General

Security Tools for the Budget Conscious ISP, Part II: Security Administration Tools

by Lisa Phifer VP Core Competence, Inc. [January 30, 2004]

Security Administration Tools
There are many, many products out there to help you manage various aspects of network, system, and server security. For the purpose of this article, we'll focus on two security-related tasks: keeping security patches up-to-date and enforcing security parameter settings.

Vulnerability assessments are only productive if you take action to close the highest-priority holes identified in test results. But ad hoc fixes have a way of coming undone over time. If you manually download missing security patches today, how will you stay on top of new patches? If you SSH into a server to lock down directories and disable anonymous FTP, how can you be sure someone won't change those settings back?

Automated tools can help you improve security after an assessment and maintain that improved level over time. Deciding which patches to apply and what parameters to change is still a big task, but tools can do the legwork by implementing your decisions consistently across an entire network.

A few commercial (security) patch management systems include:

• Altiris Patch Management Solution
• ConfigureSoft Security Update Manager (SUM)
• Microsoft SMS 2003 Security Patch Management
• Shavlik HFNetChkPro Security Patch Manager
• St. Bernard UpdateEXPERT

A non-exhaustive list of (security) configuration management products include:

• BindView Vulnerability Management
• ConfigureSoft Enterprise Configuration Manager (ECM)
• NetIQ VigilEnt Security Manager Suite
• Pedestal Software INTACT and NTSEC
• Symantec Enterprise Security Manager

As should be obvious from many of these product names, commercial offerings tend to be geared towards meeting the needs of enterprises that manage hundreds of servers and thousands of desktops. Nonetheless, these products can often be used in smaller deployments; cost can be managed by focusing on your most essential servers.

If commercial solutions just aren't in your budget, here are a few patch and configuration management tools that you can download at no cost:

• Bastille Linux Hardening System can help you secure *NIX systems running Debian, Mandrake, Red Hat, SuSE, TurboLinux, HP-UX, and Mac OS X.
• Cisco-centric Open Source Tools like CiscoConf and ConfigSafe are freely available to help manage router, switch, and other Cisco device configurations. These and many other tools can be found on the COSI Web site.
• Fast OnlineUpdate for SuSE (fou4s) is a freely available package update tool for SUSE, not specific to security patch management.
• Microsoft's Software Update Services (SUS) uses a client/server architecture to essentially run Windows Update on a Windows XP/2000/2003 Server inside a firewall, letting the administrator control which patches get pushed to Win32 clients. Microsoft also sells SMS 2003; differences between these tools are described here.
• DOE-CIAC's SafePatch is freely available to US government agencies and their contractors. SafePatch can help you automate analysis, distribution, notification, and installation of security patches on Solaris, Linux, and Windows.
• Shavlik's HFNetChkPro Free Version supports graphical patch assessment, deployment, and tracking for up to 10 Windows servers. To manage additional servers, see Shavlik's commercial product. To view sample HFNetChkPro output, click here.
• Ximian RedCarpet is an open source software management tool for RedHat, Mandrake, and SUSE Linux, available in both command line and graphic client formats.

This list is admittedly short on configuration tools. We just haven't found many free tools that offer turn-key security configuration management.

 

Security Tools for the Budget Conscious ISP, Part II: Introduction and Vulnerability Scan and Assessment Services

Security Tools for the Budget Conscious ISP, Part II: Network Vulnerability Assessment Tools

Security Tools for the Budget Conscious ISP, Part II: System Vulnerability Assessment Tools

Security Tools for the Budget Conscious ISP, Part II: Web Vulnerability Assessment Tools

Security Tools for the Budget Conscious ISP, Part II: Security Administration Tools

>Security Tools for the Budget Conscious ISP, Part II: Security Audit Tools and Conclusion