A Push For New Security Benchmarks

Datamation content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.

A large consortium of users, vendors, and insurers known as the
Center for Internet Security (CIS) this week will hold a meeting to
promote standard security settings for Microsoft’s Windows 2000.

Meanwhile, the group is testing products from Symantec, BindView,
NetIQ, and other companies for use with its own emerging set of
template-based benchmarks, meant to give network managers hands-on
tools for living up to enterprise security policies in Windows, UNIX,
and Linux environments.

The CIS benchmarks “go ‘down in the weeds,’ where detailed
operational security parameters are set, to configure workstations,
servers, routers, firewalls, and other devices,” said CIS
President and CEO Clint Kreitner.

At many organizations, these devices “are either
misconfigured, or they haven’t been properly patched,” according
to Kreitner.

Level 1 Benchmarks Completed

The CIS has more than 170 members, including major insurance
companies, auditing firms, banks, government agencies, manufacturers,
hospitals, manufacturers, software vendors and consultants.

The consortium has already completed “Level 1” security
benchmarks and scoring tools for Solaris, HP-UX, W2K, Linux, as well
as “Level 1 and 2” benchmarks and tools for Cisco IOS
routers. The finished benchmarks and tools are available for free
download on the group’s Web site, at http://www.cisecurity.org
.

The Level 1 benchmarks provide cut-and-paste command lines that
network managers, systems administrators, and other technicians can
use for setting up devices to comply with “industry best
practice” security policies.

The Level 2 benchmarks are aimed more at security consultants and
others who are “slightly more sophisticated about security,”
Kreitner said. Technicians can use the scoring tools to rate policy
compliance, as well as to help find and fix configuration errors.

The benchmarks and tools also “begin to create a language
that can be understood by both (business) managers and technical
people,” according to Kreitner.

The CIS is also certifying commercial software products for use in
specific operating environments. BindView’s bv-Control has already
been certified for W2K and Solaris.

Testing will begin today on Symantec’s Enterprise Security Suite.
Vendors that will undergo certification testing in the future include
NetIQ, among others.

Vendors Leaving Security Up To Users

At the same time, the CIS is urging vendors to ship products with
preconfigured security settings.

“How can we improve security? Vendors are leaving security up
to the users, many of whom don’t have the knowledge or time to
properly deal with it. Why do we accept it when vendors (leave) all
the services widen open? We the users have to push the vendors,”
Kreitner said.

Many organizations tend to want to “get (a product) going
first. Then we worry about security, if we ever do,” he added.

“Does this sound familiar? A (network) break-in occurs. A
well known vulnerability was exploited. Security staff and system
administrators argue about who was to blame. Senior management sees
the process as broken. Staffs are reorganized; managers are
reassigned. The new managers hire a consultant to do a vulnerability
analysis and penetration test. The consultant’s analysis shows an
average of up to 30 vulnerabilities per system,” according to
Kreitner.

“Management writes a memo telling system administrators and
department heads to fix these vulnerabilities within xx weeks. The
work would take months; system administrators don’t make all the
fixes – not even a small fraction. At the same time, new software is
installed, and new vulnerabilities are created.”

CIS benchmarks and scoring tools have already undergone more than
150,000 downloads. Users of the W2K tools include Cervalis, Tulane
University, Virginia Tech, and the US Central Credit Union, for
example. On the Solaris side, users include Agilent Technologies,
Utah State University, Mt. Clements General Hospital, and the US Air
Force Research Laboratory.

“We started with Solaris because there are so many Sun
servers in enterprise environments,” Kreitner noted. The CIS has
already released an upgrade to the original set of benchmarks and
scoring tools for Solaris.

Next to come are a W2K Level 2 IIS benchmark; Solaris Apache Level
1 benchmark; IBM AIX Level 1 benchmark and scoring tools; and
Checkpoint Firewall/VPN Level 1 benchmark and tool.

Also planned for the future are benchmarks and scoring tools for
databases, applications, network appliances, printers, and copiers.

Support Policies With Practical Procedures

Many observers outside the CIS agree that network administrators
need practical tools for implementing enterprise security policies.

“Many security problems are due to operator error. To avoid
those kinds of mishaps, the policies and standards set by managers
should be supported by ‘keystroke to keystroke” procedures,”
said Bob Robinson of Sprint’s Security Practice.

“Any participant in the CIS is doing a great service to its
clients and customers,” said Anil Phull, senior analyst for
security solutions at the Yankee Group.

The CIS was established in October, 2000 to help network users and
operators, as well as their insurers and auditors, reduce the risk of
business disruption due to technical failures or security incursions.

The five founding partners were the Information Systems Audit and
Control Association (ISACA); The American Institute of Certified
Public Accountants (AICPA); the International Information Systems
Security Certification Consortium (ISC); and the SANS Institute.

The organization’s use of benchmark and scoring tools is based on
an approach pioneered in the late 1990s by another CIS member, First
Union (recently merged with Wachovia Bank).

This article was first published on CrossNodes, an internet.com site.