Get a handle on fundamental system security
Labcal Technologies’ NetPulse 2000 is a management tool that helps you assess the fundamental security of your systems and apply prepackaged or custom security solutions. The product, which operates in Windows 2000 and Windows NT 4.0 environments, targets well-documented security problems. Although this functionality certainly isn’t groundbreaking, Labcal’s approach is unique. By designing NetPulse so that administrators with basic knowledge can secure their systems with minimal effort, the company has geared NetPulse directly toward the small to midsized organization. However, NetPulse can also operate in large environments.
NetPulse’s centralized management structure lets the software scan your entire network to locate hosts. Then you can instruct NetPulse to compare your systems’ existing security policies (or lack thereof) with NetPulse’s predefined policies. (To avoid interrupting regular network activity, you can schedule scans to run when network or server activity is at a minimum.) NetPulse targets security problems that you might consider standard, including basic user, OS, network share, and C2 security compliance. Unfortunately, the product doesn’t address problems specific to Microsoft IIS, DNS, or network services. NetPulse can automatically distribute predefined or custom policies to remote systems that don’t meet the policy requirements that you set.
After NetPulse assesses your systems and applies security policies, you can instruct the software to generate a variety of security status reports. You can configure NetPulse so that it reports on your entire network, specific shares, or specific accounts. The HTML-format reports are easily printable for use in presentations.
Installation and Configuration
I installed NetPulse on my 450MHz AMD K6-2 test system, which had 192MB of RAM and Win2K Server Service Pack 1 (SP1) installed. (Labcal recommends a minimum 90MHz Pentium processor, 32MB of RAM, and 70MB of hard disk space.) The installation process was predictably straightforward and quick. One question that the software asks concerns the mode in which you want the software to operate—Administrator or Auditor. Administrator mode gives you full control to make security changes, and Auditor mode limits you to only security assessment. I chose Administrator mode. At the end of the installation, NetPulse required a reboot to effect security modifications in the registry and system files.
After the restart, NetPulse displayed a window that prompted me for the type of discovery I wanted to perform. I could choose to scan the entire network or scan only the local domain or workgroup. I chose the Local Domain/Workgroup discovery option, then started the program. As Figure 1 shows, NetPulse’s main control screen lists domains, workgroups, and systems in the left pane and displays data such as current hidden or visible network shares in the right pane. From this window, you can manage the current system and all other systems on the network. The ability to expand treeviews simplifies management—particularly when you have more than one network to monitor.
NetPulse provides a NetBIOS-based automatic-detection feature for discovering systems on your network; however, if you have a computer that doesn’t respond, you can add it manually. Simply choose Network from the menu bar and select Computer Controls, Add Computer. Then, type the name of the system to add it to the list. This manual entry is certainly handy for one-time jobs. If you want to assemble systems into more specific groups, you can use a taskbar button to switch to the Group view, in which you can create the groups you want. Sorting systems into groups can help you apply specific settings to groups of systems that have similar requirements.
After I selected the system I wanted to assess from the main screen’s left pane, I clicked Assessment, Security Polices to create a custom security policy. The six-tabbed Security Policies menu, which Figure 2 shows, contains a plethora of management options. On this menu, I set the security settings that I wanted to implement on my system. The extensive menu is fairly easy to use. However, a couple of the tabs are poorly organized, so inexperienced administrators might have trouble navigating them. After I selected my options, I clicked Validate Policy to see whether the software detected any problems or contradictions (e.g., improper auditing options, nonexpiring passwords) with my selections. If you choose not to build a custom policy, you can select one of the three preset policies—Base Template (Account Policy & Audit Policy Only), Workstation Policy, or Server Policy—from the Policy drop-down menu.
Previous
