Is there a published standard or guideline for system hardening? ISO, ANSI, NIST, etc.?
In fact there are two. A few years ago, an independent non-profit called the Center for Internet Security was founded to help evangelize the need for secure configurations and define a series of benchmarks that would provide information (mostly free of charge) to practitioners on how to harden specific systems.
CIS uses a consensus model: a working group establishes best practices on how to harden specific systems and then takes feedback from many other constituents to define a set of recommendations. At last count there were more than 30 different products that have incorporated CIS benchmarks, including all the Windows OS versions, Red Hat Linux 5 (for RHEL 5), Mac OS X 10.5 (Leopard), Solaris 10, HP-UX, Oracle Database 9i/10g, Exchange Server 2007, several Cisco IOS routers, and many others.
The U.S. government also has an initiative to establish hardening guidance for certain systems. The Federal Desktop Core Configuration (FDCC) establishes the baseline for U.S. government desktops.
Many of the leading vulnerability-scanning products already support both CIS and FDCC. So it's possible to scan devices with these tools to pinpoint gaps in their configuration, right out of the box.
- Learn more about hardening servers in a DMZ network.
- Harden your system to stop malware in its tracks.
Dig Deeper on Information security policies, procedures and guidelines
Related Q&A from Mike Rothman
Pirated software is still a major concern nowadays. Uncover how to prevent software piracy and protect your organization's intellectual property. Continue Reading
While liaison officer responsibilities vary depending on the company they work for, their strong organizational and communications skills make them ... Continue Reading
The CISSP certification can be a challenge to obtain. Mike Rothman unveils how to get on the right education and career tracks in order to get CISSP ... Continue Reading