Expose your weaknesses

The CSO's version of introspection involves searching within the data center to look for weaknesses. For this process, consider vulnerability assessment and management tools like eEye Digital Security's Retina vulnerability scanner, GFI LANguard's vulnerability scanner with patch management and security auditing, or Qualys, a relatively simple to use Web-based tool for companies that may not have security staff with relevant skills.

County Bank, a 40-branch bank based in Merced, Calif., runs an AS/400 and about 40 PC servers and uses Qualys to conduct regular scans on the servers.

"Having a tool like this is extremely important," says Charlie McClain, information security officer at County Bank. "The vulnerability picture in the Windows environment changes on a daily basis." He likes Qualys because it keeps up with those vulnerabilities, meaning he does not have to.

In addition to scanning the Windows servers daily, County Bank scans its AS/400 once a month.

Also on the market is Nessus, the open-source vulnerability scanner that is no longer included in the BackTrack CD because of kernel compatibility issues.

It's important to scan frequently. "Scan every 24 hours, looking for the silly human mistakes people make," says Ken van Wyk, founder and principal consultant at KRvW Associates, an Alexandria, Va.-based security consultancy. He says that changes in applications, configurations, servers or the network can accidentally open vulnerabilities as a side effect and need to be spotted early.

'CSI Data Center'

Vulnerability scanners are perhaps the best-known computer-forensics tools. Forensics tools range from basic log scanners to very elaborate programs that can examine the guts of your system at a deep level. The skill and technical knowledge needed to run these tools varies greatly. Serious forensics analysis is a job for experts, but just about anybody can use other simpler analysis tools, although interpretation may require special knowledge. Every CSO should have at least some basic forensics tools to use in the data center.

Perhaps the best example is the BackTrack 3 CD. The BackTrack 3 CD (www.remote-exploit.org/backtrack.html), a live CD containing a collection of open-source forensics tools. "One thing someone [who is handling data center security] should do is download BackTrack 3 CD, learn how to use it and learn how to create visibility into their network environment," says John Kindervag, a senior analyst at Forrester Research. Plug the leaks

Software that monitors the data that leaves the data center and attempts to prevent the inappropriate export of sensitive data is called data-leakage-protection software. Other names for this fairly new area are data loss prevention (DLP), information leak detection and prevention (ILDP), information leak prevention (ILP), content monitoring and filtering (CMF) or extrusion prevention system.