Re: We Found the Vulnerabilities, so What Next ?!!

On Feb 17, 2006, at 14:50, Mansour wrote:


> I know it will be more better to use this scenario with patched
> system, but I would like to know, are we will be in an acceptable
> level without patching the system ?

What is "acceptable" depends on what you are trying to protect and  
the level of risk you're willing to accept. These are factors I don't  
know (and I don't want to know), so I can't give you an answer as  
simple as a "yes" or a "no".

Of course, securing the server to the extreme will make your life  
harder -- I did not go into chrooting apache, but that's another  
approach you could add (but then you can't stick to the RedHat RPMS  
any more, so life gets even harder). In the end, you have to find the  
correct balance between what a fully secured system should be and  
what the reality of your job allows you to do (ideally that should be  
the same thing, but I know how things can be).

One big thing missing in the steps you intend to take is that if your  
web server contains custom scripts (CGI/PHP/whatever), then you  
definitely want to audit them. You also want to filter outgoing TCP/ 
UDP connections. And have a disaster recovery plan ready.


                                    -- Renaud
_______________________________________________
Nessus mailing list
Nessus@list.nessus.org
http://mail.nessus.org/mailman/listinfo/nessus