Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Would you consider the following to be "basic hardening items" for network equipment and servers?

  • VLANs
  • Access Control (such as NTFS permissions)
  • Patch Management System
  • Host Firewall
  • Anti-Virus

What is the minimal protection needed to segment my internal network from the DMZ and the outside? Is having a WAF, assuming you're dealing with web applications, and default denies, with tightly confined rules, on the firewalls sufficient?

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

The most basic principles for making a network secure are 'defence in depth' - that is, you want to put as many things between your 'crown jewels' and potential attackers as you can - and 'minimal surface area' - that is, you expose as little as possible to attack.

To get there; your list of basics is pretty good at addressing 'defence in depth', though you may want the ability to blacklist/whitelist applications.

You should have a look at minimal surface areas - turn off admin privileges, unused services, blacklist any application running outside of c:\windows, c:\program files, etc., block executables on USB, turn off web access on machines that don't need it, etc.

Finally, the Australian DSD guide at http://www.dsd.gov.au/publications/Top_35_Mitigations_2012.pdf is a very good 'checklist' for this sort of thing - start at the top and work down.

share|improve this answer
    
Very nice link to the OZ DSD, I'm printing some dozens of A3 copies of that, cheers! –  TildalWave Feb 7 '13 at 2:20
1  
May also be interested in dsd.gov.au/publications/Catch_Patch_Match.pdf (and dsd.gov.au/videos/catch-patch-match.htm) if you're communicating to non-IT people. –  Bob Watson Feb 7 '13 at 2:30
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.