=
me
areas. This is a strong indicator that your security posture is based on a =
few
standard security solutions. Contacting a security partner that can help you
identify critical areas of risk should be made a priority of your near term
security plans.
Figure 1: Comparison of BRP and DiDI
In general, it is bes=
t to
have a DiDI rating on par with the BRP rating for the same category. An
imbalance either within a category or across categories—in either
direction—may indicate the need to realign your IT investments.
Security Maturity
Security maturity is
inclusive of controls (both physical and technical), the technical acumen o=
f IT
resources, policy, process, and maintainable practices. Security maturity c=
an
be measured only through the organization's ability to effectively use the
tools available to create a maintainable security level across many
disciplines. A baseline of security maturity should be established and used=
to
define areas of focus for the organization's security programs. Not all
organizations should strive to reach the optimized level, but all should as=
sess
where they are and determine where they should be, in light of the business
risk they face. For example, a company with a low-risk environment may never
need to advance beyond the upper range of the Baseline level or the lower r=
ange
of the Standardized level. A company with a high-risk environment will like=
ly
push well into the Optimized level. Your Business Risk Profile scores help =
you
gauge your risk.
|
nSecurity Maturity |
A measure of a company's prac=
tices
against industry best practices for maintainable security. Each company
should strive to align its maturity level, and associated security strate=
gy,
relative to the risks taken in doing business: |
|
nBaseline |
Some proactive security measu=
res
deployed as first-line defenses; operations and incident response still v=
ery
reactive |
|
nStandardized |
Multiple layers of defense de=
ployed
in support of a defined strategy |
|
nOptimized |
Effectively protecting the ri=
ght
things the right way and ensuring ongoing utilization of best practices |
Based on your answers=
to
the risk assessment and as depicted in the chart below, your company is doi=
ng
well in that it has a defined security strategy and a practices defense in
depth. You can further enhance your maturity by leveraging your comprehensi=
ve
corporate security policy, IT security policies and procedures for the IT
infrastructure. Use those to define a layered approach to security that fol=
lows
industry best practices, and applies only the necessary amount of protectio=
n to
assets.
Figure 2: Security Maturity
Scorecard
Based on your answers=
to
the risk assessment, the following ratings have been applied to your defens=
ive
measures. The Assessment Detail and Prioritized Action List sections of this repo=
rt
include further detail for each, including the findings, best practices, an=
d recommendations.
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
Security Initiatives
The following areas f=
all
short of best practices and should be addressed to increase the security of
your environment. The Assessment Detail and Prioritized Action List sections of this repo=
rt
include further detail for each, including the findings, best practices, and
recommendations.
|
High Priority |
Medium Priority<= o:p> |
Low Priority |
|
Anti-virus - Servers=
Clustering Anti-virus - Desktop=
s Management Host - Se=
rvers Application & Da=
ta
Recovery |
Virus Signatures Protocols & Serv=
ices Intrusion-Detection =
System
(IDS) Application Data Flo=
w Backup & Restore=
|
Firewall Rules and F=
ilters Governance Management Host Backup Management Host - Ne=
twork
Devices |
Assessment in Detail
This section of the r=
eport
provides the detailed findings for each category, as well as best practices,
recommendations, and references for additional information. Recommendations=
are
prioritized in the following section.
Areas of Analysis
The following table l=
ists
the areas that were included for high-level analysis in this security risk
assessment and describes each area's relevance to security. The Assessment
Detail section of this document describes your organization's security post=
ure
(based on answers you gave during the assessment) in each of these areas and
provides industry-recognized best practices and recommendations for achievi=
ng
those practices.
|
Cate=
gory |
Impo=
rtance
to security |
|
Busin=
ess
Risk Profile |
|
|
Business Risk Profil=
e |
Understanding how the
nature of your business affects risk is important in determining where to
apply resources in order to help mitigate those risks. Recognizing critic=
al
areas of business risk will help you to optimize allocation of your secur=
ity
budget. |
|
Infra=
structure |
|
|
Perimeter Defense |
Perimeter defense
addresses security at network borders, where your internal network connec=
ts
to the outside world. This constitutes your first line of defense against
intruders. |
|
Authentication |
Rigorous authenticat=
ion
procedures for users, administrators, and remote users help to ensure that
outsiders do not gain unauthorized access to the network through the use =
of
local or remote attacks. |
|
Management &
Monitoring |
Management, monitori=
ng,
and proper logging are critical to maintaining and analyzing IT environme=
nts.
These tools are even more important after an attack has occurred and inci=
dent
analysis is required. |
|
Workstations |
The security of indi=
vidual
workstations is a critical factor in the defense of any environment,
especially when remote access is allowed. Workstations should have safegu=
ards
in place to resist common attacks. |
|
Appli=
cations |
|
|
Deployment & Use=
|
When business-critic=
al
applications are deployed in production, the security and availability of
those applications and servers must be ensured. Continued maintenance is
essential to help ensure that security bugs are patched and that new
vulnerabilities are not introduced into the environment. |
|
Application Design |
Design that does not
properly address security mechanisms such as authentication, authorizatio=
n,
and data validation can allow attackers to exploit security vulnerabiliti=
es
and thereby gain access to sensitive information. |
|
Data Storage &
Communications |
Integrity and
confidentiality of data is one of the greatest concerns for any business.
Data loss or theft can hurt an organization's revenue as well as reputati=
on.
It is important to understand how applications handle business critical d=
ata
and how that data is protected. |
|
Opera=
tions |
|
|
Environment |
The security of an
organization is dependent on the operational procedures, processes and
guidelines that are applied to the environment. They can enhance the secu=
rity
of an organization by including more than just technology defenses. Accur=
ate
environment documentation and guidelines are critical to the operation te=
am's
ability to support and maintain the security of the environment. |
|
Security Policy |
Corporate security p=
olicy
refers to individual policies and guidelines that exist to govern the sec=
ure
and appropriate use of technology and processes within the organization. =
This
area covers policies to address all types of security, such as user, syst=
em,
and data. |
|
Backup & Recover=
y |
Data backup and reco=
very
is essential to maintaining business continuity in the event of a disaste=
r or
hardware/software failure. Lack of appropriate backup and recovery proced=
ures
could lead to significant loss of data and productivity. |
|
Patch & Update
Management |
Good management of p=
atches
and updates is important to securing an organization's IT environment. Th=
e timely
application of patches and updates is necessary to help protect against k=
nown
and exploitable vulnerabilities. |
|
Peopl=
e |
|
|
Requirements and
Assessments |
Security requirements
should be understood by all decision-makers so that both their technical =
and
business decisions enhance security rather than conflict with it. Regular
assessments by a third party can help a company review, evaluate, and
identify areas for improvement. |
|
Policies and Procedu=
res |
Clear, practical
procedures for managing relationships with vendors and partners can help
limit your company's exposure to risk. Procedures covering employee hiring
and termination can help protect your company from unscrupulous or
disgruntled employees. |
|
Training and Awarene=
ss |
Employees should be trained and made aware of how security applies to their daily job activit= ies so that they do not inadvertently expose their company to greater risks.<= o:p> |
Assessment Analysis
Infrastructure
Infrastructure securi=
ty
focuses on how the network should function, what business processes (intern=
al
or external) it must support, how hosts are built and deployed, and how the
network will be managed and maintained. Effective infrastructure security c=
an
help provide significant improvements in the areas of network defense, inci=
dent
response, network availability, and fault analysis. By establishing a sound
infrastructure design that is understood and followed, an organization can
identify areas of risk and can design methods of threat mitigation. The
assessment reviews high-level procedures that an organization can follow to
help mitigate infrastructure risk by focusing on the following areas of
infrastructure security:
- Perimeter
Defense—Firewalls, Anti-virus, Remote Access, Segmentation
- Authentication—Pass=
word
Policies
- Management &
Monitoring—Management Hosts, Log files
- Workstation—Build
Configuration
|
Peri=
meter
Defense |
|
Subca=
tegory |
Best
Practices |
|
Firewall Rules an=
d Filters |
Firewalls are a firs=
t-line
defense mechanism and should be placed at all network border locations. R=
ules
implemented on firewalls should be highly restrictive and set on a
host-by-host and service-by-service basis. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Firewall Rules and
Filters |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Firewall Rules and
Filters |
Your answers indicat=
e that
not only have you deployed firewalls at network borders, you have also ta=
ken
an extra precaution by creating one or more DMZ segments to protect
Internet-accessible resources. |
Review firewall poli=
cies
regularly and prune old or improper rules. Implement rules for controlling
inbound and outbound access and consider implementing egress filtering to
prevent unnecessary outbound connections. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Firewall Rules and
Filters |
You have indicated t=
hat
host-based firewall software is used to protect servers. |
Continue installing
host-based firewalls on all servers, and consider extending this software=
to
all desktops and laptops in the organization also. |
Resources
Securing Your Netw=
ork
This article, written=
for
network administrators and IT professionals, presents an overview of the top
network-level threats and the ways in which you can counter them. The autho=
rs
review security issues and the configuration settings to be applied to rout=
ers,
firewalls and switches.
http://msdn.microsoft.com/library/en-us/dnnetsec/html/THCMC=
h15.asp
FAQ About Internet
Firewalls
This FAQ is appropria=
te for
users who are not IT professionals and who have questions about using and
deploying a firewall.
http://www.microsoft.com/security/protect/firewall.asp
|
Subca=
tegory |
Best
Practices |
|
Anti-virus |
Deploy anti-virus
solutions throughout the environment on both the server and desktop level=
s.
