Ok, it sounds like we should have one more point of clarification. In our last blog post we posted about a process to follow for creating and maintaining system baselines. But after thinking about it, one more thing auditors, or administrators performing Control Self Assessments (CSAs) might want to consider what types of baselines could be gathered to comprehensively asses a system.
Some baselines an auditor might want to gather would be:
· User accounts / Group memberships
· Running services
· Installed software
· System security configurations
· Installed hardware devices
· Removable devices
· System performance
Most definitely there are more baselines than this that we might consider gathering. But this should be a good place to start on a system. Network devices or applications might want to consider other criteria, but this is a good starting point for systems.
For the rest of the year we have decided to post specific methods for gathering baselines. We want to provide practical methods and scripts for gathering information from systems. We hope they’re helpful to everyone. If you have any requests, please don’t hesitate to drop us a line and let us know!