Re: DISA Security Readiness Review Evaluation Scripts

From: Toby Bearden (tbearden_at_comcast.net)
Date: 11/25/05

  • Next message: Smith, Michael J.: "RE: DISA Security Readiness Review Evaluation Scripts" 
    Date: Fri, 25 Nov 2005 07:56:50 -0600
To: hannibal blog <hannibalsec@gmail.com>

    The DISA stigs are very comprehensive. The only thing you have to be
    careful about is going to far. I have used the os, database, and web
    server stigs a lot, and the best way to do it the first time you try
    is to incrementally apply the changes, then test the server and make
    sure it still has the functionality you require. If you apply
    everything and then try to work your way back, you are doomed. The
    first time I did it, I would apply about 5-10 changes, test
    functionality, if it worked, take a ghost image, and apply 5-10 more
    changes. That way you can easily drop back to a working point.

    Also, you need to really understand what you are doing with regards
    to permissions and user rights if you are going to follow the stig.
    Otherwise you will make changes that will block out functionality you
    need, and it may be difficult to work backwards. Definitely try it a
    few times on a non-production server first. Also, depending on the
    environment(NT domain, AD, etc...) there are a couple of known
    gotcha's with the protocols.

    Good Luck,
    Toby

    On Nov 24, 2005, at 2:19 AM, hannibal blog wrote:

    > Hello
    >
    > did anyone try the publicly available disa SRR availble at
    > http://iase.disa.mil/stigs/SRR/
    > what is the diference between the publicly available ones and those
    > reserved to .mil ?
    > What do u think about using them to audit a customer win 2k server ?
    >
    > ----------------------------------------------------------------------
    > --------
    > Audit your website security with Acunetix Web Vulnerability Scanner:
    >
    > Hackers are concentrating their efforts on attacking applications
    > on your
    > website. Up to 75% of cyber attacks are launched on shopping carts,
    > forms,
    > login pages, dynamic content etc. Firewalls, SSL and locked-down
    > servers are
    > futile against web application hacking. Check your website for
    > vulnerabilities
    > to SQL injection, Cross site scripting and other web attacks before
    > hackers do!
    > Download Trial at:
    >
    > http://www.securityfocus.com/sponsor/pen-test_050831
    > ----------------------------------------------------------------------
    > ---------
    >

    ------------------------------------------------------------------------------
    Audit your website security with Acunetix Web Vulnerability Scanner:

    Hackers are concentrating their efforts on attacking applications on your
    website. Up to 75% of cyber attacks are launched on shopping carts, forms,
    login pages, dynamic content etc. Firewalls, SSL and locked-down servers are
    futile against web application hacking. Check your website for vulnerabilities
    to SQL injection, Cross site scripting and other web attacks before hackers do!
    Download Trial at:

    http://www.securityfocus.com/sponsor/pen-test_050831
    -------------------------------------------------------------------------------

  • Next message: Smith, Michael J.: "RE: DISA Security Readiness Review Evaluation Scripts"

    Relevant Pages

    • RE: Penetration test of 1 IP address
      ... You could use a whole sleth of tools on some server, ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Check your website for vulnerabilities to SQL injection, ... Up to 75% of cyber attacks are launched on shopping ...
      (Pen-Test)
    • Re: ARP Spoofing and Routing
      ... I would like to know how to go abt spoofing arp caches, ... >What I was trying to do was arpspoof a server so that I could intercept ... Up to 75% of cyber attacks are launched on shopping carts, forms, ... Check your website for ...
      (Pen-Test)
    • RE: ARP Spoofing and Routing
      ... It's pretty nice and very easy to use once you figure out the arp spoofing piece. ... >What I was trying to do was arpspoof a server so that I could intercept ... Up to 75% of cyber attacks are launched on shopping carts, forms, ... Check your website for ...
      (Pen-Test)
    • RE: database server audit tools
      ... For ongoing audit accountability and regulatory compliance via log ... Subject: database server audit tools ... please send me also some links to harden my database server from attacks.. ... Audit your website security with Acunetix Web Vulnerability Scanner: ...
      (Pen-Test)
    • Re: Identification of a Mail Server
      ... Identification of a Mail Server ... Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)