Iowa State University IT

System Administration Best Practices

Systems, networks, and sensitive information can be compromised by malicious and inadvertent actions despite a system administrator's best efforts. By following these simple sytem administration practices, it will be easier to build a more secure system with minimal interruptions in service for users. This document provides a set of best-practices to help ensure an acceptable level of security across campus in terms of confidentiality, integrity, availability, and mutual authentication.

Throughout this document the term "server" is used to mean a combination of the hardware, operating system, network service, application software, and network connection.

Learn about your system

Define critical hosts

A critical host is a machine which, if compromised, could significantly harm the University including, but not limited to: reputation damage, interruption of a critical task, disclosure of confidential information, and legal liability. For example, any machine that may contain confidential data, medical records, payroll information, students transcripts, social security numbers, etc. "What are you trying to protect?" is a good question to ask before defining critical hosts.

Update anti-virus software

Anti-virus software is available to University faculty, staff, and students at no cost. It is important to develop appropriate virus detection and eliminate the threat for servers.

Automatic updates to anti-virus software is essential to ensure new viruses are caught in a timely systematic fashion. It is a systems administrator's responsibility to ensure anti-virus definitions are up to date.

ePolicy Orchestrator (ePO) is a tool from McAfee allowing centralized management of antivirus software. Antivirus packages for desktops and servers can be installed and updated remotely, virus definition files updated on demand, routine or emergency virus scans scheduled, and security settings adjusted from a single location. ePO works with the McAfee corporate antivirus packages as well as those from Symantec. A small software package is installed on client machines, and those clients then contact an ePO server for antivirus software and updates.

IT Services maintains a central ePO server on campus. Departments can request access to that server, and use it to maintain antivirus packages on their department-owned machines. There is no charge for this service at this time. Alternatively, the ePO software is available to departments through the ISU/McAfee site license.

For more information on ePolicy Orchestrator, including setting up a departmental site on the IT Services ePO server, contact Jeff Balvanz or Al Day.

Protect passwords

Configure only essential services

Update your systems

Protect your systems from spyware

Spyware and adware pose security, privacy and productivity risks. It is important to keep your system protected from such malicious programs and protect your servers (where possible) with appropriate anti-spyware tools.

Use a firewall

A firewall is considered a high-risk network device. It helps you govern the network traffic to and from your network, needs monitoring in real time, and serves as a primary line of defense against external threats. Make sure to document any change made to the firewall configuration.

Define secure access policy

Physically protect your servers

Ensure data security and integrity

Monitor your system

Document configurations and disaster recovery

Have a backup plan