User's Manual

Solaris 9 Security CX-310-301 21
220 ultra10.example.com ESMTP Sendmail 8.12.10+Sun/8.12.9; Thu, 1 Apr
:49 +0100 (BST) 2004 18:38
expn john
250 2.1.5 John Philcox <[e-mail]>
expn testuser
550 5.1.1 testuser... User unknown
expn admin
250 2
quit
.1.5 System Administrator <[e-mail]>
221 2.0.0 ultra10.example.com closing connection
Connection to 0 closed by foreign host.
Steps to Prevent Information Disclosure
There are a number of steps that can be taken to avoid information disclosure:
¾ User education – The most important step that can be taken. Make people aware of the security
issues and methods by which attackers might try and obtain information from them that would
compromise the computer system
¾ Turn off any unnecessary network services
¾ Enforce a good password mechanism and educate users again to realize the importance of
choosing a secure password
¾ Use encryption mechanisms for data in transit between systems, especially on the Internet
¾ Implement a firewall to protect the organization and add logging to the rules so that a record exists
of persistent attempts to access an asset
¾ Enable auditing and system logging so that unauthorized attempts are recorded and the
accountability and non-repudiation is maintained
¾ Monitor the systems continuously, which might mean installing a third-party product so that the
administrator is automatically informed when events occur – products such as Sun Management
Center, HP Openview, BMC Patrol, eTrust from Computer Associates are good examples
Evaluation Standards
The National Computer Security Center published a book called “The U.S. Department of Defense Trusted
Computer System Evaluation Criteria”, better known as “The Orange Book” which defined seven levels of
trust. The levels from lowest to highest are:
¾ D – Minimal protection
¾ C1 – Some access control and permissions. Passwords required for logon
¾ C2 – Authentication is audited and audit logs are held securely
¾ B1 – Mandatory access control with labels. Security access is based on labels