After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the best resources to keep you feeling all safe (or frightened) inside?
Comments disabled on deleted / locked posts / reviews
|
7 Answers
Someone else mentioned SecurityFocus, but for more general security related issues (not specific to IT), I recommend Schneier on Security. His blog touches on IT security, but also on other security topics as well. I find that some of the more general issues he discusses helps me to be more aware of security in general, which carries over into IT operations.
answered Jun 15, 2009 at 22:20
-
1For those too lazy to read (like me) there's an excellent podcast for Schneier's Cryptogram newsletter. crypto-gram.libsyn.com Jun 15, 2009 at 23:44
Honestly, the main thing I do is keep current on patches, including being on the announce/security mailing list for any software I install that's not from the main OS vendor.
Anything else starts falling onto the "more effort than it's worth" side of the cost vs. benefit analysis. I could do my own custom patch, but I'm more likely to break something than if I wait for the vendor to release a tested update.
There's always new threats. Do you really have the time to keep up with every one of them? Do you even care if you're not running the program in question in the affected configuration?
Concentrate on providing the smallest attack surface you can, along with the smallest reasonable attack window. In other words: only run what you need to, firewall everything you can, and keep current on patches.
-
1You should really subscribe to the lists/feeds from your major application providers as well. Not everything is covered under Microsoft Updates, or for custom installations in linux (ie non-packaged). Jun 15, 2009 at 23:46
-
Joseph, that's what I meant by "being on the list for software that's not from the main OS vendor". Definitely agree.– freiheitJun 16, 2009 at 16:06
Securityfocus is my favorite. I am subscribed to this feed with my rss reader. Its volume is manageable to follow. The famous Bugtraq mailing list is also hosted there.
It is also advisable to subscribe your vendor's (security) announce list if they have any.
-
1Remember that if you install any software that's not from the vendor you should also sign up for that software's (security) announce list– freiheitJun 15, 2009 at 22:30
-
SecurityFocus has one big vulnerability database classified by vendor and product. You can also purchase Symantec DeepSight Alert Services where you can select whcich software do you have and several methods for vulnerabilities notifications.
There is a complementary service by Symantec (Threat Alert) which notifies about global security threats.
In the same sort of line, you can use (and contribute to) OSVDB (Open Source Vulnerability Database).
If you want to know about security tools I find darknet very useful.
US-CERT puts out a weekly vulnerability summary. It's pretty comprehensive, and it usually takes only a few minutes to skim it. You can subscribe via e-mail or RSS...
I track a several security focused resources, my favorites being Schneier and the Internet Storm Center (part of SANS). Unfortunately, the longer I read Schneier, the more I find myself thinking, ‘Yeah, but....’ after reading an entry. That being said, he makes an incredible cryptographer, and can certainly help you think with security in mind. Dark Reading is another good resource for the security analyst, but will likely be hit/miss for general IT workers.
Otherwise, do what everybody else seems to be mentioning; subscribe to the patch or announce list for anything you use vendor or otherwise. I subscribe to the Secunia mailing list to keep a general eye on what's coming through. Roughly once a week we are asking the SysAdmins whether or not the patches have been applied from vulnerabilities advertised through Secunia.
answered Jun 16, 2009 at 1:26
It really depends on how interested in security you are. Are you just wanting to monitor for when assets you have in house have security issues? Or do you really like security?
You can also check out Project Quant for a list of the process for monitoring for advisories: http://securosis.com/projectquant/details-monitor-for-advisories
Someone recently compiled a good list of over 100 security related RSS feeds: exoticliability.com/forum/topics/list-of-feeds-for-infosec
I'll also shamelessly plug the OSVDB (Open Source Vulnerability Database), a project of the Open Security Foundation. It's a great place to get vulnerability information combined from a variety of sources (milw0rm, Bugtraq, secunia, CVE, etc.)
