Yesterday I spent most of the day re-installing one of the workstation in the office with Ubuntu 11.10. I like what I saw, but the Unity interface is not my cup of tea so I installed Gnome – what they call Classic Ubuntu.
In principle I shut down as many operating services as I can – especially those that call out and/or listen on the Internet but this is supposed to be a development machine with access to our private git repository and sending out email via a Postfix relay.
On our own small scale of a lab with 6-7 machines for testing network and software security of customer applications, I got thinking that most system vulnerabilities live in the cracks of system integration of components and packaged software while most of the industry’s efforts in software security are directed towards new software implementations.
If you are preparing to implement a packaged application for financial management, CRM, data mining or ERP something in the back of your mind probably says that the vendor’s development organization is probably not a lot different than yours (although you hope they’ve thought through the security issues first)..
Here are a 2 ideas to help find the crud in the cracks:
- Inspect and penetration-test the system; assess infrastructure components, database interfaces and Web applications for vulnerabilities using The Software Associates 6 step Business threat analysis methodology
- You need to identify fault-prone modules in your particular operation and evaluate those modules with the most impact on system reliability and downtime.