Deploy specialized anti-virus solutions for specific tasks such as file
server scanners, content screening tools, and data upload and download
scanners. Configure anti-virus solutions to scan for viruses both entering
and leaving the environment. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Anti-virus |
You have indicated t=
hat
perimeter hosts have anti-virus software installed. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Anti-virus |
You have indicated t=
hat
email servers have anti-virus software installed. |
|
Resources
FAQ About Anti-vir=
us
Software
This FAQ is appropria=
te for
users who are not IT professionals and who have questions about using antiv=
irus
software.
http://www.microsoft.com/security/protect/antivirus.asp
|
Subca=
tegory |
Best
Practices |
|
Anti-virus - Desk=
tops |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Anti-virus - Desk=
tops |
You indicated that
anti-virus solutions have not been deployed at the desktop level. |
Consider deploying an
anti-virus solution to all employees' laptops and/or desktops. Add the
anti-virus client in the default workstation build environment. |
|
Subca=
tegory |
Best
Practices |
|
Anti-virus - Serv=
ers |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Anti-virus - Serv=
ers |
You indicated that
anti-virus solutions have not been deployed at the server level. |
Consider deploying an
anti-virus solution to critical file servers initially and then to e-mail,
database, and web servers. If you are using Microsoft Exchange, consider
using the additional anti-virus and content-filtering capabilities at the
mailbox level. |
|
Subca=
tegory |
Best
Practices |
|
Remote Access |
Workstations are a
critical factor in the defense of any environment, especially if there are
remote and roaming users that connect to the environment. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote Access |
You have indicated t=
hat
remote access to your organization's network is available |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote Access |
Your answers indicat=
e that
not only have you implemented a VPN for remote access, but you have also
incorporated multifactor authentication as a second line of defense. |
Regularly audit the =
access
list for all the users on the VPN device. Consider managing the VPN device
from inside the corporate network only. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote Access |
Your answers indicat= e that employees and/or partners remotely connect to your internal network, but = no VPN technology is currently being used to secure access for these users.<= o:p> |
Deploy VPN for
remote-user-access connectivity based on IP Security (IPSec), Secure Sock=
ets
Layer (SSL), and Secure Shell (SSH) technologies. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote Access |
You have indicated t=
hat
the VPN is capable of limiting connectivity to a quar=
antine
until all necessary security checks have been passed. |
|
|
Subca=
tegory |
Best =
Practices |
|
Segmentation |
Use segmentation to
separate specific extranets from vendor, partner, and customer access. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Segmentation |
Your response indica=
tes
that Internet-facing services are hosted on your organization's network |
Ensure that firewall=
s,
segmentation and intrusion-detection systems are in place in order to pro=
tect
the company's infrastructure from Internet-based attacks. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Segmentation |
You have indicated t=
hat
the network has more than one segment. |
Continue using netwo=
rk
segmentation in order to better manage network traffic and limit access t=
o resources
based on user requirements. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Segmentation |
Your answer indicate=
s that
network segmentation is not currently being used in the environment. It is
important to keep customer-/partner-specific extranet services on their o=
wn
network segments. |
Move extranet access
servers to a physically separate network segment. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Segmentation |
You have indicated t=
hat
hosts are grouped into network segments based on offering similar service=
s. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Segmentation |
You have indicated t=
hat
hosts are grouped into network segments based on providing only the neces=
sary
services for the users that connect. |
|
|
Subca=
tegory |
Best
Practices |
|
Remote-Access Use=
rs |
Implement complex pa=
ssword
controls for all users of remote access, whether this access is granted
through the use of dial-up or VPN technologies. A password is considered =
to
be complex if it meets the following criteria: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote-Access Use=
rs |
You have indicated t=
hat
employees are not able to remotely connect to the network. |
By not allowing remo=
te
access, you reduce your overall risk. However if remote access is planned=
or
implemented in the future, be sure to follow best practice when deploying=
the
remote-access solution in order to minimize the risk associated with that
access. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote-Access Use=
rs |
You have indicated t=
hat
contractors are not able to remotely connect to the network. |
By not allowing remo=
te
access, you reduce your overall risk. However if remote access is planned=
or
implemented in the future, be sure to follow best practice when deploying=
the
remote-access solution in order to minimize the risk associated with that
access. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote-Access Use=
rs |
You have indicated t=
hat
third parties are not able to remotely connect to the network. |
By not allowing remo=
te
access, you reduce your overall risk. However if remote access is planned=
or
implemented in the future, be sure to follow best practice when deploying=
the
remote-access solution in order to minimize the risk associated with that
access. |
|
Subca=
tegory |
Best
Practices |
|
Intrusion-Detecti=
on
System (IDS) |
Both network- and
host-based intrusion-detection systems should be deployed to detect and
notify of attacks against corporate systems. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Intrusion-Detecti=
on
System (IDS) |
You have indicated t=
hat
you are using intrusion-detection hardware or software. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Intrusion-Detecti=
on
System (IDS) |
You have indicated t=
hat
you are not using a host-based intrusion-detection system (HIDS) |
Consider deploying
host-based intrusion-detection systems, which can help notify administrat=
ors
that an attack is occurring against your hosts and help the administrators
respond in a timely manner. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Intrusion-Detecti=
on
System (IDS) |
You have indicated t=
hat
you are using a network-based intrusion-detection system (NIDS) |
Continue the practic=
e of
deploying a network-based intrusion-detection system. Ensure that the
signatures are kept current, and investigate intrusion-prevention technol=
ogy
as it becomes more widely available. |
Resources
Auditing & Int=
rusion
Detection
This document provide=
s a
high-level overview of what types of events you should be logging and their
importance in trying to detect an intruder. It also covers different monito=
ring
techniques and detection methods.
|
Subca=
tegory |
Best
Practices |
|
Wireless |
Best practice for wi=
reless
implementation should include ensuring that the network does not broadcast
its SSID; that WPA encryption is used; that the network is fundamentally
treated as untrustworthy. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
You have indicated t=
hat
wireless connectivity to the network is available |
In order to minimize=
the
risk associated with wireless networks, the implementation should include
non-broadcast of SSID, WPA encryption, and treating the network as untrus=
ted. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
You have indicated t=
hat
the wireless network is not treated as untrusted. |
Consider migrating your wireless network to an untrusted netw=
ork
segment and requiring the use of VPN or similar technologies in order to
better preserve data integrity. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
You have indicated t=
hat
you are not using WEP encryption in your wireless environment. |
If you are currently=
using
no encryption, consider using WPA to prevent wireless network traffic fro=
m being
'sniffed' and read as clear text. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
You have indicated t=
hat
you are not using WPA encryption in your wireless environment. |
If you are currently=
using
no encryption, consider using WPA to prevent wireless network traffic from
being 'sniffed' and read as clear text. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
You have indicated t=
hat
you have not disabled broadcasting of the SSID on the access point. |
Consider disabling S=
SID
broadcast to make it more difficult for a casual user to attempt to conne=
ct
to your wireless network. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
You have indicated t=
hat
you are not using MAC restrictions in your wireless environment. |
Consider using WPA
authentication in addition to MAC filtering in order to prevent unauthori=
zed
computers from connecting to the network. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Wireless |
Your response is tha=
t you
have changed the SSID on the access point from the default. |
Changing the default=
SSID
is the first step in securing your wireless network. However, this needs =
to
be combined with further best practices in order to minimize risk. These
include non-broadcast of SSID, WPA encryption, and treating the network as
untrusted. |
|
Auth=
entication |
|
Subca=
tegory |
Best
Practices |
|
Administrative Us=
ers |
For administrative
accounts, implement a strict policy that requires the use of complex
passwords that meet the following criteria: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Administrative Us=
ers |
Your answers indicat=
ed
that currently there is either none or only simple password authentication
required for administrative access to manage devices and hosts. |
Consider implementing
complex password controls for all administrative accounts and service
accounts. A password is considered to be complex if it meets the following
criteria: |
|
Subca=
tegory |
Best
Practices |
|
Internal Users |
For user accounts,
implement a policy that requires the use of complex passwords that meet t=
he
following criteria: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Internal Users |
You indicated that
multifactor authentication is required for user access to the internal
network and hosts. |
To further mitigate =
the
risk of access to the environment being gained through low-level user
accounts, consider implementing the following controls: |
|
Subca=
tegory |
Best
Practices |
|
Remote-Access Use=
rs |
Implement complex pa=
ssword
controls for all users of remote access, whether this access is granted
through the use of dial-up or VPN technologies. A password is considered =
to
be complex if it meets the following criteria: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Remote-Access Use=
rs |
You indicated that
multifactor authentication is required for users who remotely access your
internal network and host computers. |
To further mitigate =
the
risks of brute-force password attacks through remote access services,
consider implementing the following controls: |
|
Subca=
tegory |
Best
Practices |
|
Password Policies=
|
Typically the restri=
ctions
around creating passwords for administrators should be greater than those=
for
normal accounts. |
|
Subca=
tegory |
Best
Practices |
|
Password Policies=
-
Administrator Account |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Password Policies=
-
Administrator Account |
You have indicated t=
hat
administrator accounts have password policies implemented. |
Consider implementing
additional protections around administrative accounts, such as logging and
monitoring services, around all successful and failed authentications. |
|
Subca=
tegory |
Best
Practices |
|
Password Policies=
-
User Account |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Password Policies=
-
User Account |
You have indicated t=
hat
user accounts have password policies implemented. |
Consider implementing
logging thresholds around failed authentications so that alerts can be se=
nt to
systems administrators. |
|
Subca=
tegory |
Best
Practices |
|
Password Policies=
-
Remote-Access Account |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Password Policies=
-
Remote-Access Account |
You have indicated t=
hat
remote access accounts have password policies implemented. |
Consider implementing
additional security around remote-access accounts through the use of logg=
ing
and monitoring services on the remote-access device/host. |
|
Mana=
gement
and Monitoring |
|
Subca=
tegory |
Best
Practices |
|
Build |
Maintain a build pro=
cess
with all vendor patches and recommended lockdown configuration. Test this
process regularly. |
|
Subca=
tegory |
Best
Practices |
|
Secure Build |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
your system builds include host-hardening procedures. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
remote control/management software is not used in the environment. |
Continue the practic=
e of
not using remote control/management software. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
disk-encryption software is not used in the environment. |
Consider using disk
encryption software in order to prevent data compromise in the event of
machine theft. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat a
password-protected screen saver is not used in the environment. |
Consider requiring a=
ll
users to have a password-protected screen saver with a short time-out per=
iod. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
personal firewalls have not been installed on all of the workstations in =
the
environment. |
Implement a policy w=
hich
calls for periodic review of default firewall settings, so as to allow for
changes in applications or services being used. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
client-side remote access software has been installed on workstations that
connect remotely to the internal network. |
Consider using a sin=
gle
remote-access solution for the environment, if there are multiple types of
solution deployed. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
modems are not used in the environment. |
Continue disabling m=
odem
and dial-up access in order to reduce the risk of having machines able to=
be
directly dialed into. |
Resources
Windows Server 2003
Security Guide
This guide provides
easy-to-understand advice, tools, and templates to help you secure
Microsoft® Windows Server™ 2003 operating system in many
environments. Network administrators and IT professionals responsible for
installing and configuring servers would likely benefit the most from this
information.
