- Do you need to encrypt the data repository?
- Do you need a hash of the transactions for integrity purposes?
- Should you digitally sign transactions?
- Make sure that database logging is enabled and properly configured.
- Harden the operating system.
- Disable unnecessary services and close ports.
- Change system defaults.
- Don't use group or shared account passwords.
- Lock down file shares.
- Restrict access to only necessary personnel.
- Consider host-based firewalls and intrusion detection for critical servers.
- Maintain proper patch procedures.
- Use switches rather than routers or hubs as much as possible.
- Lock down unused router/switch ports.
- Consider MAC filters for critical systems.
- Establish logical subnets and VLANs.
- Set up access control lists (ACLs) for access routes.
- Use ingress/egress filters, anti-spoof rules.
- Determine appropriate location and functionality for network-based firewalls and intrusion detection.
- Use encrypted logins or SSL for web-based sessions.
- Establish input/output handling procedures.
- Use physical access logs for server rooms and network operations centers.
- Document tape-handling procedures, tape rotation, offsite storage.
- Consider an alternate data center.
- Archiving: Where does your data go to rest in peace?
- Data destruction: Degauss, erase/overwrite, physical destruction?
- How is data handled when equipment is sent out for repair, replacement, or end of life?
This is just a quick list of points to consider. Fortunately, folks much smarter than I am have developed a much more comprehensive approach.
Security standards and guidance are available, especially for organizations that are part of or do business with the U.S. government. Through the work of various organizations, the government has put together a program known as Certification & Accreditation (C&A). Standards have been and continue to be developed that provide guidance on the performance of risk assessments, development of security plans, and the application of security controls.
By subscribing to our early morning news update, you will receive a daily digest of the latest security news published on Help Net Security.
With over 500 issues so far, reading our newsletter every Monday morning will keep you up-to-date with security risks out there.