© S A N S I n s t i t u t e 2 0 0 4 , A u t h o r r e t a i n s f u l l r i g h t s .
Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46
© SANS Institute 2004,As part of GIAC practical repository.Author retains full rights.
Microsoft’s (MS) Windows Operating System software has repeatedly proved tobe less than optimal with regards to security, especially over the last two years. Due tocontinued vulnerabilities in MS software and the addition of network services, a networkconnected to the Internet was audited for an acceptable level of risk. The auditrevealed several areas of unacceptable risk that needed immediate remediation andother areas that needed improvement over the longer term. A plan was developed to reduce the risk of the network and to the data thatresides on the systems. Over the period of several months during 2003 the networkwas migrated from a variety of Microsoft OSes and software to a mixture of OpenBSD,third party software and current versions of Windows. An examination of the networkafter the implementation of OpenBSD and other software proved to increase the overallsecurity of the system in the perimeter, the services provided to internal and externalclients, data integrity, system/data availability, and auditing. An informal security policywas put into place to ensure that the system did not lapse into an unsatisfactory state inthe future.