October 25. Server Security: Protecting Your Digital Core

For most organisations, servers are the undisputed backbone of their IT infrastructure. They house critical applications, store vast amounts of sensitive data (customer information, intellectual property, financial records), and power essential services. Consequently, servers are prime targets for cyber attackers, making robust server security an absolute necessity, not an option. A compromise of even one critical server can bring an entire operation to its knees.

Key Points for Server Security:

1. Strong Access Controls and Multi-Factor Authentication (MFA):

   • Least Privilege: Ensure users and applications only have the minimum necessary access to server resources.

   • MFA for All Admin Accounts: Enforce MFA for anyone logging into servers, especially administrative accounts, which are highly attractive targets.

   • Regular Review: Periodically review server access lists and revoke permissions for inactive or changed roles.

2. Regular Patching and Updates:

   • Operating Systems (OS): Keep server OS (Windows Server, Linux distributions) fully patched with the latest security updates.

   • Applications and Services: Update all software running on the servers (databases, web servers, middleware).

   • Automated Patch Management: Implement a system to automate and manage patching across all servers.

3. Robust Firewall Configuration:

   • Network Segmentation: Place servers on isolated network segments (VLANs) behind robust firewalls, limiting external and internal access.

   • Strict Rules: Configure firewalls to allow only absolutely necessary inbound and outbound traffic to and from servers. Close all unused ports.

4. Anti-Malware and Endpoint Detection and Response (EDR):

   • Deploy server-grade anti-malware and EDR solutions to detect and prevent malicious activity, including ransomware and sophisticated attacks.

5. Data Encryption:

   • Encryption at Rest: Encrypt data stored on server hard drives.

   • Encryption in Transit: Ensure data transferred to and from servers (e.g., via HTTPS, SFTP, VPNs) is encrypted.

6. Logging and Monitoring:

   • Comprehensive Logging: Enable detailed logging on servers, applications, and network devices.

   • Centralised Logging and SIEM: Collect all logs into a Security Information and Event Management (SIEM) system for centralised analysis, correlation, and real-time alerting on suspicious activity.

   • Regular Review: Actively review server logs for anomalies.

7. Regular Backups:

   • Criticality: Back up all server data and configurations regularly, testing recovery procedures often. Ensure backups are isolated and protected from the main network to prevent ransomware from encrypting them.

8. Physical Security:

   • Secure server rooms with restricted access, surveillance, and environmental controls.

9. Vulnerability Management and Penetration Testing:

   • Conduct regular vulnerability scans and penetration tests against your servers to identify and fix weaknesses before attackers do.

Treating your servers as highly sensitive and critical assets, and implementing these layers of security, is paramount to maintaining the integrity, availability, and confidentiality of your organisation's most valuable digital resources.

💡Today's Cyber Tip: Server access review

Today, think about the physical security of your server room or network cabinets. Ensure it's locked, access is restricted to authorised personnel only, and visitors are escorted. Don't overlook the basics – a physical breach can be just as damaging as a digital one!

Physical checks and location are equally as important as systems access controls. 

🔐Consider where the location of your server is and who else has access to that location? 
🔐Is there a risk of tampering from an external threat?
🔐Is there risk of accidental damage or tampering?
🔐Who has access to the area and what other things are stored there?

Does the organisation have a  document DPE Model Physical Security Policy(179 KB) ?

Review the DfE Servers and Storage Standards for Schools and Colleges which advises that servers and related storage platforms must be secure and follow data protection legislation - they must be 'secure by design'. We can provide support, guidance and trackers to assess where you are now and your progress:https://digitalstandardstracker.co.uk/ 

Consider having your anti-virus software prevent the use of USB sticks in the organisation.

Review: NCSC Server Advice

Review DPE's previous articles about server security: 
{article title="How secure is your server?"}[link][title][/link]
[readmore]{/article}
{article title="Keeping your IT systems safe and secure"}[link][title][/link]
[readmore]{/article}

We can come and review your server location as part of our data walks (Making the Rounds), which will give you an indication  of whether you are meeting the DfE Servers and Storage Standard.

DPE Knowledge Bank Guidance and Support:

For schools and colleges, six of the DfE Digital Standards are now mandatory. We have a DfE Digital Standards Tracker tool help you track your cyber resilience and your progress: 

   

Review our Cyber Security Best Practice Area for micro learning, support, guidance and policies:

Cyber Security Best Practice Area

Why not have a look at our 'specialist' trainer Harry the Hacker :