From viruses and worms to hackers and stolen notebooks, today's businesses face growing risk from digital attack. They also face increasing regulatory pressure to secure sensitive customer and third-party information.

To address these issues at the client level, it has become common practice to deploy security-hardened PC configurations, with features such as antivirus and firewall applications, VPN clients for remote access, and file encryption to protect information on lost or stolen mobile devices. To be effective, these safeguards should be backed up by automated and timely distribution of virus signatures and software security patches to all connected systems.

Even with all these precautions, however, PC security is still at risk. It can be compromised by a single security patch that fails to install properly, or an end-user who turns off a security application, downloads vulnerable software or reinstalls a failed application without appropriate patches.

Given the thousands of client devices in a typical enterprise, such occurrences are not at all uncommon and introduce an unacceptable level of risk for many businesses.

Verifying PC security configurations

To address this challenge, connected businesses should strongly consider monitoring PC security compliance on a continuous basis. Ideally, the monitoring solution should be able to see every PC on the network, including intermittently and remotely connected systems. It should also be independent of the software patching solution, to avoid potential "blind spots." For example, if patching and monitoring tools both rely on an installed software agent, a system with an absent or failed agent would remain both unpatched and undetected-an open door to potential attacks.

Fortunately, most current operating systems are equipped to support automated compliance monitoring. Since Microsoft Windows 2000, every Microsoft operating system has included Windows Management Instrumentation (WMI), a service for general platform management.

WMI is Microsoft's implementation of the Common Information Model (CIM), an industry standard regulated by the Distributed Management Task Force . Though this article focuses on WMI-based solutions, open source equivalents are available for Linux and for most flavors of UNIX. These tools can be used to establish effective compliance monitoring and enforcement in non-Windows or mixed OS environments.

WMI and its open source counterparts allow security administers to monitor virtually every aspect of a PC or server configuration, including hardware, software, services, registry, files, permissions, performance, and event data

Any platform with WMI can be controlled locally or remotely using the Windows Management Instrumentation Command-line (WMIC) interface, a scripting language included in Windows XP Professional. WMIC is easy to learn for anyone who understands basic programming and recent Microsoft operating systems.

Since it can output results in HTML format, WMIC can be used to build a system management console for all WMI-enabled systems, providing a unified interface for inventory and configuration management, software distribution, scheduling and scripted actions based on events or conditions.

It is relatively simple to write WMIC scripts for monitoring patch installation and other system parameters, such as virus signature updates and firewall configurations. For organizations that prefer not to write their own scripts, good off-the-shelf and freeware tools are available. With either approach, non-compliant systems can be quickly identified and automatically corrected.

Of course, given the complexity of an enterprise environment, no automated monitoring solution is likely to be 100 percent effective. It is therefore important to compare the security compliance database with an inventory of networked systems. Established processes should be in place to track down physical locations and responsible parties for unknown systems, so they can be quickly removed from the network or integrated into the managed environment.

Using read-only permissions to increase security

When establishing tasks and procedures for compliance monitoring and enforcement, security administrators should pay close attention to the principles of "separation of duties" and "least privilege." "Separation of duties" reduces risk by assigning components of sensitive processes to different individuals, so that all involved parties would have to collude to maliciously manipulate the process.

"Least privilege" simply means that each person is given only those access and administrative privileges required to perform his or her job. Providing additional capabilities would only increase risk without providing any associated benefit.

To support these fundamental security strategies, WMI allows read-only permissions to be assigned for specific auditing tools. This not only helps to improve operational security, but also enables centralized monitoring for business units that wish to retain control over business-critical systems.

When non-compliant systems are discovered, the business unit can be informed via email. Of course, it is important to clearly define communications, responsibilities and timeframes for correcting deficiencies, since a single vulnerable system can put the entire network at risk.

Addressing the risks of older operating systems

WMI is included as a service in the standard configuration of Windows 2000 and all later Microsoft operating systems, so there is no need to download a separate agent or configure WMI independently for platforms running these operating systems. This helps to ensure simple, comprehensive coverage in up-to-date Windows environments.

In theory, systems with older Microsoft operating systems could be monitored by installing an appropriate version of WMI. In practice, this is a labor-intensive task which offers little benefit. Microsoft no longer provides robust patching services for discontinued operating systems. The advantages of security monitoring are therefore largely negated for systems running Windows 98 or Windows NT. In most cases, these older systems should be decommissioned, or possibly upgraded if they are sufficiently powerful enough to run current operating systems and applications.

Educating the enterprise

Effective security monitoring and enforcement requires cooperation from business units and individual users. All affected organizations and individuals need to understand the nature and magnitude of the risk. It can be helpful to explain that compliance monitoring also helps to reduce configuration drift, which can increase availability and reduce disruptions.

End-users also need to understand the risks inherent in downloading software, accepting email from unfamiliar sources and altering system configurations. Security-conscious users add another important level of defense, by thwarting many attacks and by reducing the rate at which vulnerabilities emerge between scheduled compliance scans.

Security essentials

Security is a race with no clear finish line and no guaranteed solutions. However, businesses can take cost-effective steps to reduce their risk exposure. Deploying security-hardened PC configurations is one such step. Automating patch management and distribution is another. A third is automating security compliance monitoring so the PC infrastructure is no longer a black hole into which new systems and patches are inserted and then lost to view.

Thousands of widely distributed PCs and other client devices make up the new boundary of the enterprise network. By regularly monitoring configurations, and quickly fixing vulnerable systems, IT organizations can guard this boundary more effectively against a growing range of digital attacks.

Allyson Klein is initiative marketing manager for Intel Corp.'s Enterprise Platform Group.