Re: Security Checklist

[Sebastien MAHIEUX <sebastien.mahieux () gmail com>]

Dear J,
> I think the best way to have a global overview of your infrastructure if to implement a monitoring solution.
> For example nagios, zenoss, cacti and use snmp, and wmi to query your servers, routers, switches.
> Be notify by mail or phone before your starting day would be very efficient.
> Otherwise, if you want to check specifically you apache server, you can modify in your httpd.conf the logs file for 
> each kind of events (access, logs, etc)
> For your windows, you have to view your event manager (application / security / system). You can aggregate your event 
> manager through zenoss too and be notify for every error in your log.
> The monitoring platform is a global approach and project you have to do.
> If you need further details to implement a solution, feel free to reach me bye email.
>
> Regards.
> Sebastien.
>
> 2009/5/4 James Attard <james.attard () gmail com>
> > Dear list,
> >
> > I need some help to build up a security checklist for my company
> > running mainly windows operating systems, apache webservers, and
> > checkpoint firewall. What I have in mind is that everyday I dedicate
> > not more than 1 hour and I look at this checklist and see whether the
> > health status from a security point of view of the whole IT
> > infrastructure is OK. What should I be looking at? What logs do I need
> > to generate if they don't exist, and what information patterns should
> > I look at in the Apache logs/Windows logviewers? Do I need some
> > software to help me aggregate and process all this information?
> >
> > Regards,
> > J
> >
> > ------------------------------------------------------------------------
> > This list is sponsored by: InfoSec Institute
> >
> > Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class.
> > Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified 
> > Penetration Tester exams, taught by an expert with years of real pen testing experience.
> >
> > http://www.infosecinstitute.com/courses/ethical_hacking_training.html
> > ------------------------------------------------------------------------

------------------------------------------------------------------------
This list is sponsored by: InfoSec Institute

Learn all of the latest penetration testing techniques in InfoSec Institute's Ethical Hacking class. 
Totally hands-on course with evening Capture The Flag (CTF) exercises, Certified Ethical Hacker and Certified 
Penetration Tester exams, taught by an expert with years of real pen testing experience.

http://www.infosecinstitute.com/courses/ethical_hacking_training.html
------------------------------------------------------------------------