Microsoft Gold Cer=
tified
Partners
The Microsoft® Go=
ld
Certified Partner Program for Security Solutions will help you find special=
ists
in building and deploying IT solutions that help protect user security. Mic=
rosoft
works closely with partners to help ensure they have the highest level of
expertise with Microsoft technologies and solutions.
http://directory.microsoft.com/resourcedirectory/Services.a=
spx
Securing Your Data=
base
Server
Database architects a=
nd
database administrators will benefit most from this guide, which provides a
proven methodology for securing database servers--Microsoft® SQL
Server™ in particular. The guide reviews the most common threats that
affect database servers, then steps through the process of applying a secure
configuration.
http://msdn.microsoft.com/library/en-us/dnnetsec/html/THCMC=
h18.asp
passfilt.dll
Passfilt.dll is a
replacement .dll for Microsoft® Windows NT® 4.0 operating system. U=
sing
passfilt, you can modify the operating system's default parameters to provi=
de
strong password support and administrative account lockout (at the network
level).
|
Subca=
tegory |
Best
Practices |
|
Third-Party
Relationships |
To help reduce the r=
isk of
exposure, formal policies and procedures should exist to govern relations=
hips
with third parties. These policies and procedures help to identify securi=
ty
issues and the responsibilities of each party in mitigating them. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Third-Party
Relationships |
You have indicated t=
hat
systems are configured by internal staff. |
Systems should be
configured by internal staff following a tested build image. |
|
Subca=
tegory |
Best
Practices |
|
Physical Security=
|
All computer systems
should be secured to prevent easy theft. Servers and networking equipment
should be secured in locked cabinets in locked rooms with controlled acce=
ss. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
Your response indica=
ted
that physical security controls have been deployed to secure your
organization's assets. |
Continue use of phys=
ical
controls, and consider extending them to all computer equipment, if that =
has
not already been done. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
servers are not in a lockable cabinet or rack. |
Having servers in a
lockable cabinet/rack further protects against unauthorized tampering. If
possible, consider migrating servers to lockable enclosures. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat an
alarm system has not been installed to detect and report break-ins |
Consider installing =
an
alarm system in order to detect and report break-ins. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
networking equipment is not in a locked room with restricted access. |
Networking equipment
should be secured in a locked room or closet. Plan to migrate
network equipment to a more secure area. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
workstations are not secured with cable locks |
In order to prevent =
theft,
consider securing workstations with cable locks. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
laptops are not secured with cable locks |
In order to prevent =
theft,
consider securing laptops with cable locks. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
sensitive printed materials are not stored in locked file cabinets. |
Sensitive documents =
should
be kept in locked cabinets in order to prevent theft and disclosure of
sensitive information. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
network equipment is also in a lockable cabinet or rack. |
Having network equip=
ment
in a lockable cabinet/rack further protects against unauthorized tamperin=
g.
Ensure that access to keys/combinations is limited to only those who have=
a
business need. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Physical Security=
|
You have indicated t=
hat
servers are not in a locked room with restricted access. |
Servers should be se=
cured
in a locked room or closet. Plan to migrate the
servers to a more secure area. |
Resources
Basic Physical Sec=
urity
This resource provide=
s a
snapshot of the three basic principles of physical security: keeping people
away, keeping people out, and protecting your plumbing.
Applications
A
thorough understanding of application security requires in-depth knowledge =
of
the basic underlying application architecture as well as a solid understand=
ing
of the application's user base. Only then can you begin identifying the
potential threat vectors.
Given the limited scope of this self assessment, a complete analysis of
application architecture and thorough understanding of the user base is not
possible. This assessment is meant to help you review applications within y=
our
organization and assess them from a security and availability standpoint. It
examines technologies used within the environment to help enhance
Defense-in-Depth. The assessment reviews the high level procedures an organ=
ization
can follow to help mitigate application risk by focusing on the following a=
reas
of application security:
- Deployment &
Use—Mechanisms to enhance availability
- Application Design
—Authentication, Access Control, Update Management, Input
Validation, Logging & Auditing
- Data Storage &
Communications—Encryption, Data Transfer, Restrictive Access
|
Appl=
ications |
|
Subca=
tegory |
Best
Practices |
|
Load-Balancing |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Load-Balancing |
You have indicated t=
hat
load balancers are currently deployed in the environment. |
Periodically audit t=
he
configuration of your load balancers and run diagnostics on a regular bas=
is
to make sure they are functioning properly. |
|
Subca=
tegory |
Best
Practices |
|
Clustering |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Clustering |
You have indicated t=
hat
clustering is not deployed in your environment. |
To ensure high
availability for critical databases and file shares, consider deploying
clustering mechanisms. |
|
Subca=
tegory |
Best
Practices |
|
Application &=
Data
Recovery |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Application &=
Data
Recovery |
You have indicated t=
hat
your organization has line of business applications |
Any Line of Business
applications should be periodically evaluated for security, backed up
regularly, fully documented, and have continge=
ncies
in place in case they fail. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Application &=
Data
Recovery |
Your response indica=
tes
that regular testing of application and data recovery is not performed. |
Perform full backups
regularly. Perform regular tests of the backup and recovery mechanism that
permits restoration of the application to a normal operating state. |
|
Subca=
tegory |
Best
Practices |
|
Third-party indep=
endent
software vendor (ISV) |
The third-party
independent software vendor (ISV) should regularly provide patches and up=
grades
for their application, and they should explain the purpose of patches and=
any
impact you may expect in terms of the functionality, configuration, or
security of the application being patched. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Third-party indep=
endent
software vendor (ISV) |
You have indicated t=
hat
third party vendors have developed one or more of the key applications in
your environment. |
Ensure that the third
party who has developed your key software will continue to support that
software, provide updates in a timely manner, and can provide you with so=
urce
code in the event that the third party can no longer support the applicat=
ion. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Third-party indep=
endent
software vendor (ISV) |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
Subca=
tegory |
Best
Practices |
|
Internally Develo=
ped |
The in-house develop=
ment
team should regularly provide patches and upgrades for their application,=
and
they should explain the purpose of patches and any impact you may expect =
in
terms of the functionality, configuration, or security of the application
being patched |
|
|
Findi=
ngs |
Recom=
mendations |
|
Internally Develo=
ped |
You have indicated t=
hat
your organization uses custom macros for office applications. |
Using custom macros
requires that the security settings in Office are downgraded, exposing yo=
ur
office applications to malicious documents. Consider limiting the ability=
to
develop and run custom macros to only those that have a business need. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Internally Develo=
ped |
Your responses indic=
ate
that your in-house development team provides you with regular software
updates and security patches for applications developed by them. |
Continue to work wit=
h the
development team to address all application and security issues in the
deployed applications. |
|
Subca=
tegory |
Best
Practices |
|
Vulnerabilities |
All known security
vulnerabilities should be identified and patched. Regularly monitor vendor
and third-party security sites for new vulnerability information and
available patches. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Vulnerabilities |
Your responses indic=
ate
that procedures exist for addressing known security vulnerabilities in
applications you are currently using. |
These procedures sho=
uld
include lab testing of the patches as well as application testing after t=
he
patch has been applied, to identify conflicts that may require the patch =
to
be rolled back. |
|
Appl=
ication
Design |
|
Subca=
tegory |
Best
Practices |
|
Authentication |
The application shou=
ld
implement an authentication mechanism whose strength is commensurate with
requirements governing security of data or access to functionality.
Applications that rely on passwords should provide for password complexity
constraints that include character mix (alpha, numeric, and symbols), min=
imum
length, history maintenance, enforced lifetime, pre-expiration, and
dictionary checking. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Authentication |
Your responses indic=
ate
that multifactor authentication is being used for key applications. |
To further mitigate =
the
risks of brute-force password attacks for external applications, consider
implementing the following controls: |
|
Subca=
tegory |
Best
Practices |
|
Password Policies=
|
The use of strong
passwords is a basic element of Defense-in-Depth. Strong passwords should=
be
8 to 14 characters in length, with alphanumeric and special characters.
Minimum length, history maintenance, lifetime, and pre-expiration of
passwords should all be set to provide additional defenses to password
strength. In general, password expiration should be set to the following:=
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Password Policies=
|
Your response indica=
tes
that strong password controls are implemented across key applications. |
Consider implementing
logging thresholds around failed authentications so that alerts can be se=
nt
to systems administrators. Also consider extending the use of strong
passwords across all applications. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Password Policies=
|
Your response indica=
tes that
account lockout controls are not implemented across key applications. |
Think about implemen=
ting
account lockout (after 10 failed attempts), initially for all critical
external applications. The controls around account lockout can vary from
being focused on blocking brute-force password attacks to as complex as
requiring administrator intervention to unlock the account. Consider the
following guidelines when implementing controls around account lockout: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Password Policies=
|
Your response indica=
tes
that a password-expiration control is not implemented across key
applications. |
Consider implementing
password expiration for all types of accounts for critical applications b=
ased
on the guidelines mentioned in the Best Practice column. In general, pass=
word
expiration should be set to the following: |
|
Subca=
tegory |
Best
Practices |
|
Authorization &am=
p;
Access Control |
Applications should
implement an authorization mechanism that provides access to sensitive da=
ta
and functionality only to suitably permitted users or clients. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Authorization &am=
p;
Access Control |
Your response indica=
tes
that key applications restrict access to sensitive data and functionality
based on privileges assigned to the account. |
Consider conducting
focused application testing on key applications that process sensitive da=
ta
and on the interfaces available to users from the Internet. |
|
Subca=
tegory |
Best
Practices |
|
Logging |
Logging should be en=
abled
across all applications in the environment. Log file data is important for
incident and trend analysis as well as for auditing purposes. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
Your answers indicat=
e that
various events are being logged by applications in the environment. The a=
pplications
should log all events based on listed best practices. |
For ease of log-file
management and analysis, consider integrating with a centralized logging
mechanism. The logging mechanism should retain and archive logs in accord=
ance
with applicable corporate data retention policies. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
changes to user accounts are not logged. |
Consider logging cha=
nges
to user accounts in order to detect privilege escalations and unauthorized
new account creations. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
successful access to resources is not logged. |
Consider logging
successful access to resources in order to trace malicious behavior after=
the
fact. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
access denied to resources is not logged. |
Consider logging acc=
ess
denied to resources in order to be able to detect attempts at privilege
escalation. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
changes to data are not logged. |
Consider logging cha=
nges
to data in order to track malicious activity. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
application errors are not logged. |
Consider logging
application errors in order to be able to troubleshoot and detect any Tro=
jan
horses or malicious code. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
successful authentications are not logged. |
Consider logging
successful authentications in order to track user activity. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Logging |
You have indicated t=
hat
failed authentication attempts are logged. |
Continue logging fai=
led
authentication attempts. |
|
Subca=
tegory |
Best
Practices |
|
Input Validation<= o:p> |
The application may =
accept
input at multiple points from external sources, such as users, client app=
lications,
and data feeds. It should perform validation checks of the syntactic and
semantic validity of the input. It should also check that input data does=
not
violate limitations of underlying or dependent components, particularly
string length and character set. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Input Validation<= o:p> |
Your response indica=
tes
that input from data feeds is not validated. |
Work with the applic=
ation
vendor (ISV or internal development team) to implement mechanisms to vali=
date
all data input. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Input Validation<= o:p> |
Your response indica=
tes
that all end-user input is validated. |
Continue to audit ea=
ch
application to ensure that user input is consistently and appropriately
validated. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Input Validation<= o:p> |
Your response indica=
tes
that client application input is not validated. |
Work with the applic=
ation
vendor (ISV or internal development team) to implement mechanisms to vali=
date
all data input. |
|
Data
Storage & Communications |
|
Subca=
tegory |
Best
Practices |
|
Encryption |
Sensitive data shoul=
d be
encrypted or hashed in the database and file system. The application shou=
ld
differentiate between data that is sensitive to disclosure and must be
encrypted, data that is sensitive only to tampering and for which a keyed
hash value (HMAC) must be generated, and data that can be irreversibly
transformed (hashed) without loss of functionality (such as passwords). T=
he
application should store keys used for decryption separately from the
encrypted data. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Encryption |
Your response indica=
tes
that key applications in your environment are encrypting sensitive data p=
rior
to transmission. Your answer indicates that key applications in your
environment do encrypt sensitive data that is in storage. |
Use industry-standard
encryption algorithms for all encryption. |
|
Subca=
tegory |
Best
Practices |
|
Encryption - Algo=
rithm |
The application shou=
ld use
industry-standard cryptographic algorithms with keys of appropriate sizes=
and
cryptographic modes appropriate to the need. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Encryption - Algo=
rithm |
You have indicated t=
hat
you are using DES encryption. |
Consider upgrading y=
our
encryption to 3DES or AES in order to make it much more difficult to break
through brute-force techniques. |
Operations
This
area of analysis examines the operational practices, procedures, and guidel=
ines
followed by the organization to help enhance Defence-in-Depth. This assessm=
ent
examines policies and procedures that govern system builds, network
documentation, and the use of technology within the environment. It also
includes supporting activities required to manage the information and
procedures used by the administrators and operations staff within the
environment. By establishing operational practices, procedures, and guideli=
nes
that are understood and followed, an organization can potentially enhance i=
ts
Defense-in-Depth posture. The assessment reviews high level procedures an
organization can follow to help mitigate operations risk by focusing on the=
following
areas of operations security:
- Environment—System =
Build,
Network Documentation, Application Data Flow, Application Architecture=
- Security Policy—Pro=
tocols
& Services, Acceptable Use, User Account Management
- Patch & Update
Management—Patch Management, Virus Signatures
- Backup &
Recovery—Backup, Storage, Testing
|
Envi=
ronment |
|
Subca=
tegory |
Best
Practices |
|
Firewall Rules and
Filters |
Firewalls are a firs=
t-line
defense mechanism and should be placed at all network border locations. R=
ules
implemented on firewalls should be highly restrictive and set on a
host-by-host and service-by-service basis. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Firewall Rules and
Filters |
You have indicated t=
hat
the firewall is tested regularly to ensure proper performance. |
Continue regular tes=
ting
of your firewall. Ensure that functionality is working as expected not on=
ly
from external traffic, but that the firewall is also behaving as expected
towards internal traffic. |
Resources
Securing Your Netw=
ork
This article, written=
for
network administrators and IT professionals, presents an overview of the top
network-level threats and the ways in which you can counter them. The autho=
rs
review security issues and the configuration settings to be applied to rout=
ers,
firewalls and switches.
