The U.S. Department of Defense has a wide range of documents known as the "STIGs" — Security Technical Implementation Guide. These describe US DOD's view of best practices. Get them here: http://iase.disa.mil/stigs/stig/
If you're in US DOD or a contractor to it, you will be regularly audited. If you convince the auditor that you're following the STIG, the audit will succeed quickly. If you don't follow a STIG item, that may be acceptable as long as you can provide an explanation of why you are doing that and what you are doing to provide the needed security in that area.
If you are not connected to DOD, then the STIGs may seem somewhat paranoid and of little interest. But they do provide a good starting point for your policy. At the very least, they provide an organized set of concerns to be addressed in your policy.
TARA, the Tiger Analytical Research Assistant, is an automated system administrator's assistant: http://www-arc.com/tara/index.shtml.
COPS has been a standard auditing tool, although it's getting awfully old: ftp://ftp.cerias.purdue.edu/pub/tools/unix/scanners/cops/
Titan automatically changes your system configuration to increase security, possibly breaking some functionality: http://www.fish2.com/titan/
Bastille takes you through a series of questions, educating along the way, possibly making configuration changes to increase security: http://www.bastille-linux.org/
Internet Security Systems, http://www.iss.net, makes system configuration testers with graphical interfaces. However, their tools are very expensive and have a difficult licensing scheme, and you don't necessarily get as much information as you can from the free tools.
Password cracking tools have clever rules implementing what users once thought were really keen ways to build passwords. Assume your threats have Crack, with the most up-to-date Crack rule sets, dictionaries of terms specific to your organization (e.g., phone directory, list of project and product names, building names, etc), and possibly huge dictionaries in several languages.
Password Cracking Tools for the Windows NT Family (NT3.x, NT4.x, Win2000, WinXP, Win2003, Vista, etc)
More tool FTP sites:
My how-to-secure-Linux-and-BSD page is at: http://www.cromwell-intl.com/security/linux-hardening.html
|
||||||||||||
|
||||||||||||
