I work in a smallish company (100-200 computers and a handful of servers) and I am trying to come up with a checklist of things to check at a regular basis, such as weekly, monthly, etc. We use Windows servers and Lotus notes. I currently have: check logs, check for users in AD and Notes that no longer work here, check admin rights and check for holes in the firewall. I have basic security knowledge so where else should I look to clean up security holes as well as check for signs of an unnoticed attack?
Check your backups! This is an often overlooked task, but backups are critical to your integrity and availability. The best way to recover from some compromises is to restore from backup. Use your backups to perform restores on actual computers. Less frequently use the backups to restore to the actual machines being backed-up. If you have offsite backups, test those periodically as well. The frequency of each backup test depends on your resources and your needs for recovery.
Don't forget to check logs for your printers, coppiers, and other network attached devices. If you use key cards for physical access, check those logs as well.
Its good to check, but you should also have a procedure that when a user no longer needs access (contract completed, no longer employed, etc) HR or the responsible department notifies you immediatly. The check should involve a comparison and synchronization with the HR database.
Also audit all changes made by users with administrative rights.
Also do traffic analysis and compare to a baseline.
Good practice to prevent exploitation of security vulnerabiltes is to stay up to date on the products you use.
SANS has a great blog http://www.sans.org/windows-security/
Microsoft Security Intelligence Report http://www.microsoft.com/security/sir/default.aspx
Microsoft Windows Server Security Forum http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads
Lotus Security Handbook http://www.redbooks.ibm.com/abstracts/sg247017.html
A simple approach is to measure your system (computers, network, and devices) in a clean (secure) state. Do simple traffic monitoring and usage statistics, and then periodically and automatically measure the current system and compare to your baseline. A more proactive approach is to use Intrusion Detection System (IDS) and or Intrusion Prevention System (IPS).
CERT's Windows Intruder Detection checklist is a good start.
It points out in particular that logs, while possibly useful, are not reliable for detecting intrusion.
At a broad level, their checklist is