When a piece of information is crucial and can cause serious damage to the national security can be considered classified information. Based on the severity of the damage, classified information can be categorized as top secret (if leaked can cause highest level of damage), secret and confidential (will not cause significant damage if confidential information get leaked). [Read more…] about 12 Things to Remember when Handling Classified Information
security tips
Google Analytics for IT Security Professionals
What is Google Analytics? In short Google analytics is a website statistics tracking tool that you can use to track how your users are interacting with your WebPages such as which pages are being visited the most and where the visitors came from or what keywords he used to find your pages.
Who should use Google Analytics? IT professionals( both in operation and security) involved in managing websites for business purposes can be hugely benefited using analytic type of tools for analysis and monitoring how outside world is interacting with their sites or blogs. Since Google analytics is a free service offered by Google, anyone with a website can use it to track his web visitors’ behavior. If you want to implement analytics in your website you can find useful information at: analytics.google.com  [Read more…] about Google Analytics for IT Security Professionals
WordPress Security Best Practices
With every update, WordPress improves its security capabilities and fix the vulnerabilities. As you know that the default configuration is always risky. To secure a site you always need to customize your security settings, which means apply the best security practices for your blogging platform. If you are a new WordPress user, you might go through a steep learning curve before you become concern about security. We humans do not try to learn things unless you need it or love it -everybody thinks about user experience. However, nobody trusts a site that get hacked frequently. This post you will illustrate you how to apply the WordPress security settings and practices to make your site secured. You can easily implement the following instructions from your cPanel, Plesk or any other control panels.
- Always create an administrative account for blog management, and another editing account (with posting privilege only) to add post in your blog
- By default WordPress use the path www.yourwebiste.com/wp-admin.php to login to your blog. Since the attackers are aware of this you can rename this path by using a plug-in called stealth login. This is an excellent way to prevent automated attack against your blog. Though there are plugins in place to modify the login page, but it is better and more effective if you can change your login page with htaccess. Remember that Modification of htaccess file is not advisable for the beginners. [Read more…] about WordPress Security Best Practices
Cisco Router Security Check for Auditor
Since router is the key to access an organization’s network from the outside world, the maximum security priority should be given to routers that are connected to the Internet and to the important application servers. ISO-27001 has already defined standard router security checklist, which any organization can use to improve their router securities. This post aims to familiarize you with some critical router security checklist so that you can have an in-depth and clear understanding of router security standards.
IIS Security Settings
The version of IIS is all about its modules and functions. If you are just learning IIS then before reading this article, it is better to take  a closer look at the IIS manger on your server and then go through the following instructions. To secure your IIS server you need to put some extra care to the following settings of IIS server
- IIS authentication
- IPv4 and domain rules
- ISAPI and CGI
- Filtering request
- Configuration to shared hosting sites
- Authorize the URLs in your server     [Read more…] about IIS Security Settings
Active Directory Security Checklists
As you know that in a Windows based domain system, active directory is the central management tool that provides access controls to users to the servers or to use any services offered by any specific servers. So, security in Windows based infrastructure should start with securing the active directory. Though most of the part of securing an active directory process focus on security settings of the server, but there are some other components in a network environment – DNS, File server etc. – that also play a vital role when we consider about securing an active directory based environment. More or less, you need to know and test the following settings to check up how secure active directory configuration are windows server configurations and the services.
Linux Security Basics
The purpose of the Linux security checklist is to help the Linux users, entry-level, to become familiar with the most common security vulnerability of Linux operations systems. As you know security checking needs to be verified against well established practices, the following steps are necessary to following before starting your Linux security checking.
- Version number of Linux
- How many users use the OS?
- How many applications are running in your server?
- What are the active services?
- If your sever physically secured
- Whether modification in Linux configuration needs to go through authorization from senior management
- What is your backup plan?
