Securing Linux: A Survival Guide for Linux Security (Version 2.0)

1.2 DEFENSE-IN-DEPTH

In today's world, it is very rare to find instances of a single layer of protection. Homes have door and window locks, deadbolts, an alarm system, and fences around the yards. Cars have door locks, an alarm system that, in most cases, makes a loud noise and kills the ignition, and a steering wheel lock of some kind. In Information Security, this layered approach is commonly referred to as Defense-In-Depth.

Due to the large variety of attacks present today, Defense-In-Depth is necessary to properly secure systems. Some of the elements of Defense-In-Depth include:

• BIOS Passwords “ This prevents an unauthorized individual from booting a system.

• Physical Security “ An unauthorized individual should not be given physical access to the system(s). If they can remove the system from the building, they can put the hard drive(s) in a system they control.

• Chassis Lock s “ This prevents an unauthorized individual from gaining access to the internals of a system.

• Firewalls “ This protects the system by only allowing access to those protocols we have defined in our security policies

• Intrusion Detection “ This protects the system by watching for and alerting on known vulnerabilities.

• File Integrity Software (Tripwire) “ This protects the system by comparing the signature of critical files to a database of known good signatures.

• Logging “ This protects the system by recording identified critical events.

• Baseline and Auditing “ This protects the system by taking a snapshot of the system before it goes on the network and comparing that snapshot to snapshots taken at a regular interval.