Các tài liệu hướng dẫn bảo mật hệ thống mạng máy tính

Các tài liệu hướng dẫn bảo mật hệ thống
mạng máy tính

Ngày nay vấn đề bảo mật đã trở thành những chủ đề nóng nhất trên
Internet. Với tốc độ phát triển cực nhanh của mạng toàn cầu đã đem lại
những lợi ích về mặt kinh tế và xã hội không thể phủ nhận. Chính những
lợi thế đó đã là nơi lý tưởng để tội phạm, hacker sử dụng khai thác với
nhiều mục đích khác nhau.
Để giúp các bạn có thêm thông tin và kiến thức Quản Trị Mạng xin trân trọng
giới thiệu các giải pháp, hướng dẫn bảo mật của Trung tâm bảo mật và cứu
hộ toàn cầu - Cert.org. Bài viết gồm rất nhiều nội dung do đó chúng tôi
không thể tiến hành biên dịch ra tiếng Việt được mong các bạn thông cảm
CERT
®
Security Improvement Modules
Each CERT Security Improvement module addresses an important but
narrowly defined problem in network security. It provides guidance to help
organizations improve the security of their networked computer systems.
The CERT security practices have been compiled in The CERT
®
Guide to
System and Network Security Practices, published by Addison-Wesley and
available at walk-in and online bookstores. Using a practical, phased
approach, the book shows administrators how to protect systems and
networks against malicious and inadvertent compromise based on security
incidents reported to the CERT/CC.
Each module page links to a series of practices and implementations.
Practices describe the choices and issues that must be addressed to solve a
network security problem. Implementations describe tasks that implement
recommendations described in the practices. Please note that these
implementations should be considered examples; they have not been updated
to reflect current versions of operating systems or current vulnerabilities. For
more information about modules, read the section about module structure.
 List of modules
 List of practices
 List of implementations
o General
o UNIX
o NT
o Other technologies
 Intended audience
 Description of module structure
 Available formats
Modules
1. Outsourcing Managed Security Services
2. Securing Desktop Workstations
3. Responding to Intrusions
4. Securing Network Servers
5. Deploying Firewalls
6. Securing Public Web Servers
7. Detecting Signs of Intrusion
HTML versions of the modules are available from the CERT web site. PDF
and Postscript versions of the modules are available from the SEI web site.
For the PDF and Postscript versions, click on the icons next to the module
names. The currently available modules are:
Practices
1. Harden and secure your systems by establishing secure
configurations Considerations for Vulnerability Assessment as a
Managed Security Service
2. Prepare for intrusions by getting ready for detection and response
3. Detect intrusions quickly
4. Respond to intrusions to minimize damage
5. Improve your security to help protect against future attacks
We also have practices relating to outsourcing managed security
services. They are listed under the heading
Practices related to outsourcing managed security services
Practices about hardening and securing systems
1. Develop a computer deployment plan that includes security issues
2. Include explicit security requirements when selecting servers
3. Keep operating systems and applications software up to date
4. Offer only essential network services and operating system services
on the server host machine
5. Configure computers for user authentication
6. Configure computer operating systems with appropriate object,
device, and file access controls
7. Configure computers for file backups
8. Protect computers from viruses and similar programmed threats
9. Configure computers for secure remote administration
10. Allow only appropriate physical access to computers
11. Configure network service clients to enhance security
12. Configure multiple computers using a tested model
configuration and a secure replication procedure
13. Develop and promulgate an acceptable use policy for
workstations
14. Configure computers to provide only selected network
services
15. Isolate the Web server from public networks and your
organization's internal networks
16. Configure the Web server with appropriate object, device
and file access controls
17. Identify and enable Web-server-specific logging mechanisms
18. Consider security implications before selecting programs,
scripts, and plug-ins for your web server
19. Configure the web server to minimize the functionality of
programs, scripts, and plug-ins
20. Configure the Web server to use authentication and
encryption technologies, where required
21. Maintain the authoritative copy of your Web site content on a
secure host
22. Protect your Web server against common attacks
23. Design the firewall system
24. Acquire firewall hardware and software
25. Acquire firewall documentation, training, and support
26. Install firewall hardware and software
27. Configure IP routing
28. Configure firewall packet filtering
29. Configure firewall logging and alert mechanisms
30. Test the firewall system
31. Install the firewall system
32. Phase the firewall system into operation