- If there is any antivirus software running
- Check the access control list of the routers and firewalls, if any, directly connected to your server
- Do not use Telnet and FTP since both transmit unencrypted text. Instead use SSH and SFTP for secure connection with other servers or networks.
- Power supply unit to your Linux server? Is there any emergency power supply?
- Temperature and environmental control of the server room. [Read more…] about Linux Security Basics
MySQL Security Settings Checklist and Issues
Securing MySQL requires not only hardening the security configuration of your database itself but also the web server along with the operating system. As you know that most of the web hosting provider love Linux and Apache as part of their web-hosting solution, you need to make sure that your host is taking proper security measures to ensure tighter control of Apache and OS. Your main task will be to perform a few simple tasks or test on your MySQL to remove all the known and easy-to-solve security vulnerabilities of your database. And the good news is that if you are new website owner and reluctant to learn some basic SQL tricks to, then also you can fix the basic security settings of your database from PhPMySQLadmin interface of your Cpanel.
Unless you are hosting your website on your own server in your own premise, you should let the task of Apache and OS security setting to your hosting provider. Now, checkout the following steps required for MySQL security:     [Read more…] about MySQL Security Settings Checklist and Issues
Physical Security of Information Assets
Without paying proper attention to the physical security of information asset your IT assets and infrastructure are always under security threats from known or unknown sources or from accidental hazards. An IT security manager or designer will always need to pay equal or even more attention to ensure that his all the information assets are physically secured. It is not necessary that all the physical security risk to IT assets can be only from physical break into the IT server or assets room, but there are major risk related to environmental risks such as fire. To control the physical security of all IT assets you need to identify all the assets that you consider sensitive and important for your organization. The physical security of IT assets can be broadly categorized based on the following criteria:
1. Security of Asset Location
2. Human access control to the security room
3. Environtal control
Security of asset location
The location of the information asset room need to physical secured. It is always a good practice not to disclose the location of your server room to public. The lesser people know about the location of your server room the better. First of all, you need to make sure that there one entry to your server room including one emergency exit door. Secondly, the entrance of the access door should not be directly visible to the location of your office where the majority of the officials work. Thirdly, before the main access door there should be another small door or space to reduce the risk of piggy backing.
Human access control
Before entering the server room all the personal need to be authorized to enter the room-there can be an exception to the daily maintenance team. But it is better to have the presence of a supervisor when maintence works are carried out. All the personals need to be physically verified and must carry an identity card, if possible implement digital access control or any biometric access control. The security person before the access room must be present always and they there may be a pool of security guards who will be only duty so as they can be familiar with the faces entering the room on regular basis. Finally, there should be close circuit camera both in and outside of the asset room and you need to make sure the access to the digital recording devices are properly monitored and logged.
Environmental security control
You need to make sure that all the equipment installed inside the server rooms are being auditor regularly. Make sure there are at least two emergency power-off switches for the server room itself-one inside and the other outside the room. All the electrical wiring should be placed inside fire-resistance panels and if there are any office desk or cabinets, then use only those equipments made of fire-resistance materials. Any kind of food intake must be strictly prohibited in the server room
Internet Explorer Security Settings Configuration Guide
The foundation of safer browsing experience depends on how much secure your web browser is. When you install any web browser such as Internet Explorer, you get a default security setting, which may not be suitable for your web privacy and data integrity.This article aims to help you to learn a few useful security tips of Microsoft IE 9. With the new Internet explorer version 9 you can enjoy safe browsing experience with faster surfing speed. If you want to enable these security features on your Internet explorer you have to learn how to change a couple of security setting s on your browser. In case you do not have downloaded IE 9 then you can do so by going at Microsoft’s official site for Internet Explorer download.
Now let’s see how you can change the security setting of your Internet browser and what the benefits of it are. The following are the security benefits:
- Active X control
- Smart screen filtering
- In private browsing
- Tracking protection
- Privacy Settings [Read more…] about Internet Explorer Security Settings Configuration Guide