http://msdn.microsoft.com/library/en-us/dnnetsec/html/THCMC=
h15.asp
FAQ About Internet
Firewalls
This FAQ is appropria=
te for
users who are not IT professionals and who have questions about using and
deploying a firewall.
http://www.microsoft.com/security/protect/firewall.asp
|
Subca=
tegory |
Best
Practices |
|
Administrative Us=
ers |
For administrative a=
ccounts,
implement a strict policy that requires the use of complex passwords that
meet the following criteria: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Administrative Us=
ers |
You have indicated t=
hat
separate logins are used for secure administration of systems and devices
within the environment. |
Continue requiring
separate accounts for administrative/management activity, and ensure that
administrative credentials are changed frequently. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Administrative Us=
ers |
You have indicated t=
hat
users have been granted administrative access to their workstations. |
Consider removing
administrative access for users, in order to limit the ability to modify =
the
secure build. |
|
Subca=
tegory |
Best
Practices |
|
Management Host |
When management pack=
ages
are used, the administrative consoles should be hardened and physically
secured. |
|
Subca=
tegory |
Best
Practices |
|
Management Host -
Servers |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Management Host -
Servers |
Your answers indicat=
e that
a dedicated management computer does not exist for servers. |
Consider deploying a
separate management workstation to administer the servers on the network.=
|
|
Subca=
tegory |
Best
Practices |
|
Management Host -
Network Devices |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Management Host -
Network Devices |
You indicated that a
dedicated management computer for administering network devices has been
deployed. |
Test all management
systems that utilize SNMP to ensure that they are patched to the latest
version and do not use default community settings. |
|
Subca=
tegory |
Best
Practices |
|
Third-Party Relat=
ionships |
To help reduce the r=
isk of
exposure, formal policies and procedures should exist to govern relations=
hips
with third parties. These policies and procedures help to identify securi=
ty
issues and the responsibilities of each party in mitigating them. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Third-Party
Relationships |
You have indicated t=
hat
your organization manages the computing environment itself. |
Based on business ne=
eds,
either self management or outsourcing can be viable solutions. If the
management is outsourced, security requirements should be addressed in the
contract, and service-level agreements (SLAs) used to enforce compliance =
with
those requirements. |
|
Secu=
rity
Policy |
|
Subca=
tegory |
Best
Practices |
|
Secure Build |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
the build processes for infrastructure devices have been documented. |
Continue using a
documented build process for infrastructure devices, and ensure that the
build is kept current as new patches are released. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
the build processes for servers have been documented. |
Implement a document=
ed
build process for servers, and ensure that the build is kept current as n=
ew
patches are released. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Secure Build |
You have indicated t=
hat
the build processes for workstations and laptops have been documented. |
Implement a document=
ed
build process for workstations and laptops, and ensure that the build is =
kept
current as new patches are released. |
Resources
Windows Server 2003
Security Guide
This guide provides
easy-to-understand advice, tools, and templates to help you secure
Microsoft® Windows Server™ 2003 operating system in many
environments. Network administrators and IT professionals responsible for
installing and configuring servers would likely benefit the most from this
information.
Microsoft Gold Cer=
tified
Partners
The Microsoft® Go=
ld
Certified Partner Program for Security Solutions will help you find special=
ists
in building and deploying IT solutions that help protect user security. Mic=
rosoft
works closely with partners to help ensure they have the highest level of
expertise with Microsoft technologies and solutions.
http://directory.microsoft.com/resourcedirectory/Services.a=
spx
Securing Your Data=
base
Server
Database architects a=
nd
database administrators will benefit most from this guide, which provides a
proven methodology for securing database servers--Microsoft® SQL
Server™ in particular. The guide reviews the most common threats that
affect database servers, then steps through the process of applying a secure
configuration.
http://msdn.microsoft.com/library/en-us/dnnetsec/html/THCMC=
h18.asp
passfilt.dll
Passfilt.dll is a
replacement .dll for Microsoft® Windows NT® 4.0 operating system. U=
sing
passfilt, you can modify the operating system's default parameters to provi=
de
strong password support and administrative account lockout (at the network
level).
|
Subca=
tegory |
Best
Practices |
|
Protocols &
Services |
Clearly document the
standards and practices regarding which protocols and services are allowe=
d by
the organization. Access-control lists should be verified to ensure that =
all
services allowed have a business need for the level of access granted.
Identify specific IP addresses/ranges wherever possible. Servers should h=
ave
their services limited to only those required by the business need. Speci=
fics
for protocol version and minimum encryption strength should also be state=
d in
these guidelines. Enforce accepted protocol usage through the use of
perimeter devices (routers, gateways, firewalls, etc.), strong
authentication, and encrypted communications. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Protocols &
Services |
Your response indica=
tes
that you have documented guidelines that govern which protocols and servi=
ces
are allowed on the corporate network. |
Audit the documentat=
ion
for allowed protocols and services and check that it conforms to the
configured ACLs and firewall rules on the respective devices. |
|
Subca=
tegory |
Best
Practices |
|
Acceptable Use |
An Acceptable Use po=
licy
exists to govern the appropriate use of corporate networks, applications,
data, and systems. The policy should also cover digital media, printed me=
dia,
and other intellectual property. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Acceptable Use |
Your response indica=
tes
that a corporate acceptable use policy exists at your organization. |
All employees and
customers who use any corporate resources should be familiar with these
policies. Make the policies available on the corporate intranet and consi=
der
introducing them as part of new employee orientation. |
|
Subca=
tegory |
Best
Practices |
|
User Account Mana=
gement |
Individual user acco=
unts
should be created for all persons needing access to IT resources. Accounts
should not be shared among users. By default, accounts should be created =
with
the minimum required privileges enabled. Network and server administrators
should have privileged (administrator) as well unprivileged accounts.
Password strength should be enforced and regularly audited and all account
modifications should be logged. As an individual's role changes, all acco=
unt
privileges should be reviewed and modified as necessary. When employment =
is
terminated, all accounts should be disabled or removed. |
|
|
Findi=
ngs |
Recom=
mendations |
|
User Account Mana=
gement |
Your response indica=
tes
that policies governing individual user account management are being used
within the environment. |
It is important to m=
anage
individual user accounts through a list of policies mentioned in the best
practice section. |
|
|
Findi=
ngs |
Recom=
mendations |
|
User Account Mana=
gement |
You have indicated t=
hat
user accounts are not shared. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
User Account Mana=
gement |
You have indicated t=
hat
administrators do not have both privileged and unprivileged accounts. |
Administrators shoul=
d be
required to use unprivileged accounts for regular work, and only use
privileged accounts when needed. |
|
|
Findi=
ngs |
Recom=
mendations |
|
User Account Mana=
gement |
You have indicated t=
hat
accounts are not disabled when users leave your organization. |
To protect against
malicious ex-employees, all accounts should be immediately disabled on ex=
it. |
|
|
Findi=
ngs |
Recom=
mendations |
|
User Account Mana=
gement |
You have indicated t=
hat
password strength is not enforced. |
Policy should define=
a
minimum password strength, which should then be enforced by the authentic=
ation
mechanism. |
|
Subca=
tegory |
Best
Practices |
|
Security Requirem=
ents |
The organization
identifies individuals with subject-matter expertise in security to be
involved in all security-related discussions and decisions. The organizat=
ion
identifies what it needs to protect based on the value of the asset, as w=
ell
as the level of security needed to protect it. All threat vectors are
included in the analysis. The resulting strategy balances cost and benefi=
t of
the protections, and may include transfer or acceptance of risk as an opt=
ion.
