When
Check for updates quarterly.
Why
Knowing and then keeping current on the volume of security information required to manage security is a serious challenge. That's why top practitioners arranged a summit a few years ago to try to boil down all of the serious security issues to the "80%" solution, i.e., if you do nothing else, at least secure these "features," as they are the most exploited and will affect your systems with serious repercussions if compromised. As SANS said, "Although there are thousands of security incidents each year affecting these operating systems, the overwhelming majority of successful attacks target one or more of these 20 vulnerable services."
Strategy
Formerly the "Top 10" security vulnerabilities, SANS has expanded it to the top 10 each for Unix- and Linux-based systems, and Windows-based systems.
Top vulnerabilities of Windows systems
1. Web servers and services
2. Workstation service
3. Windows remote access services
4. Microsoft SQL Server
5. Windows authentication
6. Web browsers
7. File-sharing applications
8. LSASS exposures
9. Mail client
10. Instant messaging
Top vulnerabilities of Unix systems
1. BIND Domain Name System
2. Web server
3. Authentication
4. Version control systems
5. Mail Transport Service
6. Simple Network Management Protocol (SNMP)
7. Open Secure Sockets Layer (SSL)
8. Misconfiguration of enterprise services NIS/NFS
9. Databases
10. Kernel
More important than just listing problems, the Top 20 list includes step-by-step instructions for correcting the security exposure and pointers to more information. The list and instructions are updated as more critical threats and more current or convenient protection methods are identified.
Folks, you've been reading these tips for almost a year now -- if you do nothing else, go to the Top 20 site, and check and secure your systems. Don't just "think" your systems are configured correctly -- know for sure.
More information
On the SANS Top 20 page [http://www.sans.org/top20 ] you can read about the list's evolution, the participants and where to send suggestions for it via e-mail.
About the author
Shelley Bard, CISSP, CISM, is a senior security network engineer with Verizon Federal Network Systems (FNS). An information security professional for 17 years, Bard has briefed and written infosecurity assessments and technical reports for the White House and Department of Defense, special interest groups, industry and academia. Please e-mail any comments.
Opinions expressed in this column are those of Shelley Bard and don't necessarily reflect those of Verizon FNS.
