[ISN] Draft guidance for securing servers

http://www.gcn.com/online/vol1_no1/46239-1.html

By William Jackson
GCN.com
05/08/08

The National Institute of Standards and Technology is seeking comment on 
its draft guidelines for securing servers, released this week.

NIST Special Publication 800-123 [1], "Guide to General Server 
Security," makes recommendations for securing server operating systems 
and softwarein addition to maintaining a secure configuration with 
patches and software upgrades, security testing, log monitoring and 
backups of data and operating system files.

The document addresses common servers that use general operating systems 
and are deployed in outward- and inward-facing locations. The 
recommendations apply to a variety of typical servers, such as Web, 
e-mail, database, infrastructure management and file servers. Much of 
the content was derived from SP 800-44 Version 2, "Guidelines on 
Securing Public Web Servers," and SP 800-45 Version 2, "Guidelines on 
Electronic Mail Security."

Common security threats addressed include exploitation of software bugs 
to gain unauthorized access, denial-of-service attacks, exposure or 
corruption of sensitive data, unsecured transmission of data, use of a 
server breach to gain access to other network resources and use of a 
compromised server to launch attacks.

NIST recommended that security plans be considered from the initial 
planning stage because addressing security is more difficult after 
deployment. "Organizations are more likely to make decisions about 
configuring computers appropriately and consistently when they develop 
and use a detailed, well-designed deployment plan," the document said. 
It also advised agencies to consider human resources required for 
deployment and operational phases, including training requirements.

To ensure the security of a server and the supporting network 
infrastructure, NIST recommends:

    * Organizationwide information system security policy.
    * Configuration/change control and management.
    * Risk assessment and management.
    * Standardized software configurations that satisfy the information 
      system security policy.
    * Security awareness and training.
    * Contingency planning, continuity-of-operations and disaster 
      recovery planning.
    * Certification and accreditation.

In deployment server operating systems, default hardware and software 
configurations usually must be modified to achieve adequate security 
rather than maximum functionality and ease of use. "Because 
manufacturers are not aware of each organization's security needs, each 
server administrator must configure new servers to reflect their 
organization's security requirements and reconfigure them as those 
requirements change," NIST advised. "Using security configuration guides 
or checklists can assist administrators in securing systems consistently 
and efficiently."

Similar efforts are needed for server applications. "The overarching 
principle is to install the minimal amount of services required and 
eliminate any known vulnerabilities through patches or upgrades," the 
document said.

Comments on the draft should be e-mailed [2] by June 13, with the phrase 
"Comments SP 800-123" in the subject line.

[1] http://csrc.nist.gov/publications/drafts/800-123/Draft-SP800-123.pdf 
[2] 800-123comments (at) nist.gov