Security requirements, derived from both business and technical
representatives, are documented and published for all parties to review a=
nd
address in future designs. Differences between classes of applications and
data may result in different end requirements being identified. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
your organization has a model for assigning criticality levels to each
component of the computing environment. |
Continue to assign l=
evels
of criticality to components, and be sure to update the model as new
equipment is added. |
|
Subca=
tegory |
Best
Practices |
|
Governance |
Third-party audits s=
hould
be performed regularly to ensure compliance with all current legal and ci=
vil
governance requirements (e.g., HIPAA for healthcare; Sarbanes-Oxley for
SEC-regulated firms). |
|
|
Findi=
ngs |
Recom=
mendations |
|
Governance |
You have indicated t=
hat
your organization has policies to govern the computing environment. |
Continue developing = and implementing policies for governance of the computing environment, in accordance with applicable standards (ISO17799, CoBIT, HIPAA, SOX, etc.)<= o:p> |
|
Subca=
tegory |
Best
Practices |
|
Security Policy |
Security policies sh=
ould
be defined with input from management, IT, and HR; empowered by the corpo=
rate
executives; and frequently updated to reflect current best practice (such=
as
CoBIT). |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Policy |
You have indicated t=
hat an
information security policy exists to govern the security-related activit=
y of
the organization. |
Continue usage of the
information security policy, but periodically review and update the polic=
y to
reflect current technologies and environment changes. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Policy |
You have indicated t=
hat
the policy was developed with IT alone. |
Policies should be
developed both by IT and business representatives in order to account for
legal, technical, and business requirements. |
Resources
Microsoft Operatio=
ns
Framework (MOF) Process Model for Operations
This white paper desc=
ribes
the Microsoft® Operations Framework (MOF) process model, which provides
technical guidance for organizations working to achieve reliability,
availability, supportability, and manageability of their IT solutions. This
paper is intended for IT managers responsible for defining consistent polic=
ies,
procedures, standards, and best practices across an organization.
Microsoft Operatio=
ns
Framework (MOF) - Team Model
This white paper prov=
ides
guidance on how to structure IT teams to help achieve greater efficiency and
synergy. This document is intended for IT and Operations managers as an out=
line
of best practices for organizational structure and process ownership.
http://www.microsoft.com/technet/itsolutions/cits/mo/mof/mo=
ftml.mspx
|
Patch
& Update Management |
|
Subca=
tegory |
Best
Practices |
|
Network Documenta=
tion |
Current and accurate
physical and logical diagrams of the external and internal networks should
always be available. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Network Documenta=
tion |
Your answer indicate=
s that
logical network diagrams exist for your environment and they are kept
up-to-date. |
Review the policy th=
at
governs updates to the network diagrams. |
|
Subca=
tegory |
Best
Practices |
|
Application Data =
Flow |
Application architec=
ture
diagrams should depict major components and data flows that map the flow =
of
critical data through the environment, including the systems through which
the data passes and how the data is manipulated. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Application Data =
Flow |
Your response indica=
tes
that application architecture and data-flow diagrams exist for external
applications only. They do not exist for any of the internal applications=
in
your environment. |
Work with the applic=
ation
architecture team and the respective business owners to develop architect=
ure
and data flow diagrams for internal applications. Update these diagrams i=
n a
timely manner, when changes are made to the environment or to the applica=
tion
itself. |
Resources
Building
Secure ASP.NET Applications: Authentication, Authorization and Secure
communication.
This guide provides information to help you design and build secure Microsoft® ASP.NET applications for Windows® 2000 operating system and version 1.0 of the Microsoft .NET Framework. It describes how to use various features to enhan= ce security in building application level authentication and authorization communication mechanisms within and across the tiers of .NET applications.<= o:p>
http://msdn.microsoft.com/library/default.asp?url=3D/librar=
y/en-us/dnnetsec/html/secnetlpMSDN.asp
Improving Web
Application Security
This guide gives you a
solid foundation for designing, building, and configuring secure Microsoft&=
reg;
ASP.NET Web applications. Whether you are maintaining applications or build=
ing
new ones, you can apply the principles here to help make sure your Web
applications are hack-resistant.
http://msdn.microsoft.com/library/en-us/dnnetsec/html/Threa=
tCounter.asp
|
Subca=
tegory |
Best
Practices |
|
Patch Management<= o:p> |
Security patches and
configuration changes should be deployed in a timely fashion (defined by
corporate security policy) from when they become available. Whether devel=
oped
internally or supplied by a third-party, patches and updates should be th=
oroughly
tested in a lab environment before being rolled into production.
Additionally, each system should be tested after the patch has been appli=
ed
to identify conflicts which are unique to that system and may require
rollback of the patch. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Patch Management<= o:p> |
Your response indica=
tes
that a patch & update policy exists only for applications and not for
operating systems.. |
While having a patch=
&
update policy for applications is important, it is critical to enforce a
similar policy for operating systems as well. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Patch Management<= o:p> |
You have indicated t=
hat
patches and updates are tested before being applied to all systems. |
Continue testing all
patches and updates before they are deployed into the production environm=
ent. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Patch Management<= o:p> |
|
Deploy automated pat=
ch
management for servers to ensure that patches are applied in a timely man=
ner. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Patch Management<= o:p> |
You have indicated t=
hat
automated patch management is used on workstations and laptops. |
|
Resources
Microsoft Guide to
Security Patch Management
This guide should be =
read
by system administrators responsible for maintaining multiple Microsoft®
Windows®-based computers within an organization. It provides essential
security patch management advice and the recommended processes, tools, and
techniques for implementing it
|
Subca=
tegory |
Best
Practices |
|
Virus Signatures<= o:p> |
Regularly monitor re=
levant
vendors' sites for virus signature updates and download updates to a
quarantined area for testing in a lab environment. Verify that the update=
s do
not cause any conflicts with deployed operating systems or applications
before rolling out to production. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Virus Signatures<= o:p> |
Your answer indicate=
s that
policies for virus signature updates do exist in your environment. |
Regularly monitor re=
levant
vendor and security sites for warnings on recent attacks and new virus
outbreaks. Periodically audit remote users to ensure they are updating th=
eir
systems. |
|
Subca=
tegory |
Best
Practices |
|
Change Management=
and
Configuration |
Any changes to the
production environment should first be tested for security and compatibil=
ity
before being released into production, and full documentation should be k=
ept
of the configuration of all production systems. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Change Management=
and
Configuration |
You have indicated t=
hat
your organization has a change and configuration management process. |
Continue using a for=
mal
change and configuration management process to test and document all upda=
tes
before deployment. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Change Management=
and
Configuration |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Change Management=
and
Configuration |
You have indicated t=
hat
changes to configurations are tested before deployment to production syst=
ems. |
Continue the practic=
e of
testing all configuration changes before deployment to production systems=
. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Change Management=
and
Configuration |
You have indicated t=
hat
configuration compliance is checked and enforced centrally. |
Continue the practic=
e of
checking for and enforcing compliance through a central management system=
. |
|
Back=
up and
Recovery |
|
Subca=
tegory |
Best
Practices |
|
Log Files |
Log files are config=
ured
to allow for recording all planned activity without overwriting entries. =
An
automated process should be set up to rotate log files on a daily basis a=
nd
offload the logs to a secure server within the management network. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Log Files |
You have indicated t=
hat
logs are not written to a centralized log server. |
Consider logging to a
centralized log server in order to preserve data in case a production ser=
ver
is compromised. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Log Files |
You have indicated t=
hat
log files are rotated in your environment. |
Consider storing the=
log
files in a database so that the security team can perform trend analysis =
and
have access to protected logs in the event an incident occurs. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Log Files |
You have indicated t=
hat
access to log files is not protected in your environment. |
Consider protecting =
all
operating system log files and application log files on the servers in the
DMZ and core networks by limiting file access permissions. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Log Files |
You have indicated t=
hat
log files are not reviewed regularly in your environment. |
The security team sh=
ould
review the log files every day to look for suspicious or anomalous
activities. Consider having the log files from the DMZ and core network
servers monitored by MOM (Microsoft Operations Manager). In the event of
critical log-file entries being generated, MOM will send alerts to the
appropriate members of the team. |
|
Subca=
tegory |
Best
Practices |
|
Log Files - Rotat=
ion |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Log Files - Rotat=
ion |
You have indicated t=
hat
log files are reviewed regularly in your environment. |
Consider having the =
log
files from the DMZ and core network servers monitored by MOM (Microsoft
Operations Manager). In the event of critical log-file entries being
generated, MOM will send alerts to the appropriate members of the team. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Log Files - Rotat=
ion |
You have indicated t=
hat
log files are reviewed daily. |
The security team sh=
ould
review the log files every day to look for suspicious or anomalous
activities. Consider having the log files from the DMZ and core network
servers monitored by MOM (Microsoft Operations Manager). In the event of
critical log-file entries being generated, MOM will send alerts to the
appropriate members of the team. |
|
Subca=
tegory |
Best
Practices |
|
Backup |
Full backups should =
be
performed at regular intervals. If feasible, partial intermediary backups
should be made between full backups. The backup strategy should address t=
he
worst-case scenario of a complete system and application restore. For
critical applications, the restore process should result in a fully
functioning application in minimal time. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup |
Your answer indicate=
s that
critical assets in your environment are being backed up on a regular basi=
s. |
Audit the backup
mechanisms and ensure that all critical assets are being backed up regula=
rly.
Periodically test the restore functionality to verify recoverability from=
the
backup media. |
|
Subca=
tegory |
Best
Practices |
|
Backup Media |
Detailed policies sh=
ould
exist to govern the storage and handling of backup media. These policies
should address issues such as: |
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup Media |
Your response indica=
tes
that a policy which addresses the storage and handling of backup media do=
es
exist in your environment. |
While just having a =
policy
in place to govern the handling and storage of backup media is a great fi=
rst
step, it is important to have this policy be thorough and well defined.
Regularly audit the policy to ensure that it meets all of the criteria ou=
tlined
in the best practice section. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup Media |
You have indicated t=
hat
backups are placed in offsite storage. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup Media |
You have indicated t=
hat
backups are not stored in locked fireproof cabinets. |
Backup media should =
be
kept in a locked, fireproof cabinet offsite, have its access restricted o=
nly
to necessary personnel, and rotated and replaced in accordance with
manufacturer's recommendations. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup Media |
You have indicated t=
hat
access to backup media is not restricted. |
Backup media should =
be
kept in a locked, fireproof cabinet offsite, have its access restricted o=
nly
to necessary personnel, and rotated and replaced in accordance with
manufacturer's recommendations. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup Media |
You have indicated t=
hat
backup media rotation and replacement is not defined by policy. |
Backup media should =
be
kept in a locked, fireproof cabinet offsite, have its access restricted o=
nly
to necessary personnel, and rotated and replaced in accordance with
manufacturer's recommendations. |
|
Subca=
tegory |
Best
Practices |
|
Backup & Rest=
ore |
Backup and restore
procedures should be tested regularly to identify faulty media and improve
the chance of a successful restore in the event of an outage. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Backup & Rest=
ore |
Your answer indicate=
d that
a well-documented policy exists for backup & restore procedures. |
Audit all
the backup and restore documents to ensure all the critical systems
necessary for business continuity are covered. Test backup and recovery
process on a regular basis to ensure that all hardware and software
components are functioning as expected. |
Resources
Backup and Restore
Solution
This resource provides
guidance on the importance of backup and recovery services in Microsoft®
Windows® operating systems.
http://www.microsoft.com/technet/security/topics/disasterre=
covery/secmod200.mspx
People
=
Security
efforts in an organization often overlook organizational aspects that are
critical to helping the organization maintain overall security. This sectio=
n of
the assessment reviews those processes within the enterprise governing
corporate security policies, Human Resources processes, and employee securi=
ty
awareness and training. The People Area of Analysis also focuses on dealing
with security as it relates to day-to-day operational assignments and role
definitions. The assessment reviews high- level procedures an organization =
can
follow to help mitigate people risk by focusing on the following areas of
people security:
- Requirements and
Assessments—Planning, Third-Party Assessments
- Policy and ProceduresR=
12;HR
Policy, Third-Party Relationships
- Training and Awareness=
212;Security
Awareness
|
Requ=
irements
& Assessments |
|
Subca=
tegory |
Best
Practices |
|
Security Requirem=
ents |
The organization
identifies individuals with subject-matter expertise in security to be
involved in all security-related discussions and decisions. The organizat=
ion
identifies what it needs to protect based on the value of the asset, as w=
ell
as the level of security needed to protect it. All threat vectors are
included in the analysis. The resulting strategy balances cost and benefi=
t of
the protections, and may include transfer or acceptance of risk as an opt=
ion.
