Linux Advisory Watch – June 4, 2004

Incident Response

One of the most overlooked
aspects of information security is incident response. Often system administrators
and management only take action after a compromise or critical failure. Incident
response includes much more than sorting out problems after they occur. It includes
incident preparation, detection mechanisms, containment, eradication, restoration,
and review.

In preparation for a security
incident, it is important to establish a security policy & plan of action and
identify a security response team that is available 24 hours. Software to be
used during an incident should be installed, tested, and configured during the
preparation phase. During the adrenaline rush of an incident, it is impossible
to learn new software.

Administrators should also
take appropriate steps to ensure event detection. This includes scanning and
reviewing system log files, installing host and network based intrusion detection
systems, and implementing a remote notification system to notify members of
the security response team via pager or mobile phone.

Upon detection of an incident,
it is important to have containment procedures. Is the threat a network user?
It is important that the staff has the knowledge and tools necessary to address
the problem at the firewall level. If there is a system compromise, is tripwire
configured properly to report exactly what files were modified? After containment,
the next step is eradication. How can the problem be eliminated? The primary
purpose of containment and eradication is limiting damage and stopping the problem
from further damage.

After an incident has commenced,
the next step is system restoration. It is important to assess the actual damage
that took place and restore the system to its original condition. This may only
include fixing a few files, or restoring completely from a tape-backup. Finally,
after restoration is important to review how well the incident was handled.

Until next time, cheers!
Benjamin D. Thomas

LinuxSecurity
Feature Extras:

Guardian
Digital Security Solutions Win Out At Real World Linux
– Enterprise Email and Small Business Solutions Impres at Linux Exposition.
Internet and network security was a consistent theme and Guardian Digital
was on hand with innovative solutions to the most common security issues.
Attending to the growing concern for cost-effective security, Guardian Digital’s
enterprise and small business applications were stand-out successes.

Interview
with Siem Korteweg: System Configuration Collector
– In this interview we learn how the System Configuration Collector (SCC)
project began, how the software works, why Siem chose to make it open source,
and information on future developments.

Security:
MySQL and PHP
– This is the second installation of a 3 part article on LAMP (Linux Apache
MySQL PHP). In order to safeguard a MySQL server to the basic level, one has
to abide by the following guidelines.

[ Linux
Advisory Watch ] – [ Linux
Security Week ] – [ PacketStorm
Archive ] – [ Linux Security
Documentation ]

Linux Advisory Watch
is a comprehensive newsletter that outlines the security vulnerabilities that
have been announced throughout the week. It includes pointers to updated packages
and descriptions of each vulnerability.
[ Subscribe
]