Article

Automated tool at LinuxWorld reduces security risk

Pam Derringer, News Writer

Despite the risks of viruses and malicious attacks, most Linux Web servers are inadequately protected against intrusion.

Requires Free Membership to View

For more on LinuxWorld 2008 and Linux security:
LinuxWorld 2008 conference coverage

IBM engineer touts SELinux at LinuxWorld workshop

Red Hat Linux locked down per DoD, CIS security guidelines

In a preview of his security workshop presentation at LinuxWorld Conference & Expo, Edward Hammersla, the chief operating officer of Herndon, Va.-based Trusted Computer Solutions Inc., said that nearly one-quarter of all Linux Internet-facing servers are not locked down or secured against intrusion because of time and expense. And according to industry studies, another 50% are locked down manually with scripts.

So while 25% of Linux servers are probably secure, as much as 75% may be fully or somewhat at risk.

Security settings need configuration
Even Red Hat Enterprise Linux, which includes SELinux (Security Enhanced Linux) with access protection, is shipped with all the settings wide open to facilitate installation, and out of the box the distribution would fail more than half of industry security guidelines, Hammersla said. Ditto for Solaris 10 with Trusted Extensions, the other most secure Unix operating system.

As much as 75% of Linux servers may be fully or somewhat at risk.
,

"All studies agree that administrators needs to pay greater attention to locking down operating systems," Hammersla said. "Even with SELinux, you have to turn on the SE features. And you have to know where they are to activate them."

Another major area of vulnerability is server passwords, which are administered manually, he said.

But luckily, Hammersla has a fix. Trusted Computer Solutions has an automated scanning tool that searches all servers for conformity to 160 commercial and military guidelines and identifies vulnerabilities, he said. Its Security Blanket complements and extends SELinux to ensure that the operating system and applications run safely, he said.

"The operating system is a traditionally overlooked piece of Linux security, Hammersla said. "With the proper tools, this can be done easily and result in a far more secure operation."

Let us know what you think about the story; email Pam Derringer, News Writer . And check out Enterprise Linux Log.


There are Comments. Add yours.

 
TIP: Want to include a code block in your comment? Use <pre> or <code> tags around the desired text. Ex: <code>insert code</code>

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
Sort by: OldestNewest

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to: