Data repository:

• Do you need to encrypt the data repository?
• Do you need a hash of the transactions for integrity purposes?
• Should you digitally sign transactions?
• Make sure that database logging is enabled and properly configured.

Server considerations:

• Harden the operating system.
• Disable unnecessary services and close ports.
• Change system defaults.
• Don't use group or shared account passwords.
• Lock down file shares.
• Restrict access to only necessary personnel.
• Consider host-based firewalls and intrusion detection for critical servers.
• Maintain proper patch procedures.

Network segment:

• Use switches rather than routers or hubs as much as possible.
• Lock down unused router/switch ports.
• Consider MAC filters for critical systems.
• Establish logical subnets and VLANs.
• Set up access control lists (ACLs) for access routes.
• Use ingress/egress filters, anti-spoof rules.
• Determine appropriate location and functionality for network-based firewalls and intrusion detection.
• Use encrypted logins or SSL for web-based sessions.

Physical security for data:

• Establish input/output handling procedures.
• Use physical access logs for server rooms and network operations centers.
• Document tape-handling procedures, tape rotation, offsite storage.
• Consider an alternate data center.
• Archiving: Where does your data go to rest in peace?
• Data destruction: Degauss, erase/overwrite, physical destruction?
• How is data handled when equipment is sent out for repair, replacement, or end of life?

This is just a quick list of points to consider. Fortunately, folks much smarter than I am have developed a much more comprehensive approach.

Structured Approach


Security standards and guidance are available, especially for organizations that are part of or do business with the U.S. government. Through the work of various organizations, the government has put together a program known as Certification & Accreditation (C&A). Standards have been and continue to be developed that provide guidance on the performance of risk assessments, development of security plans, and the application of security controls.