Chapter 1 – Introduction and Description
Multi-Tech RouteFinder RF650VPN User Guide
9
Pre-Installation Planning - the Organizational
Security Policy
Having an organization-wide security policy is the first and perhaps most important step in general
security planning. Organizations without a well-devised top level security policy will not have ready
answers to questions such as:
·
Who is allowed access to which servers ?
·
Where are the backups stored ?
·
What is the recovery procedure for a security breach ?
These questions must be answered in terms of security costs, useability, compatibility with internal
"culture", and alignment with your site's legal requirements.
Putting a security policy in place and keeping abreast of new security issues as they arise are paramount
to securing your network.
Security management is one of the categories defined by the
ISO
(International Standards
Organization) from
http://www.iso.ch/welcome.html
and
http://www.iso.ch/iso/en/ISOOnline.frontpage
.
Sources of security policy information include the
SANS Institute
,
Microsoft
,
FreeSwan
and other
sources.
The SANS (System Administration, Networking, and Security) Institute, founded in 1989, is a
cooperative research and education organization of more than 96,000 system administrators, security
professionals, and network administrators. The SANS community creates System and security alerts and
news updates, Special research projects and publications, In-depth education, and Certification. Contact
the SANS at
http://www.sans.org/newlook/home.htm
.
Linux FreeS/WAN is an implementation of IPSEC and IKE for Linux. Several companies are co-operating
in the S/WAN (Secure Wide Area Network) project to ensure that products will interoperate. There is
also a VPN Consortium fostering cooperation among companies in this area. FreeS/WAN source code is
freely-available, runs on a range of machines including cheap PCs, and is not subject to US or other
nations' export restrictions:
http://www.freeswan.org/
.
Microsoft Windows 2000 and Windows NT security and related HowTos, Problem Solving,
Documentation, Security Bulletins, and Troubleshooting are available at:
http://www.microsoft.com/technet/default.asp
.
Attrition.org (
http://www.attrition.org
) is a computer security Web site dedicated to the collection,
dissemination and distribution of information about the industry for anyone interested in the subject. They
maintain one of the largest catalogs of security advisories, cryptography, text files, and denial of service
attack information. They are also known for the largest mirror of Web site defacements and their crusade
to expose industry frauds and inform the public about incorrect information in computer security articles.
ATTRITION.ORG is a privately owned and operated system hosted via Inficad Computing and Design.
Computer Security Index FAQ Home Page:
http://web.superb.net/islander/crypto/alt-security-keydist-
FAQ.html
The CERT (Computer Emergency Reponse Team) site at
ftp://info.cert.org/
lists all of the Coordination
Center (CERT-CC) past advisories, as well as 24-hour technical assistance in responding to computer
security incidents.