What to add to a repeating security checklist?

Question

I work in a smallish company (100-200 computers and a handful of servers) and I am trying to come up with a checklist of things to check at a regular basis, such as weekly, monthly, etc. We use Windows servers and Lotus notes. I currently have: check logs, check for users in AD and Notes that no longer work here, check admin rights and check for holes in the firewall. I have basic security knowledge so where else should I look to clean up security holes as well as check for signs of an unnoticed attack?

Answer 1

checklist of things to check at a regular basis, such as weekly, monthly,

Check your backups! This is an often overlooked task, but backups are critical to your integrity and availability. The best way to recover from some compromises is to restore from backup. Use your backups to perform restores on actual computers. Less frequently use the backups to restore to the actual machines being backed-up. If you have offsite backups, test those periodically as well. The frequency of each backup test depends on your resources and your needs for recovery.

check logs

Don't forget to check logs for your printers, coppiers, and other network attached devices. If you use key cards for physical access, check those logs as well.

check for users in AD and Notes that no longer work here

Its good to check, but you should also have a procedure that when a user no longer needs access (contract completed, no longer employed, etc) HR or the responsible department notifies you immediatly. The check should involve a comparison and synchronization with the HR database.

check admin rights

Also audit all changes made by users with administrative rights.

check for holes in the firewall.

Also do traffic analysis and compare to a baseline.

clean up security holes

Good practice to prevent exploitation of security vulnerabiltes is to stay up to date on the products you use.

SANS has a great blog http://www.sans.org/windows-security/

US-CERT http://www.us-cert.gov/cas/alldocs.html

Microsoft Security Intelligence Report http://www.microsoft.com/security/sir/default.aspx

Microsoft Windows Server Security Forum http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads

Lotus Security Handbook http://www.redbooks.ibm.com/abstracts/sg247017.html

check for signs of an unnoticed attack?

A simple approach is to measure your system (computers, network, and devices) in a clean (secure) state. Do simple traffic monitoring and usage statistics, and then periodically and automatically measure the current system and compare to your baseline. A more proactive approach is to use Intrusion Detection System (IDS) and or Intrusion Prevention System (IPS).

Answer 2

CERT's Windows Intruder Detection checklist is a good start.

This document outlines suggested steps for determining whether your Windows system has been compromised. System administrators can use this information to look for several types of break-ins. We also encourage you to review all sections of this document and modify your systems to address potential weaknesses.

It points out in particular that logs, while possibly useful, are not reliable for detecting intrusion.

Proactive auditing and monitoring are essential steps in intrusion detection. It is ineffective to audit altered data or compromised systems -- their logs are unreliable. Establish a baseline for what you consider normal activity for your environment so you can determine unusual events and respond appropriately. See section C16 of this document for more information on audit settings and events useful to detect successful attacks or attacks in progress.

At a broad level, their checklist is

1. A Word on Rootkits
2. Examine Log Files
3. Check for Odd User Accounts and Groups
4. Check All Groups for Unexpected User Membership
5. Look for Unauthorized User Rights
6. Check for Unauthorized Applications Starting Automatically
7. Check Your System Binaries for Alterations
8. Check Your Network Configurations for Unauthorized Entries
9. Check for Unauthorized Shares
10. Check for Any Jobs Scheduled to Run
11. Check for Unauthorized Processes
12. Look Throughout the System for Unusual or Hidden Files
13. Check for Altered Permissions on Files or Registry Keys
14. Check for Changes in User or Computer Policies
15. Ensure the System has not been Joined to a Different Domain
16. Audit for Intrusion Detection