Security requirements, derived from both business and technical
representatives, are documented and published for all parties to review a=
nd
address in future designs. Differences between classes of applications and
data may result in different end requirements being identified. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
the security team is involved at the planning and design level of the
technology lifecycle. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
the security team is not involved at the deployment level of the technolo=
gy
lifecycle. |
The security team sh= ould be involved at all stages of the technology lifecycle, for all projects.<= o:p> |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
the security team is not involved at the testing level of the technology
lifecycle. |
The security team sh= ould be involved at all stages of the technology lifecycle, for all projects.<= o:p> |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
the security team is not involved at the implementation level of the
technology lifecycle. |
The security team sh= ould be involved at all stages of the technology lifecycle, for all projects.<= o:p> |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Requirem=
ents |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
Subca=
tegory |
Best
Practices |
|
Security Assessme=
nts |
Third-party assessme=
nts
should be conducted to gain a valuable and objective view of an
organization's security posture. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
You have indicated t=
hat
security assessments for your organization are performed by internal staf=
f |
Continue performing
frequent security audits by internal staff, but augment these audits with
input from a trusted third party. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
You have indicated t=
hat
assessments are performed annually. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
You have indicated t=
hat
security assessments are performed on infrastructure components. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Assessme=
nts |
|
Security assessments
should cover infrastructure, applications, policies, and audits. |
|
Subca=
tegory |
Best
Practices |
|
Security Awarenes=
s |
A security awareness
program helps employees contribute to a company's overall security postur=
e by
keeping them up-to-date on security risks. Knowledgeable employees are yo=
ur
best source for reporting security issues. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
you have an individual or group responsibility for security at your
organization. |
Continue ensuring th=
at
your company has a person or team responsible for security, and require t=
hat
this team be consulted before making changes to the computing environment=
. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
your organization security team is involved in defining requirements for =
new
and existing technologies. |
Continue consulting =
with
the security team before making changes to the computing environment. The
security team should be involved in any discussions at the earliest stage=
s of
planning. |
Resources
Microsoft Learning=
Web
site Security Resources
Microsoft® Learni=
ng is
a central source for integrated learning solutions. It provides training,
books, skills assessments, certifications, and online reference materials to
help users maximize the power of Microsoft technology.
http://www.microsoft.com/learning/centers/security.asp
|
Poli=
cy
& Procedures |
|
Subca=
tegory |
Best
Practices |
|
Background Checks=
|
Background checks sh=
ould
be performed to identify any potential issues, thus reducing the risk
exposure to the organization and to other employees. This step also helps
identify any potential issues and gaps in the candidate's resume. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Background Checks=
|
Your answer indicate=
s that
background checks are being performed for all employees. |
Excellent, continue =
this
policy. Ensure that the background check includes a review of the candida=
te's
employment, education, and legal history. |
|
Subca=
tegory |
Best
Practices |
|
Human Resources P=
olicy |
Formal exit procedur=
es
ensure that all the necessary steps are undertaken when an employment
contract is terminated. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Human Resources P=
olicy |
Your response indica=
tes
that a friendly employee exit policy does not exist within your organizat=
ion. |
Immediately begin wo=
rk
with the HR department to develop procedures for friendly employee exits.=
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Human Resources P=
olicy |
Your response indica=
tes
that a formal hostile-employee exit policy exists within your organizatio=
n. |
Regularly review exi=
sting
hostile employee exit procedures and update for gaps based on past
terminations. |
|
Subca=
tegory |
Best
Practices |
|
Third-Party
Relationships |
To help reduce the r=
isk of
exposure, formal policies and procedures should exist to govern relations=
hips
with third parties. These policies and procedures help to identify securi=
ty
issues and the responsibilities of each party in mitigating them. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Third-Party
Relationships |
Your answer indicate=
s that
policies do exist which govern third-party relationships. |
Audit all the polices and procedures for existing third-party
relationships. Revisit these policies as the business evolves to ensure t=
hey
are still aligned and properly represent the position of your company. |
|
Trai=
ning
& Awareness |
|
Subca=
tegory |
Best
Practices |
|
Security Awarenes=
s |
A security awareness
program helps employees contribute to a company's overall security postur=
e by
keeping them up-to-date on security risks. Knowledgeable employees are yo=
ur
best source for reporting security issues. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
Your response indica=
tes
that a security awareness program does exist at your organization. |
All employees should
participate in security awareness training. Security awareness should be
mandatory as part of new employee orientation. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
less than 25% of all employees have participated in a security awareness
program. |
All employees should
participate in security awareness training. Security awareness should be
mandatory as part of new employee orientation. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat awareness
training does not cover computer security, including the use of personal
firewalls and encryption. |
Security awareness
training should cover all aspects of security, including security policies
and controls, reporting suspicious activity, privacy, e-mail security,
Internet security, and computer security. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
awareness training does not cover Internet security, including Web surfing
and downloads. |
Security awareness
training should cover all aspects of security, including security policies
and controls, reporting suspicious activity, privacy, e-mail security,
Internet security, and computer security. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
awareness training covers privacy issues. |
|
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
awareness training does not cover reporting suspicious activity. |
Security awareness
training should cover all aspects of security, including security policies
and controls, reporting suspicious activity, privacy, e-mail security,
Internet security, and computer security. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
awareness training does not cover your organization's security policies a=
nd
controls. |
Security awareness
training should cover all aspects of security, including security policies
and controls, reporting suspicious activity, privacy, e-mail security,
Internet security, and computer security. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
awareness training does not cover email security, including spam and
attachment handling. |
Security awareness
training should cover all aspects of security, including security policies
and controls, reporting suspicious activity, privacy, e-mail security,
Internet security, and computer security. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
training is provided bi-annually or less. |
Security training sh=
ould
be provided for all employees on a quarterly basis. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
you do not know the answer to this question |
Review this open ite=
m with
your IT staff or a security partner. Input the most appropriate answer to
this question in the MSAT for further information. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
applications security training is not offered to employees based on their
role in the organization. |
Role based, subject =
matter
related training should be offered to all employees in the organization. =
This
training should be more thorough than that given to general employees, and
refreshed frequently. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
incident readiness and response training is not offered to employees base=
d on
their role in the organization. |
Role based, subject =
matter
related training should be offered to all employees in the organization. =
This
training should be more thorough than that given to general employees, and
refreshed frequently. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
infrastructure security training is not offered to employees based on the=
ir
role in the organization. |
Role based, subject =
matter
related training should be offered to all employees in the organization. =
This
training should be more thorough than that given to general employees, and
refreshed frequently. |
|
|
Findi=
ngs |
Recom=
mendations |
|
Security Awarenes=
s |
You have indicated t=
hat
operations security training is not offered to employees based on their r=
ole
in the organization. |
Role based, subject =
matter
related training should be offered to all employees in the organization. =
This
training should be more thorough than that given to general employees, and
refreshed frequently. |
Resources
Microsoft Learning=
Web
site Security Resources
Microsoft® Learni=
ng is
a central source for integrated learning solutions. It provides training,
books, skills assessments, certifications, and online reference materials to
help users maximize the power of Microsoft technology.
http://www.microsoft.com/learning/centers/security.asp
Prioritized Action List
The following list
prioritizes the recommendations made above in the Asses=
sment
Detail section. For more information on any of these items, refer to the
matching entry in that section.
A Microsoft security
partner can help with building a security program that encompasses these ac=
tions.
|
Prioritized Acti=
on
List |
|
|
Analysis Topic |
Recommendation |
|
High Priority |
|
|
AoA: Infrastructure<= o:p> Category: Perimeter
Defense Subcategory: Anti-vi=
rus -
Servers |
Consid=
er
deploying an anti-virus solution to critical file servers initially and t=
hen
to e-mail, database, and web servers. If you are using Microsoft Exchange,
consider using the additional anti-virus and content-filtering capabiliti=
es
at the mailbox level. |
|
AoA: Applications Category: Applicatio=
ns Subcategory: Cluster=
ing |
To ens=
ure
high availability for critical databases and file shares, consider deploy=
ing
clustering mechanisms. |
|
AoA: Infrastructure<= o:p> Category: Perimeter
Defense Subcategory: Anti-vi=
rus -
Desktops |
Consid=
er
deploying an anti-virus solution to all employees' laptops and/or desktop=
s.
Add the anti-virus client in the default workstation build environment. |
|
AoA: Operations Category: Environmen=
t Subcategory: Managem=
ent
Host - Servers |
Consid=
er
deploying a separate management workstation to administer the servers on =
the
network. |
|
AoA: Applications Category: Applicatio=
ns Subcategory: Applica=
tion
& Data Recovery |
Perfor=
m full
backups regularly. Perform regular tests of the backup and recovery mecha=
nism
that permits restoration of the application to a normal operating state.<=
br>
|
|
Medium Priority |
|
|
AoA: Operations Category: Patch &
Update Management Subcategory: Virus
Signatures |
Regula=
rly
monitor relevant vendor and security sites for warnings on recent attacks=
and
new virus outbreaks. Periodically audit remote users to ensure they are
updating their systems. |
|
AoA: Operations Category: Security P=
olicy Subcategory: Protoco=
ls
& Services |
Audit =
the
documentation for allowed protocols and services and check that it confor=
ms
to the configured ACLs and firewall rules on the respective devices. |
|
AoA: Infrastructure<= o:p> Category: Perimeter
Defense Subcategory:
Intrusion-Detection System (IDS) |
|
|
AoA: Operations Category: Patch &
Update Management Subcategory: Applica=
tion
Data Flow |
|
|
AoA: Operations Category: Backup and
Recovery Subcategory: Backup =
&
Restore |
Audit =
all the backup and restore documents to ensure all t=
he
critical systems necessary for business continuity are covered. Test back=
up
and recovery process on a regular basis to ensure that all hardware and
software components are functioning as expected. |
|
Low Priority |
|
|
AoA: Infrastructure<= o:p> Category: Perimeter
Defense Subcategory: Firewall
Rules and Filters |
|
|
AoA: Operations Category: Security P=
olicy Subcategory: Governa=
nce |
Contin=
ue
developing and implementing policies for governance of the computing
environment, in accordance with applicable standards (ISO17799, CoBIT, HI=
PAA,
SOX, etc.) |
|
AoA: Operations Category: Environmen=
t Subcategory: Managem=
ent
Host |
|
|
AoA: Operations Category: Backup and
Recovery Subcategory: Backup<= o:p> |
Audit =
the
backup mechanisms and ensure that all critical assets are being backed up
regularly. Periodically test the restore functionality to verify
recoverability from the backup media. |
|
AoA: Operations Category: Environmen=
t Subcategory: Managem=
ent
Host - Network Devices |
Test a=
ll
management systems that utilize SNMP to ensure that they are patched to t=
he
latest version and do not use default community settings. |
Appendices
Questions and Answers
The following answers=
were
provided for input into this assessment.
