Linux Advisory Watch – May 28, 2004

Internal and External Audit

One of the most important but overlooked
aspects of information security is auditing. All servers have been hardened,
all patches installed, access is regularly monitored, but can one be sure all
of those countermeasures are effective? Auditing is an independent review to
form an opinion. It can provide assurance that the security controls in place
are doing their job. It is important to conduct both internal and external,
each having their own advantages. Auditing is increasingly becoming top-management
priority because of the increased reliance on IT, increased system complexity,
and increased concern for security. Also, many laws are requiring it as a necessary
business function to achieve compliance.

Internal audit is a tool that can
be used to give assurance to managers and other personnel. It provides the ability
to compare the security policies, procedures, and practices being used with
those in a standard or best practices. It gives management the ability to make
comparisons between different departments and divisions. From an IT security
point of view, it identifies areas that need attention and can provide information
on how to improve overall security. It is always better to identify and fix
problems found internally, rather than in external audits.

External audits are conducted by
third parties and can be used to give assurance to other parties such as share-holders,
the board of directors, or partner companies. External audits can provide the
information necessary to make comparisons between other companies (if the data
is available) or industry standards. The process of auditing produces reports
that are issued to management and are written in a way that they can understand
and address. It involves translating technical risks into business language.
Generally, audit reports summarize the current situation, compare that with
what the standards say, and provide direction on how to achieve compliance.
Auditing can provide the information required for implementing new security
controls, conducting a risk analysis, and special internal investigations.

Pentesting and vulnerability assessments
are another essential aspect of auditing. It is necessary to check system security
from an intruder’s perspective. Auditors should ask who, what, when, where,
and how. Timelines should be compiled, system logs should be reviewed, and personnel
should be interviewed. Rather than only hoping a system is secure, auditing
can provide a level of assurance that will help you sleep better at night.

Until next time, cheers!
Benjamin D. Thomas

LinuxSecurity
Feature Extras:

Guardian
Digital Security Solutions Win Out At Real World Linux
– Enterprise Email and Small Business Solutions Impres at Linux Exposition.
Internet and network security was a consistent theme and Guardian Digital
was on hand with innovative solutions to the most common security issues.
Attending to the growing concern for cost-effective security, Guardian Digital’s
enterprise and small business applications were stand-out successes.

Interview
with Siem Korteweg: System Configuration Collector
– In this interview we learn how the System Configuration Collector (SCC)
project began, how the software works, why Siem chose to make it open source,
and information on future developments.

Security:
MySQL and PHP
– This is the second installation of a 3 part article on LAMP (Linux Apache
MySQL PHP). In order to safeguard a MySQL server to the basic level, one has
to abide by the following guidelines.

[ Linux
Advisory Watch ] – [ Linux
Security Week ] – [ PacketStorm
Archive ] – [ Linux Security
Documentation ]

Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.
[ Subscribe
]