Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

One of my friend has started a company, it's a small-scale company that has a 40 workers.There is two guys also responsible for the security and IT related issues.He is managing the LAN, Webpage of the company, e-mail configuration, printer hardware modification, application deployment etc.

In this point, to provide the security measures including access controls, authentication, web server security etc. Which tools do you use for securing, monitoring and controlling the system ? Are you paying for these tools or are they open source?

This question is due to the security administrators requests to my friend.He offers to get some tools for the company and my friend hesitates to pay that much on them (what he mentioned me.)

share|improve this question
    
What's the predominate OS? Windows, Linux etc.. –  tony roth May 4 '10 at 22:03
    
all computers used by the employees are upgraded to windows 7. In some branches Linux based OS are used. –  Berkay May 4 '10 at 22:06
2  
A baseball bat? –  Tom O'Connor May 4 '10 at 22:07

4 Answers 4

up vote 4 down vote accepted

Well these are the top three:

  • A decent anti-virus package on all computers on the network including servers. Ideally, scanning email as it comes in. (e.g. Trend micro, bit defender, nod32... ideally ones that can be centrally managed).

  • A good firewall with graphing and intrusion prevention mechanisms (set up to only allow essential services and block the rest). (e.g. pfsense, astaro, untangle, cisco pix)

  • A backup system you can rely on. Preferably, a copy of the data off-site. Remember the backup is only as good as the ability to restore. Although some may not see this as a security tool, it does provide some security to your data in case of catastrophic failure. It doesn't guard against corruption though because you can backup corrupted data. (e.g. shadow protect). In addition to this, make sure you have at least mirrored RAID drives in all your servers.

After that, you can go to authenticated network access. Authenticated browsing etc. If it's a Microsoft network then a domain controller with domain logon for each computer and a domain policy applied to ensure that access internally is correctly controlled. e.g. you don't want the whole organisation be able to view/edit your financial data that may be stored on an internal server.

If you have a wireless LAN in place then authentication into the wireless LAN through Radius or similar. You need the ability to control access to your LAN.

Thats all that comes to mind right now.

share|improve this answer
    
thanks can you mentions the name of the softwares widely used ? –  Berkay May 4 '10 at 22:07
    
Ok, I've updated my answer with some examples. –  Matt May 4 '10 at 22:14
    
good answer to a vague question. –  Ward May 5 '10 at 1:57
1  
You forgot a gun. To shoot the idiots ignoring all security protocols, disabling the anti virus kit and then loading funny emoticons for windows live messenger ;) –  TomTom May 5 '10 at 5:21

For monitoring I would recommend you Nagios. It's free, you can monitor everything in your network and it will never crash.

Here a link: http://www.nagios.org/

share|improve this answer
    
Thanks, i'll check it. –  Berkay May 4 '10 at 22:44

W3AF is good for quickly penetration testing your web servers. It catches a lot of the basic web server security issues. I also use the metasploit framework, but that is more involved. Backtrack has all of that stuff installed.

share|improve this answer
    
Not important - as it would not hit the company unless the web server lives in the LAN ;) –  TomTom May 5 '10 at 5:21

I recommend they install a HIPS on the office computers and maintain those via an enterprise solution where signatures are pushed from a central system. If they are responsible for the company webpage they are likely taking security somewhat seriously on their server OS, but only somewhat seriously with what that webserver is willing to processing, and probably don't know what client-side security is with regard to web development. If they are going to publish applications on behalf of the enterprise then they need to be fully aware of application and web security, because systems security then becomes only partially relevant.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.