what general internet security precautions should I take?
If you are a Webmaster, system administrator, or are otherwise involved with the administration of a network, the single most important step you can take to increase your site's Computer Security is to create a written security policy. This security policy should succinctly lay out your organization's policies with regard to:
who is allowed to use the system
when they are allowed to use it
what they are allowed to do (different groups may be granted different levels of access)
procedures for granting access to the system
procedures for revoking access (e.g. when an employee leaves)
what constitutes acceptable use of the system
remote and local login methods
system monitoring procedures
protocols for responding to suspected security breaches
This policy need not be anything fancy. It need only be a succinct summary of how the information system work, reflecting your organization's technological and political realities. There are several benefits to having a written security policy:
You yourself will understand what is and is not permitted on the system. If you don't have a clear picture of what is permitted, you can never be sure when a violation has occurred.
Others in your organization will understand what the security policy is. The written policy raises the level of security consciousness, and provides a focal point for discussion.
The security policy serves as a requirements document against which technical solutions can be judged. This helps guard against the "buy first, ask questions later" syndrome.
The policy may help bolster your legal case should you ever need to prosecute for a security violation.
For Web servers, here are some general security precautions to take:
Limit the number of login accounts available on the machine. Delete inactive users. Make sure that people with login privileges choose good passwords.
Turn off unused services. For example, if you don't need to run FTP on the Web server host, get rid of the ftp software. Likewise for tftp, send mail, gopher, NIS (network information services) clients, NFS (networked file system), finger, systat, and anything else that might be hanging around. Check the file /etc/inetd.conf or Service Manager for a list of servers that may be lurking. Deactivate any that you don't use.
Remove shells and interpreters that you don't absolutely need. Check both the system and Web logs regularly for suspicious activity.
Make sure that permissions are set correctly on system files, to discourage tampering.
Be alert to the possibility that a _local_ user can accidentally make a change to the Web server configuration file or the document tree that opens up a security hole. You should set file permissions in the document and server root directories such that only trusted local users can make changes. Many sites create a "www" group to which trusted Web authors are added. The document root is made writable only by members of this group. To increase security further, the server root where vital configuration files are kept, is made writable only by the official Web administrator. Many sites create a "www" user for this purpose.
|
