Instructor: Recovery Actions. 2 2
In this lesson, we are going to talk about the four main types 3 3
of recovery actions. 4 4
These include things like patching, permissions, 5 5
logging, and system hardening. 6 6
When we talk about patching, 7 7
this involves installing a set of changes 8 8
to a computer program or it's supporting data 9 9
that's designed to update it, fix it, and improve it. 10 10
Now, when we deal with patching, 11 11
this is something that is commonly done 12 12
in our organizations. 13 13
One of the most common mantras inside of IT 14 14
is scan, patch, scan. 15 15
And what that means is, 16 16
we're going to scan our network for vulnerabilities. 17 17
We're going to find all those things that are unpatched 18 18
and patch them. 19 19
That means getting all those security updates in place, 20 20
and then we're going to scan again to make sure 21 21
that all those patches actually took place. 22 22
This is actually a big problem, 23 23
because when you push out a patch to thousands of computers 24 24
across your network, 25 25
there's a chance that a couple of them 26 26
may not have installed that patch correctly. 27 27
And so if you don't scan again afterwards 28 28
to find out if that patch 29 29
was actually successfully installed, 30 30
this can be a big issue for you. 31 31
Additionally, if you're dealing with something 32 32
that wasn't a zero-day attack, 33 33
that means there was probably a patch available for it. 34 34
And so if somebody got into your system, 35 35
it's most likely because you didn't have a patch 36 36
applied to that system. 37 37
And so patching is the number one thing 38 38
we have to think about inside of recovery. 39 39
After we patch that system, 40 40
we also want to make sure we look at 41 41
our different mitigating controls 42 42
and our different processes 43 43
to figure out why that patch wasn't already installed. 44 44
The second thing we want to think about is permissions. 45 45
There are all types of permissions that need to be reviewed 46 46
and reinforced after an incident. 47 47
For example, one of the most common things 48 48
that people will do is have a mass password change. 49 49
They'll ask everybody to go forward 50 50
and change their passwords. 51 51
Now this is a good security practice 52 52
because those passwords may have been compromised 53 53
as part of the breach, 54 54
but it's also something dangerous 55 55
because every time you have people change their passwords, 56 56
a lot of people will simply write down their passwords 57 57
and that gives another intrusion vector 58 58
that is possible for somebody to steal their password 59 59
and be able to use it to log into the systems. 60 60
In addition to that, 61 61
you also want to check your firewall ACL 62 62
and your different file systems 63 63
and system privileges to make sure all of those permissions 64 64
are set properly 65 65
and make sure that people aren't getting into your network 66 66
by using incorrect permissions. 67 67
The third area is logging. 68 68
One of the things we want to do is verify 69 69
the logging of our communication 70 70
to our security monitoring hardware. 71 71
This ensures that the scanning 72 72
and monitoring and log retrieval systems 73 73
are all functioning properly following the incident. 74 74
A lot of times, when a bad guy gets into your network, 75 75
they will turn off the logging capabilities, 76 76
and you want to make sure all that stuff is back on 77 77
because that's important for you 78 78
to be able to hunt down those attackers 79 79
and detect future attacks as things move forward. 80 80
In addition to that, you want to make sure 81 81
that your logs are all being audited and looked at 82 82
to make sure they haven't been modified by an attacker 83 83
and that you're ready to be able to analyze them again. 84 84
The fourth recovery action we have is system hardening, 85 85
and this one is also very important. 86 86
System hardening is the process 87 87
of securing a systems configuration 88 88
and settings to reduce IT vulnerabilities 89 89
and the possibility of being compromised. 90 90
As we're dealing with system hardening, 91 91
we're going to make sure that we are doing it 92 92
because hardening is one of the most effective things 93 93
we can do as a preventative measure 94 94
when designing our system security. 95 95
We want to make sure we're doing all this 96 96
before there's an incident, 97 97
but if we have an incident, 98 98
that means we must have missed something. 99 99
And so now it's important to go back and harden again. 100 100
Now when you start dealing with all of these things, 101 101
what are the kind of actions 102 102
that you need to be performing 103 103
when conducting system hardening? 104 104
Well, there's a lot of them. 105 105
We can start out by deactivating unnecessary components. 106 106
If there's hardware or software 107 107
or network ports or operating system processes 108 108
and services or any applications that you're not using, 109 109
go ahead and turn them off and disable them. 110 110
Something that is there and open or installed 111 111
can be a vulnerability, 112 112
so if you don't need it, go ahead and remove it. 113 113
The second thing, we want to disable any unused user accounts. 114 114
Again, this is a vulnerable area for us. 115 115
If we have default system accounts like guests or admin, 116 116
those should be disabled if nobody's using them. 117 117
Every account that's there on your system 118 118
is a potential intrusion vector, 119 119
so we want to make sure we're disabling 120 120
anything that's not being used. 121 121
And this goes for your user accounts as well. 122 122
If you have a user who's been away for more than 30 days, 123 123
go ahead and disable that account. 124 124
When they come back, you can turn it back on. 125 125
Our third thing we want to think about 126 126
is how we're going to implement patch management. 127 127
Again, I mentioned this before, 128 128
part of system hardening is patching bugs. 129 129
And so if we have a good patching program in place, 130 130
we want to make sure patch management is part of that 131 131
throughout all of our systems 132 132
as part of a good vulnerability mitigation program 133 133
with our systems. 134 134
Our fourth thing we want to consider 135 135
is how we're going to restrict host access 136 136
to different peripherals. 137 137
How are we going to make sure that people aren't using USB 138 138
or Bluetooth as an attack vector? 139 139
This, again, is something we need to think about, 140 140
and if we don't need those things for a business case, 141 141
we can go ahead and disable them. 142 142
Going back to our first step, right? 143 143
Deactivating unnecessary components. 144 144
Our fifth and final thing we want to consider 145 145
is how we're going to restrict shell commands. 146 146
Now, shell commands are issued through the command shell 147 147
and these should be disabled for most users on your system 148 148
except your administrators. 149 149
If nobody has a valid business case 150 150
of why they need command line access, 151 151
go ahead and shut that down. 152 152
That's just one more attack vector that we can harden 153 153
and shut down and keep away from the attackers. 154 154
Now, to summarize all of this, 155 155
I really have three simple mottos for system hardening, 156 156
and if you keep these in mind during your exam, 157 157
you're going to do well because you can always think, 158 158
"Should I get rid of this? 159 159
Should I block this? 160 160
Should I use this mitigation?" 161 161
And if it's one of these three mottos, you probably should. 162 162
The first one is uninstall anything you aren't using, 163 163
that includes hardware, software, programs, 164 164
anything like that. 165 165
If you don't need it, uninstall it, 166 166
because it's just an intrusion vector. 167 167
Second, if you need it, make sure you patch it frequently. 168 168
Again, scan, patch, scan. 169 169
You're going to scan your network, 170 170
find the vulnerabilities, patch those vulnerabilities, 171 171
and then scan again to see what vulnerabilities remain. 172 172
And finally, my third motto, 173 173
always restrict users to the least privilege. 174 174
Again, if you can't turn it off and you can't patch it, 175 175
you want to make sure you restrict it 176 176
and you mitigate that risk. 177 177
And one of those things is your users. 178 178
Users do a lot of stupid things in our networks, 179 179
but if we restrict them to the least privilege, 180 180
we can limit the damage they can do. 181 181
So keep those three mottos in mind 182 182
and you'll do well on the exam.