• How to Harden Internet Servers
• How to put your attackers behind bars
• What is the MTU Blackhole problem? How to protect your site from it.
• Help for Ecommerce sites
• Security Best Practices Resources
• Vulnerability Checks
• Industry Self-Help Groups
• Intrusion Detection Tools and Tutorials (IDS) -- essential for fending off or catching computer criminals
• Security Tools
• How to handle cases where your network has been the victim of a malicious computer break-in

How to Harden Internet Servers:

• Windows 2003 security guide: http://go.microsoft.com/fwlink/?LinkId=14845
• Threats and Countermeasures: Security Settings in Windows Server 2003 and Windows XP http://go.microsoft.com/fwlink/?LinkId=15159
• Windows 2000 Security Hardening Guide http://www.microsoft.com/technet/security/prodtech/windows/win2khg.asp
• How to harden IIS:

• Hotfix Checker
• IIS Lockdown Tool
• URLScan

• How to Harden other Windows operating systems
• Mail servers:

• Spamcop reporting tool (must have username password) http://spamcop.net/
• Open Relay testing tool http://www.abuse.net/relay.html (must have username and password)

• Bastille Linux server security hardening script (optimized for Red Hat) http://www.bastille-linux.org/
• SANS Step By Step for NT, Linux, IDT and More.
  http://www.sansstore.org/
• Secure Shell (encrypted alternative to telnet)

• Terraterm for Windows (also get the SSH plugin for SSH terminal access to your linux boxes) http://hp.vector.co.jp/authors/VA002416/teraterm.html
• SSH plugin for TerraTerm http://www.zip.com.au/~roca/ttssh.html
  Psionics Web site. Makers of HostSentry, Portsentry and Logcheck. (MUST haves) http://www.psionic.com/

Help for Ecommerce sites

The FBI has issued a warning that over a million credit cards have been compromised by Russian gangs breaking into ecommerce sites. To keep these gangs away from your databases, please follow these simple steps (recommended by Stephen Northcutt of the SANS Institute):

Security Best Practices Resources:

• Chief Information Officers' security best practices documents
• The Center for Internet Security offers benchmarks for secure servers.
• SecurityExpressions WebScan Free Edition is a free tool for
  assessing how well computers comply with industry-standard security
  hardening policies and guidelines. http://www.securityexpressions.com/webscan

Vulnerability Checks:

• The Windows 2000 security benchmark and automated testing tools are ready as is an automated scanner for the SANS/FBI Top Twenty Internet Security Threats. They are all free and you can get them at www.cisecurity.org. The Solaris benchmark and tool is already done and is in wide use; other UNIX tools will follow shortly. The new Cisco Router security benchmark and testing tool is meeting extraordinarily positive response in testing by members of the Center for Internet Security and Cisco insiders.
• HFNetChk allows you to scan your network and
  get a list of Windows servers and the patches they are missing.
  http://archives.neohapsis.com/archives/sf/ms/2001-q4/0222.html
• Spot that hidden sniffer on your network: http://patriot.net/~carvdawg/perl.html
• SANS Institute's list of top twenty vulnerabilities
• Code Red got you down? Find out whether your Windows webserver is up to date with the IIS5 Hotfix Checking Tool
  http://www.microsoft.com/Downloads/Release.asp?ReleaseID=24168
• The Nessus free security scanner
• Cassandra: a vulnerability database service
• ICAT -- a searchable index of information on computer vulnerabilities run by the National Institute of Standards and Technology.
• WebEnforcer - it monitors known exploits that have been discovered and patched by Microsoft and partners. The tool can be found at www.hp.com/go/security.
• Wonder what that mysterious server is? Check out Nyheter's list of back doors and the ports they commonly use.

Industry Self-Help Groups:

The Information Technology Association of America is in the process of forming a consortium to share computer security technology information. Head of this effort is Donn Parker, formerly of the Stanford Research Institute and one of the first to work on computer security. http://www.itaa.org

"Scan of the Week" group seeks to identify new hacker scanner signatures: http://www.enteract.com/~lspitz/papers.html

InfraGard

InfraGard is an information sharing and analysis effort serving the interests and combining the knowledge base of a wide range of members. At its most basic level, InfraGard is a cooperative undertaking between the U.S. Government (led by the FBI and the NIPC) and an association of businesses, academic institutions, state and local law enforcement agencies, and other participants dedicated to increasing the security of United States critical infrastructures.

Security Tools

• Nmap mail list of top 50 list of security tools
• How to find rootkits on your *nix box
• SecureStack -- Free tool to prevent buffer overflows on Windows 2000
• List of commonly used ports including those used by back doors

How to handle cases where your network has been the victim of a malicious computer break-in:

• http://www.cert.org/nav/recovering.html 
• http://www.sans.org/newlook/publications/incident_handling.htm 
• http://staff.washington.edu/dittrich/talks/security/response.html 
• http://staff.washington.edu/dittrich/misc/faq/responding.faq 
• http://www.sans.org/y2k/DDoS.htm 

How to put your attackers behind bars:

• The Forensics Server Project: http://patriot.net/~carvdawg/fsproj.html
• The Focus-IH mailing list is for the discussion of forensics techniques, how and when to involve law enforcement, how to deal with criminal investigators, and any other aspect of the incident handling process.
• http://www.forensic-computing.com/archives/vind.html 
• http://www.sans.org/newlook/resources/IDFAQ/evidence_preservation.htm 
• http://www.porcupine.org/book/courses/forensics 
• http://www.forensic-computing.com/archives/fundamentals.html