8

This must be the most broad question to ask, but through the years, i've come up with my own list of things I so to secure my servers, I follow the obvious steps I could gather online such as, password length, iptables, /etc/hosts, routes, packets securing, security patches etc..

I would like to know if there is a standard in the industry, doesn't matter if it's public or private sector that I could benchmark my steps against. I know there are few out there, but what could be considered THE standard.

Improve this question
1
  • Welcome to IT Security! I would look around through hardening. This is a really broad question, and chances are you'll find what you need there. If not then please ask, or update this, with more specifics on what you need.
    – Scott Pack
    Jan 9, 2013 at 21:25

1 Answer 1

Reset to default
14

Standards are general and consist of high level principles. Guides focus on practical security. Checklists are the most detailed documents.

There are multiple agencies that produce security standards. One of the most widely used security standards today is ISO/IEC 27002 which started in 1995. This standard consists of three basic parts, BS 7799 part 1, part 2 and 3. Recently this standard has become ISO 27001. But it is a very high level standard that doesn't go into configuration specifics. It talks about building an information security infrastructure (BS 7799 part 1), an information security management system (BS 7799 part 2) and risk analysis and management (BS 7799 part 3).

You are asking about guides and the National Institute of Standards and Technology (NIST) has released several special publications addressing cyber security. Here is the Guide to General Server Security from NIST. This general document discusses the need to secure servers and provides recommendations for selecting, implementing, and maintaining the necessary security controls.

NSA develops and distributes security configuration guides for a wide variety of software, both open source and proprietary.

For more detailed documents about securing certain installations follow NIST's National Checklist Program Repository. NCP security checklists (or benchmarks) provide detailed low level guidance on setting the security configuration of operating systems and applications. For example there are checklists for securing:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .