Securing the network

To finally bring computers into conformance with your organization's security policy, you need to resolve the security problems that the policy runs identify.

Symantec ESM installs with a set of default policies. You should start by running the Phase 1 security policy on your network resources. This policy consists of the modules that check the most significant and potentially problematic security areas of a computer.

When you resolve the problems that the Phase 1 policy identifies, you can move on to the Phase 2 policy. This policy includes all of the available modules but only the key security checks in each module are enabled.

After you resolve the problems that the Phase 2 policy identifies, continue with the Phase 3 policy. This policy has three levels. You can choose the level that raises your network resources to the relaxed, moderate, or strict-level security environment.

The ESM console provides functions to help you resolve the security problems that the policy run reports. The ESM console also lets you modify the checks in the modules to exclude specific items from reports. On occasions, your modifications may affect areas of the computer that should be reported. In these instances, you can use alternative functions to fine-tune your modifications.

The following process outlines how to bring computers into conformance:

1.	Run an initial policy on agents in your network
2.	Select an agent computer that reports red level security problems.	Consider beginning with the computers that contain high-value information or are more susceptible to attack. The ESM console lists the reported security problems in the grid. Each problem has an assigned security level and score. Red messages indicate severe security problems. Yellow messages indicate moderate security problems. When you solve the red level problems on one computer, move on to another computer that reports red level problems. Continue this process until you solve all of the red level security problems on the network.
3.	Select an agent reporting yellow level security problems.	After you solve the yellow level problems on one agent computer, move on to another computer that reports yellow level problems. Continue this process until you solve all of the yellow level security problems on the network.
4.	Proceed to a stronger security policy and repeat the process.