WHAT IS A SERVER?

In computing, a server is a piece of computer hardware or software that provides functionality for other programs or devices, called “clients”. This architecture is called the client–server model.

A server is a computer connected to a network of other workstations called ‘clients’. Client computers request information from the server over the network.

Servers tend to have more storage, memory and processing power than a normal workstation. 

How a server functions depends on the type of network it is on. Let’s dive into a few different types of networks and how servers interact with them.

WHAT ARE THE USES OF A SERVER?

The main and important function of a server is to listen in on a port for incoming network requests, and a good demonstration of this is the interaction between a Web server and browser.

WHAT IS REMEDIATION SERVER?

Remediation Servers

Remediation servers are the subset of your intranet that noncompliant NAP clients can access when you configure your health requirement policies to enforce limited access. The remediation servers include network infrastructure servers and health update servers. The noncompliant NAP client uses these servers or the resources on these servers to perform remediation, either automatically or manually. It is also possible to configure your health requirement policies to enforce limited access for non-NAP-capable clients.

Remediation servers are not required if you are using reporting mode. In reporting mode you are not limiting the access of noncompliant NAP clients.

Remediating servers

Remediation is the process of downloading the payload for patches determined to be missing on one or more target servers and then applying that payload to the identified target servers to bring each one up to the required level.

Setting up and configuring a remediation server

Network Access Control (NAC) requires a remediation server to repair vulnerable or infected devices. The remediation server is where a device whose posture is determined to be unhealthy is sent to be remediated (repaired) so that it can meet the compliance rules you’ve configured for a healthy status.

The remediation server is where you publish remediation resources, such as the security clients that scan for vulnerabilities and other security risks on devices, patch files, and the HTML pages that appear on devices providing options for remediation or limited network access.

Remediation server prerequisites

The machine you want to set up as a remediation server must meet the following system requirements:

• The remediation server can be any type of Web server, such as IIS on Windows, or Apache on Linux.
• You must create a Web share on the remediation server that has anonymous access with read and browse rights enabled. For detailed instructions

Determining server location on the network

You should comply with the following guidelines when deciding the location of the remediation server on your network.

• The remediation server can be placed on either side of the router.
• If you choose to have it on the client side of the router, then it will be more secure because you don’t have to make any exceptions in your router rules, but you will have to manually walk all the remediation files to the machine each time you change them.
• If you put it on the opposite side of the router, then you have a potential security risk since quarantine machines are accessing a machine on your network, but you can push remediation files to the machine without having to walk them there.
• The remediation server must be visible from the remediation VLAN.
• You can have more than one remediation server on your network.

You can see diagrams showing component location and process workflow for LANDesk 802.1X NAC in the overview section.

Creating and configuring a Web share on the remediation server

This procedure has been automated for you with a script located on the core server that you run from the machine you want to set up as a remediation server.

The Web share that is created on the remediation server acts as a storage area for the patch executable files that are used to remediate vulnerabilities on affected devices. When you publish Infrastructure files or remediation resources (i.e., security client, patch files, and HTML files from the core server), those files are copied to this Web share.

NOTE: The name of the Web share must be LDLogon. You can create this share anywhere on the Web server. A typical path would be: C:\Inetpub\wwwroot\LDLogon. However, you can create the share at any path as long as the URL redirect is configured to go to: http://servername/LDLogon.

After running the script to create and configure the Web share, you must then add the remediation server in the console and specify the path to the share console. This ensures that the core server publishes remediation resources to the correct location on the remediation server.

To run the remediation server configuration script

1. From the machine you want to set up as the remediation server, map a drive to your core server’s LDMain\Install\TrustedAccess\RemediationServer folder.
2. Double-click the CONFIGURE.REMEDIATION.SERVER.VBS setup script.

The remediation server configuration script automatically configures the server to perform remediation by:

• Creating a Web share named LDLogon (typically) at: c:\inetpub\wwwroot\LDLogon.
• Enabling anonymous access to the LDLogon share with Read, Write, and Browse rights.
• Adding a new MIME type for .lrd files, and setting it to application/octet-stream (application/binary).

