FDIC insures its systems

The Federal Deposit Insurance Corp. uses Microsoft's Systems Management Server (SMS) to keep patches current on its Windows desktop PCs and servers, but administrators wanted a second opinion about the status of those computers.

'Security is about layers,' said Sanjeev Purohit, assistant director of operations at FDIC's information technology division.

SMS ' like all things Microsoft ' has its detractors, who say it is not reliable in pushing patches and reporting the status of managed machines. The IT division had no reason to doubt SMS, but the agency's mission is, after all, security and accountability.

'Like everything else we do, we wanted to make sure,' said senior IT specialist Mark Krolicki. 'Trust but verify. We wanted to find something that was independent.'

The agency settled about three years ago on the NetChk Protect scanner from Shavlik Technologies to provide a second look because the inspector general's office was going to use that product for system audits.

'We got it so we could be on the same page as they were, with all of us talking the same language,' Krolicki said.

The results so far have been positive, Krolicki said. 'The Shavlik product pretty much confirmed what SMS was telling us.' But additionally, 'it has been helpful in ways we hadn't thought about.'

'SMS did not miss things,' Purohit agreed.

However, there are components of the IT system not managed under SMS and applications that are not part of the routine patch maintenance schedule. Shavlik not only verifies SMS performance but also points out when other devices and programs need attention.

'Between both products, it provides us with a holistic view we can manage devices with,' Krolicki said.

Join the crowd

FDIC is not unique in its desire for independent verification of its IT security posture. As the Office of Management and Budget issues security requirements and the National Institute of Standards and Technology develops the standards for implementing them, IT audits are becoming important tools for maintaining information security baselines.

The introduction by OMB of the Federal Desktop Core Configuration (FDCC) for Windows XP and Vista operating systems is opening even more doors for security verification and compliance vendors.

'The way federal agencies are being audited has changed,' said Chris Schwartzbauer, Shavlik's vice president of field operations. Agencies now are adopting NetChk Compliance to manage software configuration.

FDIC just started using NetChk Compliance, Purohit said. 'We are planning to use it with the FDCC.'

The Protect and Compliance tools are scanners that examine the status of networked devices, either from a central location or through agent software placed on the device. The Compliance product comes with a selection of templates based on various configuration standards that can be scanned against, or users can build their own policies. Out-of-the-box templates include Sarbanes-Oxley requirements for the private sector and Federal Information Security Management Act requirements for the government sector. FDCC is essentially a subset of FISMA, Schwartzbauer said.

The NetChk tools operate in three modes.

In one, an agent can be used to monitor, report on and manage the status of the device on which it is installed. In another, a distributed policy manager acts as an agent that manages a number of devices remotely. And in the third mode, the Central Policy Server works without agents, scanning and managing as many as hundreds of thousands of devices from a central point on the network.

The mode used depends on the number of devices being managed, how they are distributed geographically, the topology of the network and the bandwidth available.

FDIC uses the Central Policy Server. 'Our preference is always to go agentless,' Purohit said. 'We try to automate and look at things centrally.'

FDIC has a distributed but not extremely large IT environment with 5,000 users in 90 offices nationwide. Small offices have 1.5 megabits/sec T1 lines; larger regional offices have 45 megabits/sec DS3 connections.

'We have so many agents everywhere already,' Krolicki said. 'That is just one more piece of overhead to worry about, another piece of software to deploy and another management point.' It doesn't hurt to get a second opinion, especially for network scanning products that focus on patch and configuration management. These tools can be useful additions to your toolkit when you are trying to pass an information technology security audit.

"You need to have multiple tools so you can have checks and balances in place," said Sanjeev Purohit, assistant operations director of the Federal Deposit Insurance Corp.'s technology division. "No one tool can do everything.'

A second opinion can also be helpful in selecting the proper tool.

"Take the product for a test drive and talk to people who are using it," said Mark Krolicki, FDIC senior IT specialist. "And don't believe every trade magazine you read.'

A key factor in FDIC's selection of NetChk products from Shavlik Technologies is that auditors and its own inspector general also use the tools. That lets the agency and the auditors discuss audit results in the same language and confirm corrections when shortcomings are found, Krolicki said.