NIST guidance on securing OS, WiFi, servers
Connecting state and local government leaders
The National Institute of Standards and Technology has revised its guidelines for securing Windows XP and also is releasing a beta version of a database of security baseline settings for a variety of Microsoft products specified in the Federal Desktop Core Configuration.
The National Institute of Standards and Technology has revised its guidelines for securing Windows XP and also is releasing a beta version of a database of security baseline settings for a variety of Microsoft products specified in the Federal Desktop Core Configuration.'The database allows interested parties to view security settings by baseline or by policy (e.g., FDCC) as well as to compare baselines to each other,' NIST said.The beta is intended to supplement the revision of , titled 'Guidance for Securing Microsoft Windows XP Systems for IT Professionals,' which is being released in draft for public comment.NIST also is releasing a revision of , titled 'Guide to Securing Legacy IEEE 802.11 Wireless Networks,' which updates the original recommendations published in 2002, and , 'Guide to General Server Security.'The revision of SP 800-68 offers guidance for securing Windows XP Professional systems that run Service Pack 2 or 3. It provides detailed information about that operating system's security features. The original version of the guidelines was released in 2005. The accompanying database contains security baseline settings for Windows XP, Vista, Internet Explorer 7 and Windows Firewall, which fall under the FDCC requirements.NIST is seeking comments on both of these releases. Comments on Revision 1 of the Windows XP guidelines should be with 'Comments SP 800-68' in the subject line. Comments on the database should be sent to the same address with 'Comments Security Database' in the subject line.The revision to SP 800-48 gives recommendations for securing Wi-Fi systems that cannot use the IEEE 802.11i security standard. The principal caveat of the original 2002 publication still applies in this version: 'All the vulnerabilities that exist in a conventional wired network apply to wireless technologies,' plus a host of others associated with radio communications and mobile clients.The publication warns that physical security controls are especially important in a wireless environment, and organizations should take advantage of, or at least consider, all available wireless local-area network security controls. 'A wireless networking security policy and an organization's ability to enforce compliance with it are the foundations for all other security countermeasures,' NIST said.Policy considerations should include:This document is part of a suite of wireless security publications. It complements SP 800-97, 'Establishing Wireless Robust Security Networks: A Guide to IEEE 802.11i.' And Bluetooth information and recommendations previously provided in SP 800-48 have been transferred to a separate document, NIST SP 800-121, Guide to Bluetooth Security.SP 800-123, 'Guide to General Server Security,' offers assistance in installing, configuring and maintaining secure servers, including operating systems and other software. It also addresses maintenance issues, such as patches, upgrades, security testing, log monitoring and data backup. Key guidelines include:
NIST Windows Security Baseline DatabaseSpecial Publication 800-68
SP 800-48SP 800-123
e-mailed
NIST Windows Security Baseline DatabaseSpecial Publication 800-68
SP 800-48SP 800-123
e-mailed
- Roles and responsibilities, including who is authorized and responsible for installing and configuring WLAN equipment.
- WLAN infrastructure security, including physical security requirements, acceptable use guidelines, and requirements for the use of encryption and for cryptographic key management.
- WLAN client device security, such as hardware and software configuration requirements, limits on how and when WLAN client devices may be used, and guidelines for the protection of WLAN client devices.
- WLAN security assessments, particularly the frequency and scope of assessments and the actions to be taken when rogue or misconfigured devices are identified.
- Organizations should carefully plan and address the security aspects of the deployment of a server, including the personnel and training required.
- Organizations should implement appropriate security management practices and controls when maintaining and operating a secure server, consistent with overall information security policies.
- Organizations should ensure that the server operating system is deployed, configured, and managed to meet the security requirements of the organization.
- Organizations should commit to the ongoing process of maintaining the security of servers to ensure continued security, including regular security testing data backups.
NEXT STORY: TSA to expand Registered Traveler