...
Security Services/Features needed (based on SLAC MinSec):
- Anti-virus Software
- Install and configure ClamAV (optional, since not in moderate enclave)
- Application Patches
- Configure automatic updates for Applications via apt/yum config
- Authentication
- Requirements met for global accounts via Global account authentication policy handled by Active Directory rules
- Use Chef Compliance to scan for and any enabled insecure protocols such as telnet and ftp
- Logging
- Configure syslog to log to central syslog server, and enable logging locally to /var/log/everything
- Network Services
- Check for inappropriate network services via Chef Compliance
- Operating System Patches
- Configure automatic updates for OS patches via apt/yum
- Passwords
- Configure local password quality checks and policies (expiration time, etc) according to SLAC password policy
- Global account password policy handled by Active Directory
- Baseline Security Configuration
- Chef Compliance CIS Desktop profile (modified where appropriate) will be used as baseline
- Chef Compliance scanning can report on compliance level for our baseline
- Training
- No additional changes needed (same SLAC Training Assignments are required)
- Security Scanning
- Local scanner account will be enabled to allow authenticated Nessus scans by Cyber Security team
- Banner
- The SLAC DOE login banner will be configured
...
Reference Documents:
Published SLAC Policies and Governance SLAC Controlled Documents page:
https://docs.slac.stanford.edu/sites/pub/Pages/SLAC_Policies.aspxMinimum Security Requirements for Computing
https://docs.slac.stanford.edu/sites/pub/Publications/701-I02-001-00_Min_Sec_Req_for_Comp.pdfConfiguration Management Procedures in the SCS twiki:
https://novel.slac.stanford.edu/twiki/bin/view/SCCS/ConfigurationManagementSLAC Password Policy
http://www2.slac.stanford.edu/computing/security/password/passwordpolicy.htm