ZENworks® ESM 3.5 Administrator’s Manual 68
Securing Server Access
Physical Access Control
Physical access to the CLAS Server should be controlled to prevent access by unauthorized
parties. Measures taken should be appropriate to the risks involved. There are multiple available
standards and guidelines available, including NIST recommendations, HIPAA requirements, ISO/
IEC 17799, and less formal collections of recommendations such as CISSP or SANS guidelines.
Even when a given regulatory frameworks is not applicable, it may still act as a valuable resource
and planning guide.
Likewise, Disaster Recovery and Business Continuity mechanisms to protect the CLAS Server
should be put in place to protect the server if an organizational risk assessment identifies a need
for such steps. This is very simple to do, as the vast majority of the CLAS server configuration is
generated by the default install process, and all that needs to be backed up (and protected
appropriately) is the private key used for the cryptographic challenge-response mechanism. With
this key, the CLAS server can be recreated from the readily-available install files.
Network Access Control
The CLAS Server should be further protected from unauthorized access by restricting network
access to it. At a minimum, it is critical to the functionality of CLAS that network access to the
CLAS server be restricted to hosts that reside on the location-defining network. To repeat, there
should be no connectivity whatsoever to the CLAS server from devices which are not already in
the policy-defined network location that CLAS is providing location assurance for, and any
deviation from this requirement negates all assurance value of CLAS.
Furthermore, network access restrictions should include:
3. all incoming connection attempts should be restricted to HTTP over port 80; and
4. no outgoing connection attempts should be allowed.
All these measures can be imposed through the use of standard firewall technology.
High Availability
High Availability mechanisms for the CLAS Server are strongly recommended. There are
multiple alternative mechanisms for building high availability solutions, ranging from the general
(DNS round-robining, layer 3 switches, etc.) to the vendor specific (the Microsoft web site has
multiple resources on high availability web services). Those implementing and maintaining an
ESM solution should determine which class of high availability solution is most appropriate for
their context.