Practices about preparing to detect and respond to intrusions
1. Establish a policy and procedures that prepare your organization
to detect signs of intrusion
2. Identify data that characterize systems and aid in detecting signs of
suspicious behavior
3. Manage logging and other data collection mechanisms
4. Establish policies and procedures for responding to intrusions
5. Prepare to respond to intrusions
Practices about detecting intrusions
1. Ensure that the software used to examine systems has not been
compromised
2. Monitor and inspect network activities for unexpected behavior
3. Monitor and inspect system activities for unexpected behavior
4. Inspect files and directories for unexpected changes
5. Investigate unauthorized hardware attached to your organization's
network
6. Inspect physical resources for signs of unauthorized access
7. Review reports by users and external contacts about suspicious and
unexpected behavior
8. Take appropriate actions upon discovering unauthorized,
unexpected, or suspicious activity
Practices about responding to intrusions
1. Analyze all available information to characterize an intrusion
2. Communicate with all parties that need to be made aware of an
intrusion and its progress
3. Collect and protect information associated with an intrusion
4. Apply short-term solutions to contain an intrusion
5. Eliminate all means of intruder access
6. Return systems to normal operation
7. Identify and implement security lessons learned
Practices about improving system security
1. Take appropriate actions upon discovering unauthorized,
unexpected, or suspicious activity
2. Identify and implement security lessons learned
Practices related to outsourcing managed security services
1. Content Guidance for an MSS Request for Proposal
2. Guidance for Evaluating an MSS Proposal
3. Content Guidance for an MSS Service Level Agreement
4. Transitioning to MSS
5. Managing an Ongoing MSS Provider Relationship
6. Terminating an MSS Provider Relationship
7. Considerations for Network Boundary Protection as Managed
Security Services
8.
The practices are grouped into five general steps, listed below. They are
illustrated in the diagram "Security Knowledge in Practice." Please note that
the implementations referenced in these practices should be considered
examples; they have not been updated to reflect current versions of operating
systems or current vulnerabilities.
Implementations (archive)
We developed these implementations to provide details for how users could
complete steps discussed in CERT security practices for specific operating
systems. However, these implementations should be considered examples;
they have not been updated to reflect current versions of operating systems or
current vulnerabilities. We recommend that you visit vendor web sites for
current information and guidance about securing your operating system.
General
1. Process analysis checklist
2. Examples of contract language for terms and conditions or statements
of work
3. Maintaining currency by periodically reviewing public and vendor
information sources
4. Identifying tools that aid in detecting signs of intrusion
5. Establishing and maintaining a physical inventory of your computing
equipment
UNIX
1. Using MD5 to verify the integrity of file contents
2. Using Tripwire to verify the integrity of directories and files on systems
running Solaris 2.x
3. Inspecting your Solaris system and network logs for evidence of
intrusions
4. Inspecting the logs produced by the TCP wrapper program on a Solaris
2.x system
5. Using the ps program to examine processes for signs of intrusive
activity
6. Configuring Sun Solaris as a Web server
7. Configuring NCSA httpd and Web-server content directories on a Sun
Solaris 2.5.1 host
8. Enabling process accounting on systems running Solaris 2.x
9. Installing, configuring, and using tcp wrapper to log unauthorized
connection attempts on systems running Solaris 2.x
10. Configuring and using syslogd to collect logging messages on
systems running Solaris 2.x
11. Using newsyslog to rotate files containing logging messages on
systems running Solaris 2.x
12. Installing, configuring, and using logdaemon to log unauthorized
login attempts on systems running Solaris 2.x
13. Installing, configuring, and using logdaemon to log unauthorized
connection attempts to rshd and rlogind on systems running Solaris 2.x
14. Understanding system log files on a Solaris 2.x operating system
15. Installing, configuring, and using swatch to analyze log messages
on systems running Solaris 2.x
16. Installing, configuring, and using logsurfer on systems running
Solaris 2.x
17. Configuring and installing lsof 4.50 on systems running Solaris
2.x
18. Configuring and installing top 3.5 on systems running Solaris 2.x
19. Installing, Configuring, and using npasswd to improve password
quality on systems running Solaris 2.x
20. Installing and configuring sps to examine processes on systems
running Solaris 2.x
21. Installing and securing Solaris 2.6 servers
22. Installing, configuring, and operating the secure shell (SSH) on
systems running Solaris 2.x
23. Characterizing files and directories with native tools on Solaris
2.X
24. Detecting changes in files and directories with native tools on
Solaris 2.X
25. Installing and operating lastcomm on systems running Solaris 2.x
26. Installing, configuring, and using spar 1.3 on systems running
Solaris 2.x
27. Installing and operating tcpdump 3.5.x on systems running
Solaris 2.x
28. Installing, configuring, and using argus to monitor systems
running Solaris 2.x
29. Using newarguslog to rotate log files on systems running Solaris
2.x
30. Installing libpcap to support network packet tools on systems
sunning Solaris 2.x
31. Writing rules and understanding alerts for Snort, a network
intrusion detection system
32. Disabling network services on systems running Solaris 2.x
33. Installing noshell to support the detection of access to disabled
accounts on systems running Solaris 2.x.
34. Disabling user accounts on systems running Solaris 2.x

Xem chi tiết: Các tài liệu hướng dẫn bảo mật hệ thống mạng máy tính