Front cover - IBM Redbooks

112 Lotus Security Handbook
become a carrier of worms, viruses, or possibly even a conduit or bridge into your
internal network. If you permit workstations connected to your internal LAN to
also use dial-up services outside your control, those workstations can potentially
form a network-level bridge between your internal “protected” network and the
outside unfiltered Internet. So remember to include acceptable use of modems in
your security policy. This is in addition to standards for workstation virus scanning
software updates and personal firewalls and the means to keep the workstation
security measures up to date.
Information about sources of vulnerability and updates is usually available from
operating system vendors and application software vendors, but you should not
rely on vendor sources as your sole source of information. One of the best
resources on security vulnerability issues is the CERT Coordination Center. Get
the latest information from their Web site, which is updated frequently, at:
http://www.cert.org/
The resources required to perform patch management on servers will vary
depending on the size of the organization, the number of different operating
systems, and the number of applications. Patch management of workstations will
vary widely in the resources needed, depending on whether or not a central
software distribution mechanism is implemented, among other factors. Updates,
patches and other “hotfixes” can be pushed to workstations using traditional
software distribution tools, or specialized patch management products, such as
Patchlink Update (www.patchlink.com), BigFix Patch Manager (www.bigfix.com),
Security Update Manager (www.configuresoft.com), LANguard Network
(www.gfi.com), and others.
Record activity for audit and reporting
No security architecture is immune from unauthorized access attempts. Every
system should anticipate attempts to circumvent the controls designed to protect
the enterprise, and every subsystem should have auditing as a component.
Following are the features that should be incorporated:
1. A log of system activity must be available in case an investigation is required
to determine actual use (or misuse). Logs should be stored on a system that
is separate from the system generating the log, and is physically located
within a protected network zone. The log must be retained and available to
security administrators for a number of days determined by the organization’s
business security standards and procedures. We recommend keeping activity
logs for at least 60 days, as often an incident investigation needs to cover a
period of several weeks.
2. All access attempts to systems should be logged. Components must have the
ability to create access, system, resource, and activity logs. Exceptions to
compliance should be clearly described in the organization’s security policy.