Abstract

When we talk about implementing basic security measures, one could think "And what are those?" And if that question would be asked, it would be a very, very difficult question to answer. If you are a system administrator, an IT security manager in your company, or just a regular information security enthusiast, I recommend you to read this paper, as it addresses some of the most important issues in implementation of basic security measures in an IT environment.

Information security breaches have been rapidly rising over the past decade at an alarming level. For this reason, more and more IT companies have realized that securing their businesses is not something they should do, but something they have to do. The losses we read about in everyday news are too scary to let IT security of your company be just the way it is – none! You can't do it once and for all, but rather by employing basic security measures and following some rules and policies you define for your organization. In this article, we are going to point out some of the steps which need to be taken if you want to do good for your company by implementing a serious and comprehensive security process. We will not focus on only one operating system (i.e. Linux), but rather point out general information on the subject.

Introduction


According to the Internet Security Alliance (ISAlliance), there are about ten good security practices as a place to start. These ten practices include different kinds of information security, such as policy, process, people, and technology, all of which are necessary for deployment of a successful security process. With these techniques adopted, we can say we are moving towards our goal – ensuring the security of critical information assets. It is proven that through adopting commonly accepted, good security practices, every organization can begin to successfully manage their security risks. So, let's take a look over these ten practices.

The Practices

We are going to divide these ten practices as follows:

• General Management
• Policy
• Risk Management
• Security Architecture & Design
• User Issues
• System & Network Management
• Authentication & Authorization
• Monitor & Audit
• Physical Security
• Continuity Planning & Disaster Recovery

We will cover each of this practices only generally, as I think there is quite enough information over these on the Internet, covered in detail.

General Management