Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

After some comments made to another question, I wonder how many administrators actually go to websites like Packetstorm? Do you keep up to date with the latest threats coming out? Finally what are the best resources to keep you feeling all safe (or frightened) inside?

share|improve this question
add comment

7 Answers

up vote 5 down vote accepted

Someone else mentioned SecurityFocus, but for more general security related issues (not specific to IT), I recommend Schneier on Security. His blog touches on IT security, but also on other security topics as well. I find that some of the more general issues he discusses helps me to be more aware of security in general, which carries over into IT operations.

share|improve this answer
1  
For those too lazy to read (like me) there's an excellent podcast for Schneier's Cryptogram newsletter. crypto-gram.libsyn.com –  Joseph Kern Jun 15 '09 at 23:44
add comment

Honestly, the main thing I do is keep current on patches, including being on the announce/security mailing list for any software I install that's not from the main OS vendor.

Anything else starts falling onto the "more effort than it's worth" side of the cost vs. benefit analysis. I could do my own custom patch, but I'm more likely to break something than if I wait for the vendor to release a tested update.

There's always new threats. Do you really have the time to keep up with every one of them? Do you even care if you're not running the program in question in the affected configuration?

Concentrate on providing the smallest attack surface you can, along with the smallest reasonable attack window. In other words: only run what you need to, firewall everything you can, and keep current on patches.

share|improve this answer
1  
You should really subscribe to the lists/feeds from your major application providers as well. Not everything is covered under Microsoft Updates, or for custom installations in linux (ie non-packaged). –  Joseph Kern Jun 15 '09 at 23:46
    
Joseph, that's what I meant by "being on the list for software that's not from the main OS vendor". Definitely agree. –  freiheit Jun 16 '09 at 16:06
add comment

Securityfocus is my favorite. I am subscribed to this feed with my rss reader. Its volume is manageable to follow. The famous Bugtraq mailing list is also hosted there.

It is also advisable to subscribe your vendor's (security) announce list if they have any.

share|improve this answer
1  
Remember that if you install any software that's not from the vendor you should also sign up for that software's (security) announce list –  freiheit Jun 15 '09 at 22:30
    
Yeah you are right. –  cstamas Jun 16 '09 at 7:07
add comment

SecurityFocus has one big vulnerability database classified by vendor and product. You can also purchase Symantec DeepSight Alert Services where you can select whcich software do you have and several methods for vulnerabilities notifications.

There is a complementary service by Symantec (Threat Alert) which notifies about global security threats.

In the same sort of line, you can use (and contribute to) OSVDB (Open Source Vulnerability Database).

If you want to know about security tools I find darknet very useful.

share|improve this answer
add comment

US-CERT puts out a weekly vulnerability summary. It's pretty comprehensive, and it usually takes only a few minutes to skim it. You can subscribe via e-mail or RSS...

US-CERT vulnerability summaries

share|improve this answer
add comment

I track a several security focused resources, my favorites being Schneier and the Internet Storm Center (part of SANS). Unfortunately, the longer I read Schneier, the more I find myself thinking, ‘Yeah, but....’ after reading an entry. That being said, he makes an incredible cryptographer, and can certainly help you think with security in mind. Dark Reading is another good resource for the security analyst, but will likely be hit/miss for general IT workers.

Otherwise, do what everybody else seems to be mentioning; subscribe to the patch or announce list for anything you use vendor or otherwise. I subscribe to the Secunia mailing list to keep a general eye on what's coming through. Roughly once a week we are asking the SysAdmins whether or not the patches have been applied from vulnerabilities advertised through Secunia.

share|improve this answer
add comment

It really depends on how interested in security you are. Are you just wanting to monitor for when assets you have in house have security issues? Or do you really like security?

You can also check out Project Quant for a list of the process for monitoring for advisories: http://securosis.com/projectquant/details-monitor-for-advisories

Someone recently compiled a good list of over 100 security related RSS feeds: exoticliability.com/forum/topics/list-of-feeds-for-infosec

I'll also shamelessly plug the OSVDB (Open Source Vulnerability Database), a project of the Open Security Foundation. It's a great place to get vulnerability information combined from a variety of sources (milw0rm, Bugtraq, secunia, CVE, etc.)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.