Chapter 5 – PC Board Components, Upgrades, and Add-ons
Multi-Tech RouteFinder RF650VPN User Guide
189
Monitoring
Here you need to keep track of your system in terms of 'normal' usage so you can tell:
·
If your RouteFinder is working.
·
If your RouteFinder has been compromised.
·
What kinds of attacks are being perpetrated.
·
If your RouteFinder is providing the services your users need, or if upgrades or add-ons are needed.
To be proactive in solving these issues, keep track of usage reports and logs (refer to the sections on
System|User authentication, Network|Accounting, Definitions|Users, and Packet filter|LiveLog in
Chapter 3 of this manual). For information on RouteFinder upgrades and add-ons refer the preceeding
section called Software Upgrades and Add-ons.
Updating
This involves keeping both yourself and your RouteFinder abreast of new bugs, new attacks and new
patches, new tools and resources, etc. Much of the RouteFinder updating effort can be done
automatically (refer to the System|Up2Date Service section in Chapter 3 of this manual). Administrators
can keep themselves current with mailing lists, news groups, security forums, etc. (refer to the section on
Pre-Installation Planning in Chapter 1 of this manual for additional sources of information).
The SANS Institute and the National Infrastructure Protection Center (NIPC) produces a document
summarizing the Twenty Most Critical Internet Security Vulnerabilities. Thousands of organizations use
the list to prioritize their efforts so they could close the most dangerous holes first. It is segmented it into
three categories: General Vulnerabilities, Windows Vulnerabilities, and Unix Vulnerabilities. The
SANS/FBI Top Twenty list is valuable because the majority of successful attacks on computer systems
via the Internet can be traced to exploitation of security flaws on this list. While manually checking a
system for each of the listed vulnerabilities is possible, a more practical way to find UNIX and Windows
vulnerabilities is to use an automated scanner.
Bob Todd, the author of the free Internet scanner SARA, created a version of SARA that finds and reports
on the status of the SANS/FBI Top Twenty list. SARA’s Top Twenty Vulnerability scanner is available
from the Center for Internet Security (
www.cisecurity.org
). To request a copy, email
with the subject "Top Twenty Scanner." Several commercial vulnerability scanners
may also be used to scan for these vulnerabilities, and the SANS Institute maintains a list of all scanners
that provide a focused Top Twenty scanning function at
www.sans.org
.