When deploying servers, you should have a process for security hardening and certification. This process will provide a standardized image that will improve not only security but also the quality of your system deployment process. The first step to putting this process in place is to develop a standard OS image for a given set of hardware. This standard image should be the "least common denominator" that you would use for a deployment and should not contain any special applications, such as database or Web services. A good start is to deploy a server using your current process, and then harden it using documented procedures for system security:
Microsoft Windows NT: www.sans.org/newlook/publications/ntstep.htm
Novell NetWare: www.nwc.com/1120/1120ws1.html
Sun Microsystems Solaris: www.sans.org/newlook/resources/hard_solaris.htm
Hardening procedures for other operating systems can be obtained from the vendor. Some vendors can provide prehardened or "trusted" versions of their OSes.
Once you have created and tested your hardened image, you can use it as part of your standard deployment process. That process should follow five steps:
Install your standard, hardened image.
Add applications to provide the functionality the server needs (for example, database, application, Web and firewall).
Complete a vulnerability analysis on system (security certification step).
Deploy the system into your environment.
Step 4 is a certification step that reduces the probability that the system you are about to deploy will add vulnerabilities into your environment. The quality of this certification is directly related to the quality of the vulnerability assessment product you use. Your vulnerability-assessment tools should also be used periodically to examine the systems you have deployed into your environment. This on-going security certification will help keep you ahead of any vulnerabilities that may develop because of new exploits or changes in systems configuration after deployment.
REPORTS
Analyize In-Line NAC strategies and products.
ANALYTICS Plan and design your enterprise blade server deployments
InformationWeek U.S. IT Salary Survey 2008
Salaries for business technology professionals are falling. Here's what you need to know in order to make good hiring decisions and personal career choices. Download Today
REPORTS
ANALYTICS
Follow 
