Over the years I found the use of a logbook, either on paper or electronically an essential instrument in managing (security of) devices. They can be useful for more than just managing security but they shine during emergencies. Since most emergencies with devices involve loss of either Confidentiality, Integrity, or Availability, the use of these logbooks is highly related to security.
In some organizations the system or network administrators are the ones who are in the best position to keep them up to date and working properly, sometimes making it hard to coordinate with a different set of security people.
What should be in such a logbook ?
Hardware and configuration
IdentificationYou need to be able to identify a device should it get lost, stolen or otherwise compromised. I've found it useful for administrators who are less familiar with certain devices to still locate the right device and be able to power toggle a completely unresponsive system back to life. This information can be of great value and is easy to obtain during physical installation and initial staging.
Network(s)Information on the network connections.
FilteringFiltering used by this device such as packet filters, their configuration, how to turn them on and off and how to get a closed emergency filter installed.
Disk(s)Detailed information on disks, partitions and slices. Make sure to add what they are used for and the information needed to select the right replacement drive.
The easiest is to print out the information from the OS. E.g.:
$ sudo fdisk wd0
RAIDMake sure you have all the information to deal with raid devices you might have. As most often this is proprietary in format, giving guidance is hard. But make sure you have all information needed to replace drives, use hotspares, rebuild partity and reconfigure them in the same way as they were should the configuration information get lost.
Operating SystemThis information changes with reinstallation but stays as a while fairly static
OS patchesThis information changes a lot in modern OSes. An informational paragraph on how the patches are applied now and how they are done normally should suffice. Having a log of what was installed when is important.
ApplicationsThis section is what you installed as applications on the machine. It should include the important choices made during installation so that people coming after the installer could redo the installation in the same manner. This section must be expanded as time goes by and more applications are installed or removed.
If activation keys are used they should be copied here as well or at least clearly indicated how they can be obtained in an emergency.
Service contractsInformation on all hardware and software or other service contracts related to this machine. It should include the needed procedures, contract numbers , FAX and phone numbers, and any reference the other party will demand before they will start their service execution.
DependenciesA tricky part in larger organization to get right and it might make use of automation if you have many. Basically you want to show:
Services offeredServices the device offers. It should list what needs to be in place, how to test that the services are working, and a list of machines and/or other services depending on them. A prediction of what happens when the services are lost can be very valuable information when dealing with incidents and their needed communication.
Services usedDevices typically need a bunch of services of other machines. Having such a list with simple test to see if those services perform their intended task can be a great timesaver.
IncidentsAny incident this machine was involved in, should be documented in detail. Even simple hardware failures should be documented as they can lead to discover a trend that could indicate a problematic device and trigger a need for replacement.
ProceduresProcedures can be either detailed procedures or pointers to specifics. Remember you'll need them under stressy conditions, so make them easy to find and execute. Make sure they list when and by whom they were last actually tested.
Emergency accessHow does an authorized person not having or remembering the passwords access the system in an emergency (e.g a sealed envelope in a safe).
Check Backup statusHow do you see what backups have been made, what they contain etc.
Normal backup out of sequenceHow do you make a backup use normal means for backing up ?
Emergency backupHow do you make a backup in an emergency ?
Restore of dataHow do you restore a single file or directory ?
Restore of full systemHow do you restore a full system ?
Raid proceduresAs needed.
For additional inspiration refer to Security Consensus Operational Readiness Evaluation check lists and incident forms and
Swa Frantzen -- Section 66
Aug 15th 2006
1 decade ago