Changing Default Configurations

Default configurations are usually made for easy setup, not security.

1. Default Passwords: Choose a long, strong, unique password. Rotate administrative password once every 90 days. Use Multi-Factor Authentication.
2. Disable unneeded ports and protocols: Shift services from insecure to secure ones (e.g., HTTP to HTTPS, SMTP to SMTPS).
3. Check for any open ports on the devices.

Restricting Applications

Least Functionality: Process of configuring a workstation or server with only essential applications and services for the user.

Secure Baseline Image

Secure Baseline Image: Standardized workstation setup (Operating System, essential applications, and strict policies). Especially useful for larger networks.

Restricting Apps

• Allowlisting: Security measure that permits only approved applications to run on an Operating System. More secure, harder to manage.
• Blacklisting: Entails preventing listed applications from running, allows all others to execute. Less secure, easier to manage.

Unnecessary Services

Background applications that operate within the Operating System, executing a range of tasks.

Trusted Operating Systems (ToS)

Designed to provide a secure computing environment by enforcing stringent security policies. Usually relies on: Mandatory Access Control (MAC), Security Auditing, Role-based Access Control. Often uses microkernels to minimize the trusted base to reduce the attack surface.

Evaluation Assurance Level (EAL): Based on a set of predefined security standard and certification from the Common Criteria for Information Technology Security Evaluation.

SELinux (Security-Enhanced Linux)

Set of controls installed on top of another Linux distribution. Implements MAC in the Linux kernel.

Trusted Solaris

Offers secure, multi-level operations with MAC, detailed system audits, and data/process compartmentalization.

Updates and Patches

Patch management can be manual or automated.

• Hotfix: Software patch that solves a security issue and should be applied immediately after being tested in a lab environment.
• Update: Provides system with additional functionality, but usually does not provide any patching of security related issues.
• Service Pack: Includes all hotfixes and updates since release of the operating system.

Patch Management

Planning, testing, implementing, and auditing of software patches. Do not forget firmware!

1. Planning: Creating policies, procedures, and systems to verify patch compatibility.
2. Testing
3. Implementation

Patch Rings: Strategy where you deploy in rings; e.g.,

• Ring 1: Deploy to 10-20 workstations
• Ring 2: Deploy to service desk
• Ring 3: Deploy to everyone

Group Policies

Set of rules or policies that can be applied to a set of users or computer accounts in an Operating System. Used to create secure baseline as party of the larger configuration management program.

SELinux

Mandatory Access Control: System-enforced access control mechanisms based on subject clearance and object labels.

Context-Based Permissions: Permission schemes that are defined by various properties for a given file or process.

Discretionary Access Control (DAC): Each object has a list of entities that are allowed to access it.

SELinux: Uses context-based permission scheme. Used to enforce MAC on process and resources, enabling information to be classified and protected.

Data Encryption Levels

Process of converting data into a secret code to prevent unauthorized access.

Levels:

• Full-disk: Encrypts entire hard drive to protect all data stored on it.
• Partition: Only applies to specific partition on the storage device.
• Volume: Encrypts a set space on the storage medium; creating an encrypted container that can house various files and folders.
• File: used to encrypt an individual file.
• Database: Secure entire database.
• Record: used to encrypt individual records or rows within a database.

Secure Baselines

Standard security configuration applied to guarantee minimum security for a system, network, or application.

Stages:

1. Establish a security baseline.
2. Deploy secure baselines across all assets.
3. Maintain secure baseline on all assets.