Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I work in a smallish company (100-200 computers and a handful of servers) and I am trying to come up with a checklist of things to check at a regular basis, such as weekly, monthly, etc. We use Windows servers and Lotus notes. I currently have: check logs, check for users in AD and Notes that no longer work here, check admin rights and check for holes in the firewall. I have basic security knowledge so where else should I look to clean up security holes as well as check for signs of an unnoticed attack?

share|improve this question
    
What exactly are you looking for? Vulnerabilities? Signs of intrusion? –  chris Aug 19 '11 at 18:10
    
Mostly vulnerabilities, how to clean up a system, as well as typical things that get lost in the cracks such as missing users that should be removed. I doubt we would be attacked but for my own knowledge I was wondering about the signs of intrusion. –  Mobojo Aug 19 '11 at 18:56
    
You should be aware that attack prevention and forensics are two very different fields, that require very different precautions, regular activities and perhaps third-party services (think of penetration tests and audits) –  chris Aug 19 '11 at 20:15
    
I understand, I am more interested in attack prevention and system cleanup and then if someone could also give some input as to some basic forensics type checks that would be handy. This is a small company I work for so I don't need to go crazy locking it down. –  Mobojo Aug 23 '11 at 12:29

2 Answers 2

up vote 5 down vote accepted

checklist of things to check at a regular basis, such as weekly, monthly,

Check your backups! This is an often overlooked task, but backups are critical to your integrity and availability. The best way to recover from some compromises is to restore from backup. Use your backups to perform restores on actual computers. Less frequently use the backups to restore to the actual machines being backed-up. If you have offsite backups, test those periodically as well. The frequency of each backup test depends on your resources and your needs for recovery.

check logs

Don't forget to check logs for your printers, coppiers, and other network attached devices. If you use key cards for physical access, check those logs as well.

check for users in AD and Notes that no longer work here

Its good to check, but you should also have a procedure that when a user no longer needs access (contract completed, no longer employed, etc) HR or the responsible department notifies you immediatly. The check should involve a comparison and synchronization with the HR database.

check admin rights

Also audit all changes made by users with administrative rights.

check for holes in the firewall.

Also do traffic analysis and compare to a baseline.

clean up security holes

Good practice to prevent exploitation of security vulnerabiltes is to stay up to date on the products you use.

SANS has a great blog http://www.sans.org/windows-security/

US-CERT http://www.us-cert.gov/cas/alldocs.html

Microsoft Security Intelligence Report http://www.microsoft.com/security/sir/default.aspx

Microsoft Windows Server Security Forum http://social.technet.microsoft.com/Forums/en-US/winserversecurity/threads

Lotus Security Handbook http://www.redbooks.ibm.com/abstracts/sg247017.html

check for signs of an unnoticed attack?

A simple approach is to measure your system (computers, network, and devices) in a clean (secure) state. Do simple traffic monitoring and usage statistics, and then periodically and automatically measure the current system and compare to your baseline. A more proactive approach is to use Intrusion Detection System (IDS) and or Intrusion Prevention System (IPS).

share|improve this answer
    
Thanks for the list. We check our backups every week since we back up to tape and swap them every week and have to go into our backup program so we can see they were successful. I don't believe we check the tapes though to make sure they were set up correct. As for the removing users, we do have a setup to get the names of people who quit or are fired, but people tend to fall through the cracks so I am setting us up to regularly check for those people. –  Mobojo Aug 19 '11 at 13:05

CERT's Windows Intruder Detection checklist is a good start.

This document outlines suggested steps for determining whether your Windows system has been compromised. System administrators can use this information to look for several types of break-ins. We also encourage you to review all sections of this document and modify your systems to address potential weaknesses.

It points out in particular that logs, while possibly useful, are not reliable for detecting intrusion.

Proactive auditing and monitoring are essential steps in intrusion detection. It is ineffective to audit altered data or compromised systems -- their logs are unreliable. Establish a baseline for what you consider normal activity for your environment so you can determine unusual events and respond appropriately. See section C16 of this document for more information on audit settings and events useful to detect successful attacks or attacks in progress.

At a broad level, their checklist is

  1. A Word on Rootkits
  2. Examine Log Files
  3. Check for Odd User Accounts and Groups
  4. Check All Groups for Unexpected User Membership
  5. Look for Unauthorized User Rights
  6. Check for Unauthorized Applications Starting Automatically
  7. Check Your System Binaries for Alterations
  8. Check Your Network Configurations for Unauthorized Entries
  9. Check for Unauthorized Shares
  10. Check for Any Jobs Scheduled to Run
  11. Check for Unauthorized Processes
  12. Look Throughout the System for Unusual or Hidden Files
  13. Check for Altered Permissions on Files or Registry Keys
  14. Check for Changes in User or Computer Policies
  15. Ensure the System has not been Joined to a Different Domain
  16. Audit for Intrusion Detection
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.