How to Protect Your Network

Original article: http://www.nwfusion.com/research/2000/0626featside2.html

How to protect your
network

By SHARON GAUDIN
Network World, 06/26/00

                             ParaProtect, a network
                             security portal in
                             Alexandria, Va., reports
                             that 90% of the security
                             breaches its technicians
                             work on are based on
                             attacks from within. Even
                             more shocking is that
                             upwards of 50% are caused
                             by the company 's own
                             network administrators.

So what can you do to protect your network?

              Here 's a list of tips culled from industry
              analysts, security experts, corporate executives
              and agents of the U.S. Secret Service:

Make sure no one person is controlling the
system front to back.

Require every person logging on to use a
password.

Assign supervisory rights to as few people
as possible.

Back up all systems weekly.

Have a strict sign-in/sign-out system for
backup tapes.

Always have a current copy of the backup
tape stored remotely.

Do backups of desktops and laptops as
well as servers.

Rotate backup tapes - don't keep using the
same one over and over again.

Change passwords every three months.

Keep servers in a secured area.

Stay up-to-date on software patches.

Use intrusion-detection software that
alerts you when you are being hit.

                  Make sure two pairs of eyes have
                  checked code before it is entered into the
                  system.

                  Have an information security department
                  (at least one person and then one other for
                  every 1,000 users) that is separate from
                  the IT department and reports directly to
                  the chief information officer.

Spend at least 3% to 5% of the IS budget
on information security.

                  Train information security personnel to be
                  aware of any employee who shows signs
                  of being troubled or disgruntled,
                  particularly if that employee holds an
                  information-critical position.

                  Beef up security during certain events,
                  such as mergers or downsizings, that
                  could upset workers and cause them to
                  lash out at the company.

                  Monitor the network - set up software
                  that will alert you if the person is working
                  in a different part of the network or at a
                  different time than usual.

                  Scan e-mail to see what's going out of the
                  company, double-check backup tapes and
                  have someone else do the backups if that
                  person is the one in question.

                  Make sure the person in charge of the
                  system is not the same person in charge of
                  the backup.

Have specific policies and punishments
built into employee contracts.

Make sure critical IS workers are bonded.

How to protect your system if you're
firing a network administrator:

Change everyone's passwords so he/she
can't use them to break into the system.

                  Verify that your backup tapes are where
                  they should be; make sure the information
                  has been saved correctly and the tape is
                  functioning properly.

Do a new backup.

Lock down every system that person had
access to on the day of termination.

Have a new network administrator ready
to step into the open position immediately.

                  Go up on the system and check user
                  names and passwords, looking for
                  anything unusual.

Make sure every logon has a password for
it.

                  Lock down all the inside doors, such as
                  the file servers, application servers and
                  mail servers.

Look for backdoors on the system, such
as Back Orifice on Windows NT.

                  Make sure there aren't any known
                  vulnerabilities that haven't been patched -
                  the administrator could have left those
                  holes behind so he could get back in.

Strengthen your intrusion-detection
system.

                  Set a trip wire - software that alerts the
                  administrator to system anomalies, such
                  as the size of a file changing.