All security standards and Corporate Governance Compliance Policies such as PCI DSS, GCSx CoCo, SOX (Sarbanes Oxley), NERC CIP, HIPAA, HITECH, GLBA, ISO27000 and FISMA require devices such as PCs, Windows Servers, Unix Servers, network devices such as firewalls, Intrusion Protection Systems (IPS) and routers to be secure in order that they protect confidential data secure.
There are a number of buzzwords being used in this area – Security Vulnerabilities and Device Hardening? ‘Hardening’ a device requires known security ‘vulnerabilities’ to be eliminated or mitigated. A vulnerability is any weakness or flaw in the software design, implementation or administration of a system that provides a mechanism for a threat to exploit the weakness of a system or process. There are two main areas to address in order to eliminate security vulnerabilities – configuration settings and software flaws in program and operating system files. Eliminating vulnerabilites will require either ‘remediation’ – typically a software upgrade or patch for program or OS files – or ‘mitigation’ – a configuration settings change. Hardening is required equally for servers, workstations and network devices such as firewalls, switches and routers.
Article Source: http://EzineArticles.com/4995769