Don't Place the Cart Before the Security Horse
Effective IT security depends first and foremost on sound secuirty policies, Dennis emphasizes. "Policies are requirements. They should be part of your broader requirements analysis."
The following policies should be "implicit," Dennis says:
However, policies alone, of course, are not enough. "Policy docs don't implement. The map is not the terrain," cautions Dennis.
Eliminate What You Don't Need and Restrict the Rest
Dennis recommends installing from either a clean CD or an isolated LAN. Services that aren't needed should be eliminated. Even if you do need a service, you should place appropriate restrictions on its use.
Here's how to disable Linux services, according to Dennis:
You can restrict access in several ways: