Continuing with Enterprise Security: A Data-Centric Approach to Securing the Enterprise by Aaron Woody Chapter 5 gest into some of the security processes and technologies to securing you compute platforms covering topics such as:
- anti-virus (or not),
- network lock down through the use of local firewalls built into the OS (so people can’t then just access the server by any means they desire SSH, RDP, telnet etc)
- user permissions
- auditing (so you can see what is happening/happened and by whom)
- detection of file change in parts of the system that shouldn’t change except through specific mechanisms e.g. OS files should only change when patching the OS
But more importantly the chapter links these kinds of activities to the analysis of risk and previously developed trust models. So that you can understand how much security is suitable and justifiable. The ideas along with the pros and cons of each activity are well explained and clearly presented.
Chapter 6 takes us back to central theme of the book – data. With our policies and models identified we need to locate the data – this is harder than it may sound, not everything is in a database (the amount of business operation that runs on spreadsheets on people’s desktops, is endlessly amazing and then compounded by how we make the data collaborative – emailing, moving with personal USB storage, cloud services and on and on). To help find, track and potentially constrain it (prevent undue leakage) the book walks through the ideas of classification and ownership/accountability and then really starts to tie together the earlier chapters, as well as introduce some additional technology concepts such as the encryption of data when in transit and at rest. Like chapter 5, you don’t need a PhD to understand where to apply security and why – the doing maybe a different kettle of fish of course.
Previous blog entries:
There is also a supporting website for the book athttp://www.datacentricsec.com/
Phil (aka MP3Monster)'s Blog 