Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 03/17/08 issue

FDIC insures its systems

Agency uses software scanners to verify IT security posture, manage devices

By William Jackson

Story Tools:

  • Purchase a Reprint
  • Link to this page
The Federal Deposit Insurance Corp. uses Microsoft’s Systems Management Server (SMS) to keep patches current on its Windows desktop PCs and servers, but administrators wanted a second opinion about the status of those computers.

“Security is about layers,” said Sanjeev Purohit, assistant director of operations at FDIC’s information technology division.

SMS — like all things Microsoft — has its detractors, who say it is not reliable in pushing patches and reporting the status of managed machines. The IT division had no reason to doubt SMS, but the agency’s mission is, after all, security and accountability.

“Like everything else we do, we wanted to make sure,” said senior IT specialist Mark Krolicki. “Trust but verify. We wanted to find something that was independent.”

The agency settled about three years ago on the NetChk Protect scanner from Shavlik Technologies to provide a second look because the inspector general’s office was going to use that product for system audits.

“We got it so we could be on the same page as they were, with all of us talking the same language,” Krolicki said.

The results so far have been positive, Krolicki said. “The Shavlik product pretty much confirmed what SMS was telling us.” But additionally, “it has been helpful in ways we hadn’t thought about.”

“SMS did not miss things,” Purohit agreed.

However, there are components of the IT system not managed under SMS and applications that are not part of the routine patch maintenance schedule. Shavlik not only verifies SMS performance but also points out when other devices and programs need attention.

“Between both products, it provides us with a holistic view we can manage devices with,” Krolicki said.

Join the crowd

FDIC is not unique in its desire for independent verification of its IT security posture. As the Office of Management and Budget issues security requirements and the National Institute of Standards and Technology develops the standards for implementing them, IT audits are becoming important tools for maintaining information security baselines.

The introduction by OMB of the Federal Desktop Core Configuration (FDCC) for Windows XP and Vista operating systems is opening even more doors for security verification and compliance vendors.

“The way federal agencies are being audited has changed,” said Chris Schwartzbauer, Shavlik’s vice president of field operations. Agencies now are adopting NetChk Compliance to manage software configuration.

FDIC just started using NetChk Compliance, Purohit said. “We are planning to use it with the FDCC.”

The Protect and Compliance tools are scanners that examine the status of networked devices, either from a central location or through agent software placed on the device. The Compliance product comes with a selection of templates based on various configuration standards that can be scanned against, or users can build their own policies. Out-of-the-box templates include Sarbanes-Oxley requirements for the private sector and Federal Information Security Management Act requirements for the government sector. FDCC is essentially a subset of FISMA, Schwartzbauer said.

The NetChk tools operate in three modes.

In one, an agent can be used to monitor, report on and manage the status of the device on which it is installed. In another, a distributed policy manager acts as an agent that manages a number of devices remotely. And in the third mode, the Central Policy Server works without agents, scanning and managing as many as hundreds of thousands of devices from a central point on the network.

The mode used depends on the number of devices being managed, how they are distributed geographically, the topology of the network and the bandwidth available.

FDIC uses the Central Policy Server. “Our preference is always to go agentless,” Purohit said. “We try to automate and look at things centrally.”

FDIC has a distributed but not extremely large IT environment with 5,000 users in 90 offices nationwide. Small offices have 1.5 megabits/sec T1 lines; larger regional offices have 45 megabits/sec DS3 connections.

“We have so many agents everywhere already,” Krolicki said. “That is just one more piece of overhead to worry about, another piece of software to deploy and another management point.”
1 2 >> Next

More news on related topics: Communications / Networks, IT Security, IT Management, Software Applications