NOTE: You can also use the Microsoft IIS tool to manually configure the LDLogon share’s access permissions and MIME types.

The remediation server is now ready to be added in the console.

Configuring (adding) a remediation server in the console

Once a remediation server is set up, you must configure and add it to the list of valid remediation servers in the Configure remediation servers dialog box in the console. By doing this, the remediation server is recognized on the network and can communicate properly with the other NAC components.

To configure and add remediation servers in the console

1. In the Network Access Control tool window, right-click 802.1X, and then click Configure 802.1X.
2. At the Remediation servers page, click Add. The Remediation server name and credentials dialog box displays.
   
   
3. Enter the server name or IP address of the remediation server.
4. Enter the path to the Web share (on the Web server you’re setting up as a remediation server) where you want to publish compliance files. The Web share must be named LDLogon. Compliance files are the security definition files that define your compliance security policy (i.e., the contents of the Compliance group in Patch and Compliance, as well as the required patch files that remediate detected vulnerabilities).
   
   You can enter a UNC path or a mapped drive path. A UNC path is the most reliable method because drive mappings may change (see note below). You can click the Browse button to navigate to the share you want to publish compliance files to, on the remediation server.
   
   Important: If you enter a local path or a mapped drive in the Location to copy compliance files field, the files are published either to the local machine or to the specified mapped drive on the machine where the publish action is initiated. To ensure that compliance files are published to the same location on each remediation server on the network, we recommend using a UNC path to a network share.
5. Enter a valid user name and password to access the remediation server.
6. If you’ve configured more than one remediation server, you can select a backup remediation server from the drop-down list.
7. If you want to be able to configure a remediation server on another network, for devices that move between trusted networks, generate an installation package (MSI).
8. Click OK to add this remediation server to the list.

You can now publish remediation infrastructure files to the server (as long as you’ve also configured a posture validation server and user credentials).

5 Benefits of Remediation Efforts.

 

No matter what scale of business operations your organization runs, your organization’s data assets must be protected from security threats. When a risk penetrates your organization’s security framework, it can either be eliminated from its roots or be contained to minimize losses.

Risk remediation refers to the measures taken to eliminate a threat to your organization’s data after it is identified or becomes live. It is a combination of several essential and often interdependent steps that benefit your organization in numerous ways.

Here are 5 benefits of remediation efforts in information security and compliance:

They help you contain security risks

Remediation is the way to stop information security and compliance risks from getting bigger and more harmful to your organization. In case your organization is unable to identify, remediate or mitigate a data breach, your customers’ private and sensitive data can be under attack. Remediation helps you contain the impact of a risk, and hopefully, even remove it completely.

They prevent financial losses to your organization

‘Time is money’ is a popular adage in the world of business. Perhaps one of the greatest advantages of integrating security and compliance risks with remediation is that it saves organizations a lot of time, money, and other resources. If not appropriately remediated, a cybersecurity risk could cause you to lose a lot of money through loss of business and customers’ trust as well as legal penalties.

They help you gain the trust of your customers

Remediation of risks related to information security and compliance can help you gain the confidence and trust of your customers. It tells them that you are dedicated to providing them with secure service that protects their confidential data. It makes it clear to your customers that you have a solid security plan that allows you to contain or eliminate risks even if they breach your protective barriers.

They help you better prepare for future risks

The results of your remediation efforts, whether positive or negative, are beneficial for you in the long run, too. You can analyze which remediation strategies worked for your organization, and which ones did not. They inform you about what you need to improve in your future security and compliance risk assessments and remediation strategies. You can thus design better information and compliance security policies in the future.

They can help you address cybersecurity risks in real-time

Remediation efforts are the most effective when they are acted upon in real-time. Especially because cyber risks evolve at a fast rate. Fortunately, remediation efforts can be successfully integrated with information security and compliance risks in any organization. This integration makes your remediation efforts quicker and more effective. Such effective remediation efforts help you ward off cyber risks as they present themselves to your organization in real-time.

Conclusion

Remediation is indisputably one of the most important steps in security management. The above-mentioned benefits of remediation efforts in promoting information security and compliance will help you prepare your remediation strategies more sincerely

Drop your comment