Sysadmin > SecurityAndPentests > ITSecurityInaNutshell

IT-Security in a nutshell

Through my long career as a security professional, i am still annoyed how complex and inefficient IT-Security most of the time is. You have legal requirements, frameworks, lot of regulations and very often you have lot of people involved. Very soon I have the feeling, that we produce lot of paper and meetings, but very little 'security'.

Don't get me wrong, you need some structure and a substantial documentation, but what is the minimum of complexity that you need, to make proper IT-Security?

Some thoughts

  • IT-Security is thinking about responsibility, risks and costs.
  • IT-Security is risk management.
  • NistCSF is a good starting point as a meta framework
  • wrap a good story around all

In a nutshell

wipwipwip Work In Progress wipwipwip

The idea is to use a wiki with templates for documentation and integrate most of the needed tools in a very simple, flexible and easy adaptable form. It should give you an easy start, the necessary knowledge for the modules and the possibility to integrate your prefered tools when necessary.

What we need:
  • a wiki for documentation with easy to access the content (foswiki.org)
  • asset management
  • roles and responsibility
  • configuration management
    • IPAM
    • DNS
    • DHCP
    • git
    • ansible
  • risk analyse / threat modelling
  • monitoring
  • ids
  • logging
optional
  • multi language
  • firewall management

Screenshot 2022-06-21 at 19.26.47.png
Form the book "Informationssicherheit und Datenschutz"