|
Assessment Quest=
ion |
Your Answer |
|
Business Risk Pro=
file |
|
|
Number of desktops and laptop=
s in
use at your company: |
More than 500 |
|
Number of servers in use at y=
our
company: |
More than 25 servers |
|
Does your company maintain a
full-time connection to the Internet? |
Yes |
|
Do customers and vendors acce=
ss
your network or internal systems via the Internet? |
Yes |
|
Does your company host applic=
ation
services, such as a portal or a Web site, for external customers or partn=
ers? |
Yes |
|
Does your organization deploy
services that are used by both external and internal clients in the same
network segment? |
Yes |
|
Do external partners or custo=
mers
connect directly to your company's internal, back-end systems for the
purposes of data access, record updates, or other information manipulatio=
n? |
Yes |
|
Has your organization deploye=
d the
same back-end infrastructure components, such as databases, to support bo=
th
external applications and internal corporate services? |
Yes |
|
Does your organization allow
employees or contractors to connect remotely to the internal corporate
network? |
Yes |
|
Does your organization allow
employees to deploy non-production systems, such as personal Web servers =
or
computers housing "pet projects," on the general corporate netw=
ork? |
Yes |
|
Aside from backup tapes/media=
, does
your organization allow confidential or proprietary data off-site for
processing? |
Yes |
|
Would a systems security comp=
romise
in your environment significantly impact your company's ability to conduct
business? |
No |
|
Does your company share office
space with other organizations? |
Yes |
|
Does your company develop
applications? |
Yes |
|
Does your organization allow
software developers to connect remotely to corporate development resource=
s or
remotely develop application code? |
Yes |
|
Does your company develop and
market software products for customers, partners, or a broad market? |
No |
|
Does your organization allow
developers to run development or test systems in remote or unprotected
locations? |
Yes |
|
Does your IT staff act as the
custodian (as opposed to developer) of line of business applications? |
Yes |
|
Do your business processes re=
quire
data that is stored, processed, or distributed by a third party? |
No |
|
Does your company store or pr= ocess customer data in an environment that is shared with corporate resources?<= o:p> |
Yes |
|
Do you rely on third-party so=
ftware
development partners to support business-service offerings? |
Yes |
|
Does your company generate re=
venue
based on service offerings that require data processing or data mining? |
Yes |
|
Does your organization consid=
er the
data processed by your company's application services sensitive or critic=
al
to your customers' business operations? |
Yes |
|
Does your company make its cr=
itical
business applications available through Internet-based connections? |
Yes |
|
Who are the target users of t=
he key
applications within your environment? |
Internal employees |
|
How is access to key applicat=
ions
made available to users? |
From within the internal netw=
ork
only |
|
Does your corporate network c=
onnect
to customer, partner, or third-party networks via network links, whether
public or private? |
Yes |
|
Does your company generate re=
venue
from services based on the storage or electronic distribution of data, su=
ch
as media files or documentation? |
Yes |
|
Has your organization gone th=
rough
a "rip and replace" change of any major technology component in=
the
last 6 months? |
Yes |
|
Does your company rely on rec=
eiving
data feeds or processed data from partners, vendors, or other third parti=
es? |
Yes |
|
Would an incident that affect=
ed
customer applications or infrastructure, such as a site outage or a hardw=
are
or application failure, impact revenue? |
Yes |
|
Does your company store sensi=
tive
or critical customer data? |
Yes |
|
Do customer infrastructure
components or applications rely on access to resources within your
environment? |
Yes |
|
Does your company share infra=
structure
and application components among multiple customers? |
I don't know |
|
Do you consider information
technology to be a requirement for your company? |
Yes |
|
Do all of the employees in yo=
ur
company use computers for business? |
Yes |
|
Does your company outsource
maintenance or ownership of any portion of its infrastructure? |
Yes |
|
Does your company have a mid-=
or
long-term plan for the selection and deployment of new technology compone=
nts? |
No |
|
Do you consider your organiza=
tion
to be an early adopter of new technology? |
No |
|
Does your organization select=
and
deploy new technologies based on existing partnerships and licensing
agreements? |
No |
|
Does your organization limit
technology choices to technologies known by the current IT staff? |
Yes |
|
Does your company expand its
network through acquisition of new companies and their existing environme=
nts? |
No |
|
Does your organization allow
employees to download sensitive customer or corporate data to their
workstations? |
I don't know |
|
Does your organization restri=
ct
access to information by users based on their role? |
No |
|
Does your organization deploy=
new
services or applications before assessing them for possible security issu=
es? |
Yes |
|
Does your organization change
credentials for privileged accounts on a regular basis? |
I don't know |
|
Does your organization change
credentials for privileged accounts after termination of personnel with
privileged access? |
I don't know |
|
Choose the option that best
describes your company's industry segment: |
IT Services |
|
Choose the size of your organ=
ization: |
More than 500 employees |
|
Does your company have more t=
han
one location? |
Yes |
|
Is your company in a highly
competitive or research-focused industry in which intellectual property t=
heft
or espionage is a significant concern? |
Yes |
|
Are the technologists in your
company subject to high turnover or attrition? |
Yes |
|
Does your company have signif=
icant
product or brand recognition? |
Yes |
|
Does your company use down ve= rsion or legacy software (software that is no longer supported by the vendor)?<= o:p> |
Yes |
|
Does your organization acquire
software from a reputable vendor or source? |
Yes |
|
Infrastructure |
|
|
Does your organization use
firewalls or other network-level access controls at network borders to
protect corporate resources? |
Yes |
|
Does your organization deploy=
these
controls at each office location? |
I don't know |
|
Does your organization use a
neutral zone (commonly referred to as a demilitarized zone or DMZ) that
separates internal and external networks to host services? |
Yes |
|
Does the organization use
host-based firewall software to help protect servers? |
Yes |
|
Are anti-virus solutions
implemented in the environment? |
Yes |
|
Please select the systems tha=
t have
anti-virus solutions deployed: |
Perimeter hosts (gateways, pr=
oxies,
relays, etc.) |
|
Please select the systems tha=
t have
anti-virus solutions deployed: |
E-mail servers |
|
Is remote access to the compa=
ny's
network available? |
Yes |
|
Is multi-factor authentication
(tokens, smart cards, etc.) required for remote users? |
Yes |
|
Is virtual private network (V=
PN)
technology being used to provide secure connectivity to corporate resourc=
es
for these remote users? |
No |
|
Is the VPN capable of limiting
connectivity to a quarantine network until the client has passed all
necessary security checks? |
Yes |
|
Does your organization host
Internet-facing services on the company's network? |
Yes |
|
Does the network have more th=
an one
segment? |
Yes |
|
Is network segmentation used =
to
separate external customer and extranet services from corporate resources=
? |
No |
|
Does your organization group =
hosts
into network segments based on similar roles or services provided? |
Yes |
|
Does your organization group =
hosts
into network segments based on providing only the services necessary for =
the
users that connect? |
Yes |
|
Does your organization use
intrusion-detection hardware or software to help identify attacks? |
Yes |
|
Select the type(s) of
intrusion-detection systems (IDSes) used: |
Network-based IDS (NIDS) |
|
Is wireless connectivity to t=
he
network available? |
Yes |
|
Which of the following securi=
ty
controls are used to regulate connections to the wireless network? |
Changing the default/preset n= etwork name (also known as Service Set Identifier, or SSID) on the access point<= o:p> |
|
Indicate the authentication o=
ption
used for administrative access to manage devices and hosts: |
Simple password |
|
Indicate the authentication o=
ption
used for internal network and host access by internal users: |
Multifactor authentication |
|
Indicate the authentication o=
ption
used for remote access by users: |
Multifactor authentication |
|
Do controls exist to enforce
password policies on various types of accounts? |
Yes |
|
Is account lockout enabled to=
block
access to accounts after a set number of failed login attempts? |
Yes |
|
Select the accounts for which
controls exist to enforce password policies: |
Administrator |
|
Select the accounts for which=
controls
exist to enforce password policies: |
User |
|
Select the accounts for which
controls exist to enforce password policies: |
Remote Access |
|
Which of the following are bu=
ilt
based on either an image or a formal documented configuration? |
Servers |
|
Does this configuration inclu=
de
"host hardening" procedures? |
Yes |
|
Which of the following soluti=
ons
have been installed on employee workstations and laptops? |
Personal firewall software |
|
Which of the following soluti=
ons
have been installed on employee workstations and laptops? |
Spyware detection and removal
software |
|
Does your company configure i=
ts
systems itself or is this done by the hardware supplier/reseller? |
Configured by internal staff<= o:p> |
|
Have physical security contro=
ls
been deployed to secure the company's assets? |
Yes |
|
Which of the following securi=
ty
controls are used? |
Networking equipment is also =
in a
lockable cabinet/rack |
|
Applications |
|
|
What mechanisms are in place =
to
ensure high availability of applications? Select all the mechanisms that =
are
deployed from the list below: |
Load balancing |
|
Does your company have line of
business (LOB) applications? |
Yes |
|
Have third-party vendors deve=
loped
any of the key applications deployed in your environment? |
Yes |
|
Does the third-party vendor p=
rovide
regular software upgrades, security patches, and documentation on security
mechanisms? (is it still supported) |
I don't know |
|
Do you use custom macros for =
Office
applications (such as Word, Excel, or Access)? |
Yes |
|
Has an in-house team develope=
d any
of the key applications deployed in your environment? |
Yes |
|
Does the in-house development=
team
provide regular software upgrades, security patches, and documentation on
security mechanisms? |
Yes |
|
Does your organization know of
security vulnerabilities that currently exist in any of the applications
being used in the environment? |
Yes |
|
Does your organization have
procedures in place to address these security vulnerabilities? |
Yes |
|
Select the most common
authentication method used for key applications from the list below: |
Multifactor authentication |
|
Do controls exist to enforce
password policies in key applications? |
Yes |
|
Select the password controls =
that
are enforced across key applications: |
Complex Passwords |
|
Do key applications in your
environment have mechanisms enabled to restrict access to sensitive data =
and
functionality? |
Yes |
|
Do key applications in your
environment record messages in log files for analysis and auditing purpos=
es? |
Yes |
|
Select the type of events tha=
t are
logged: |
Failed Authentication Attempt=
s |
|
Is input data validated by the
deployed applications? |
Yes |
|
Select the application inputs=
from
the list below for which validation is done: |
End Users |
|
Do key applications encrypt
sensitive and business critical data that they process? |
Yes |
|
Select the different stages w=
here
encryption is used: |
Transmission and Storage |
|
Which of the following encryp=
tion
algorithms are used? |
Data Encryption Standard (DES=
) |
|
Operations |
|
|
Is the firewall tested regula=
rly to
ensure it performs as expected? |
Yes |
|
Are separate login accounts u=
sed
for normal activity vs. administrative/management activity? |
Yes |
|
Does the organization grant u=
sers
administrative access to their workstations and/or laptops? |
Yes |
|
Does the organization use ded=
icated
management hosts for secure administration of systems and devices within =
the
environment? |
Yes |
|
Select the systems for which
dedicated management hosts exist: |
Network devices |
|
Does the company manage the
environment itself, or outsource? |
The company manages the envir=
onment |
|
Does a documented process exi=
st for
host builds? If yes, which types? (For what host types does a documented
build process exist?) |
Infrastructure devices |
|
Do documented guidelines exis=
t that
govern which protocols and services are allowed on the corporate network?
Select the option that applies. |
Guidelines exist and they are
documented |
|
Does a corporate acceptable u=
se
policy exist? |
Yes |
|
Do policies exist for individ=
ual
user account management? |
Yes |
|
Select which of the following
policies are being applied towards individual user account management: |
Individual user accounts (acc=
ounts
are not shared) |
|
Does a model exist for assign=
ing
criticality levels to each component of the computing environment? |
Yes |
|
Do policies exist to govern t=
he
computing environment? |
Yes |
|
Does an information security =
policy
exist to govern the security-related activity of the organization? |
Yes |
|
Please select who developed t=
he
policy: |
IT alone |
|
Do accurate logical diagrams =
and
supporting configuration documentation exist for the network infrastructu=
re
and hosts? |
Yes |
|
Do accurate application archi=
tecture
and data flow diagrams exist for key applications? |
Yes |
|
For which types of applicatio=
ns do
diagrams exist: |
External applications only |
|
Does an established patch and upd=
ate
policy and process exist? |
Yes |
|
Select the components for whi=
ch
these exist: |
Applications |
|
Does the organization test pa=
tches
and updates before deploying them? |
Yes |
|
Indicate which of the followi=
ng are
used to deploy and manage patches: |
Windows Automatic Update |
|
On which host types is automa=
ted
patch management used? |
Workstations and laptops |
|
Does an established policy ex=
ist to
govern the updating of signature-based detection products? |
Anti-virus |
|
Does a change and configurati=
on
management process exist? |
Yes |
|
Does the organization have
configurations documented for reference? |
I don't know |
|
Does the organization test ch=
anges
to configurations before deploying to production systems? |
Yes |
|
Is configuration compliance c=
hecked
and enforced centrally (e.g., through Active Directory Group Policy)? |
Yes |
|
Is logging enabled in the
environment to record events on hosts and devices? |
Yes |
|
Does the organization take me=
asures
to protect the information contained within logs? |
Operating system and applicat=
ions
are configured to not overwrite events |
|
Does the organization review =
log
files regularly? |
Yes |
|
How often are log files revie=
wed? |
Daily |
|
Is critical and sensitive data
backed up on a regular basis? |
Yes |
|
Do policies and procedures ex=
ist
for storage and handling of backup media? |
Yes |
|
Which of the following polici=
es and
procedures are followed: |
Offsite storage |
|
Do policies exist for regular testing of backup and restore procedures? Are these policies documented?<= o:p> |
Yes, and they are documented<= o:p> |
|
People |
|
|
Does this individual or team =
have
security subject matter expertise? |
I don't know |
|
At what stages of the technol=
ogy
lifecycle is this security team or individual involved? |
Planning and Design |
|
Are roles and responsibilities
defined for each individual involved in information security? |
I don't know |
|
Does your organization perform
security assessments of the environment through independent third-parties=
? |
I don't know |
|
Does your organization perform
security assessments of the environment internally? |
Yes |
|
How often are these assessmen=
ts
performed? |
Annually |
|
Select the areas of analysis =
that
are being covered by these assessments: |
Infrastructure |
|
Do you have an individual or =
group
in your company that is responsible for security? |
Yes |
|
Is this individual or group
involved in defining security requirements for new and existing technolog=
ies? |
Yes |
|
Does the organization perform
background checks as a component of the hiring process? |
Yes |
|
Please select the option that=
is
most appropriate: |
Background checks are perform=
ed for
all positions |
|
Does a formal employee exit p=
rocess
exist? |
Yes |
|
Select the options for which a
formal employee exit policy exists: |
Hostile exits |
|
Does a formal policy exist to
govern third-party relationships? |
Yes |
|
Does a security awareness pro=
gram
exist at your company? |
Yes |
|
What perc= entage of employees have participated in the security awareness program?<= o:p> |
Less than 25% |
|
Which of the following topics=
does
the awareness training cover? |
Privacy |
|
How frequently is training of=
fered? |
Bi-annually or less |
|
Is subject-matter-related tra=
ining
offered to employees based on their roles in the organization? |
I don't know |
Glossary
The glossary addresses
standard security industry terms and concepts included in this report.
Additional terms outside of this report may also be included.
|
Term=
|
Defi=
nition |
|
Applications |
A software program t=
hat
provides functionality to an end user. Requires an operating system to ru=
n.
Examples include word processor, spreadsheet, and database programs. |
|
Anti-virus (AV) |
Software and hardware
technologies that protect the computing environment from malicious softwa=
re. |
|
Business Risk Pro=
file
(BRP) |
A measurement of the=
risk
to which an organization is exposed, based on the business environment and
industry in which it competes. |
|
Defense-in-Depth =
Index
(DiDI) |
A measurement of the
security defenses used across people, process, and technology to help mit=
igate
the risks identified for a business. |
|
Demilitarized Zone
(DMZ) |
A portion of the net=
work
that is separated from the internal network by a firewall and also connec=
ted
to the Internet via another firewall. |
|
Firewall |
A hardware or softwa=
re
device that provides protection to hosts from unauthorized access over the
network. |
|
Multifactor
authentication |
Authentication that
requires a combination of at least two of the following: something you kn=
ow;
something you have; or something you are. For example, the debit card from
your bank is two-factor authentication: It requires something you have (t=
he
card itself) and something you know (the PIN number). Requiring someone to
type in multiple passwords for authentication is only single-factor
authentication, because it is merely 'something you know.' Generally, the
more factors, the more secure the authentication. Thus, a system that
requires an ID card (something you have), a PIN (something you know), and=
a
fingerprint scanner (something you are) is more secure than one that requ=
ires
only a username/password (single factor) or ID card and PIN. |
|
Operations |
The policies, proces=
ses,
procedures, and practices related to the protection and maintenance of the
organization. |
|
People |
The members of the
organization and the policies, processes, procedures, and practices relat=
ed
to protecting them and the organization. |
|
Public Key
Infrastructure (PKI) |
An integrated set of
technologies that are required to provide Public Key encryption and digit=
al
signatures. Uses a combination of public- and private-key encryption to
provide key management, data integrity, and data confidentiality. |
|
Process |
A documented series =
of
sequential tasks used to perform a business function. |
|
Security Maturity=
|
Security maturity is
inclusive of controls (both physical and technical), the technical acumen=
of
IT resources, policy, process, and maintainable practices. Security matur=
ity
can be measured only through the organization's ability to effectively use
the tools available to create a maintainable security level across many
disciplines. A baseline of security maturity should be established and us=
ed
to define areas of focus for the organization's security programs. Not all
organizations should strive to reach the optimized level, but all should
assess where they are and determine where they should be, in light of the
business risk they face. For example, a company with a low-risk environme=
nt
may never need to advance beyond the upper range of the Baseline level or=
the
lower range of the Standardized level. A company with a high-risk environ=
ment
will likely push well into the Optimized level. Your Business Risk Profile
scores help you gauge your risk. |
Interpreting the Graphs
BRP vs. DiDI
- BRP ranges from 0 to 100,=
where
a higher score implies a greater amount of potential business risk for
that specific AoA. It is important to note that a score of zero is not
possible here; conducting business in and of itself implies some level=
of
risk. It is also important to understand that there are some aspects of
running a business that have no direct mitigation strategy.
- DiDI also ranges from 0 t=
o 100.
A high score indicates an environment where a greater number of measur=
es
have been taken to deploy defense-in-depth strategies in a particular =
AoA.
The DiDI score does not reflect overall security efficacy or even
resources spent on security, rather it is a
reflection of the overall strategy used to defend the environment.
- Intuitively, it may seem =
like a
low BRP score and a high DiDI score are a good outcome, but this is not
always the case. The scope of this self-assessment does not allow for =
all
factors to be taken into consideration. Significant disparity between =
BRP
and DiDI scores in a particular AoA suggests that further examination =
of
this AoA is recommended. When analyzing your results it is important to
consider the individual scores, both BRP and DiDI, in relation to one
another. A stable environment will likely be represented by relatively
equal scores across all areas. Disparities between DiDI scores are a
strong indicator that overall security strategy is focused on a single
mitigation technique. If the security strategy does not balance people,
process, and technology aspects, the environment will likely be more v=
ulnerable
to attack.
Security Maturity
- Security maturity for eac=
h Area
of Analysis (AoA) ranges from 0 to 100, where a higher score implies a
greater level of security maturity within the organization. The concep=
t of
security maturity is holistic though and the rating blends the scores =
from
all areas to determine overall placement (Baseline, Standardized, and
Optimized). This overall score ranges from 0 to 400. It is important to
note that a score of zero or a score of 100 in any area is unlikely; m=
ost
organizations utilize some levels of protection and are likely to be at
least at baseline level. Few organizations have such a significant lev=
el
of risk as to require them to invest heavily in security strategies and
programs.
- Security maturity is incl=
usive of
controls (both physical and technical), technical acumen of IT resourc=
es,
policy, process, and maintainable practices. Security maturity can onl=
y be
measured through the organizations ability to effectively use the tools
available to create a maintainable security level across many discipli=
nes.
A baseline of security maturity should be established and used to defi=
ne
areas of focus for the organization's security programs. Not all
organizations should strive to reach the optimized level, but all shou=
ld assess
where they are and determine where they should be compared to business
risk.
- The stacked graph shows t=
he
cumulative maturity score based on four areas: Infrastructure,
Applications, Operations, and People. The sum of the scores from these
areas determines whether the ranking is Baseline, Standardized, or
Optimized. To achieve the highest score, an organization needs to have=
a
balanced approach to their security programs, which encompasses a
multilayered and proactive response to security. By comparing the rela=
tive
size of the four analyzed areas, you can determine if your company's
security controls are more mature in one area than another, and plan f=
or
mitigation appropriately.