1 1 00:00:00,750 --> 00:00:02,850 Recovery Actions. 2 2 00:00:02,850 --> 00:00:05,910 In this lesson, we are going to talk about the four main types 3 3 00:00:05,910 --> 00:00:07,590 of recovery actions. 4 4 00:00:07,590 --> 00:00:10,470 These include things like patching, permissions, 5 5 00:00:10,470 --> 00:00:12,900 logging, and system hardening. 6 6 00:00:12,900 --> 00:00:14,250 When we talk about patching, 7 7 00:00:14,250 --> 00:00:16,470 this involves installing a set of changes 8 8 00:00:16,470 --> 00:00:19,200 to a computer program or it's supporting data 9 9 00:00:19,200 --> 00:00:22,620 that's designed to update it, fix it, and improve it. 10 10 00:00:22,620 --> 00:00:24,240 Now, when we deal with patching, 11 11 00:00:24,240 --> 00:00:25,890 this is something that is commonly done 12 12 00:00:25,890 --> 00:00:27,390 in our organizations. 13 13 00:00:27,390 --> 00:00:30,270 One of the most common mantras inside of IT 14 14 00:00:30,270 --> 00:00:32,070 is scan, patch, scan. 15 15 00:00:32,070 --> 00:00:32,903 And what that means is, 16 16 00:00:32,903 --> 00:00:34,920 we're going to scan our network for vulnerabilities. 17 17 00:00:34,920 --> 00:00:36,990 We're going to find all those things that are unpatched 18 18 00:00:36,990 --> 00:00:37,950 and patch them. 19 19 00:00:37,950 --> 00:00:40,050 That means getting all those security updates in place, 20 20 00:00:40,050 --> 00:00:42,450 and then we're going to scan again to make sure 21 21 00:00:42,450 --> 00:00:45,210 that all those patches actually took place. 22 22 00:00:45,210 --> 00:00:46,440 This is actually a big problem, 23 23 00:00:46,440 --> 00:00:49,500 because when you push out a patch to thousands of computers 24 24 00:00:49,500 --> 00:00:50,700 across your network, 25 25 00:00:50,700 --> 00:00:52,320 there's a chance that a couple of them 26 26 00:00:52,320 --> 00:00:54,270 may not have installed that patch correctly. 27 27 00:00:54,270 --> 00:00:56,190 And so if you don't scan again afterwards 28 28 00:00:56,190 --> 00:00:57,390 to find out if that patch 29 29 00:00:57,390 --> 00:00:59,370 was actually successfully installed, 30 30 00:00:59,370 --> 00:01:01,350 this can be a big issue for you. 31 31 00:01:01,350 --> 00:01:03,120 Additionally, if you're dealing with something 32 32 00:01:03,120 --> 00:01:04,740 that wasn't a zero-day attack, 33 33 00:01:04,740 --> 00:01:07,140 that means there was probably a patch available for it. 34 34 00:01:07,140 --> 00:01:08,730 And so if somebody got into your system, 35 35 00:01:08,730 --> 00:01:10,860 it's most likely because you didn't have a patch 36 36 00:01:10,860 --> 00:01:12,180 applied to that system. 37 37 00:01:12,180 --> 00:01:14,160 And so patching is the number one thing 38 38 00:01:14,160 --> 00:01:16,950 we have to think about inside of recovery. 39 39 00:01:16,950 --> 00:01:18,390 After we patch that system, 40 40 00:01:18,390 --> 00:01:19,740 we also want to make sure we look at 41 41 00:01:19,740 --> 00:01:21,330 our different mitigating controls 42 42 00:01:21,330 --> 00:01:22,800 and our different processes 43 43 00:01:22,800 --> 00:01:26,040 to figure out why that patch wasn't already installed. 44 44 00:01:26,040 --> 00:01:28,500 The second thing we want to think about is permissions. 45 45 00:01:28,500 --> 00:01:31,050 There are all types of permissions that need to be reviewed 46 46 00:01:31,050 --> 00:01:33,330 and reinforced after an incident. 47 47 00:01:33,330 --> 00:01:35,250 For example, one of the most common things 48 48 00:01:35,250 --> 00:01:37,980 that people will do is have a mass password change. 49 49 00:01:37,980 --> 00:01:39,420 They'll ask everybody to go forward 50 50 00:01:39,420 --> 00:01:41,190 and change their passwords. 51 51 00:01:41,190 --> 00:01:42,990 Now this is a good security practice 52 52 00:01:42,990 --> 00:01:44,910 because those passwords may have been compromised 53 53 00:01:44,910 --> 00:01:46,230 as part of the breach, 54 54 00:01:46,230 --> 00:01:48,240 but it's also something dangerous 55 55 00:01:48,240 --> 00:01:51,180 because every time you have people change their passwords, 56 56 00:01:51,180 --> 00:01:53,400 a lot of people will simply write down their passwords 57 57 00:01:53,400 --> 00:01:55,620 and that gives another intrusion vector 58 58 00:01:55,620 --> 00:01:57,900 that is possible for somebody to steal their password 59 59 00:01:57,900 --> 00:02:00,300 and be able to use it to log into the systems. 60 60 00:02:00,300 --> 00:02:01,290 In addition to that, 61 61 00:02:01,290 --> 00:02:03,540 you also want to check your firewall ACL 62 62 00:02:03,540 --> 00:02:04,920 and your different file systems 63 63 00:02:04,920 --> 00:02:07,770 and system privileges to make sure all of those permissions 64 64 00:02:07,770 --> 00:02:09,180 are set properly 65 65 00:02:09,180 --> 00:02:11,250 and make sure that people aren't getting into your network 66 66 00:02:11,250 --> 00:02:13,410 by using incorrect permissions. 67 67 00:02:13,410 --> 00:02:15,480 The third area is logging. 68 68 00:02:15,480 --> 00:02:17,100 One of the things we want to do is verify 69 69 00:02:17,100 --> 00:02:18,810 the logging of our communication 70 70 00:02:18,810 --> 00:02:20,820 to our security monitoring hardware. 71 71 00:02:20,820 --> 00:02:22,140 This ensures that the scanning 72 72 00:02:22,140 --> 00:02:24,240 and monitoring and log retrieval systems 73 73 00:02:24,240 --> 00:02:26,970 are all functioning properly following the incident. 74 74 00:02:26,970 --> 00:02:29,640 A lot of times, when a bad guy gets into your network, 75 75 00:02:29,640 --> 00:02:31,770 they will turn off the logging capabilities, 76 76 00:02:31,770 --> 00:02:34,380 and you want to make sure all that stuff is back on 77 77 00:02:34,380 --> 00:02:35,580 because that's important for you 78 78 00:02:35,580 --> 00:02:37,110 to be able to hunt down those attackers 79 79 00:02:37,110 --> 00:02:40,290 and detect future attacks as things move forward. 80 80 00:02:40,290 --> 00:02:42,000 In addition to that, you want to make sure 81 81 00:02:42,000 --> 00:02:44,670 that your logs are all being audited and looked at 82 82 00:02:44,670 --> 00:02:47,280 to make sure they haven't been modified by an attacker 83 83 00:02:47,280 --> 00:02:50,190 and that you're ready to be able to analyze them again. 84 84 00:02:50,190 --> 00:02:53,130 The fourth recovery action we have is system hardening, 85 85 00:02:53,130 --> 00:02:55,560 and this one is also very important. 86 86 00:02:55,560 --> 00:02:57,120 System hardening is the process 87 87 00:02:57,120 --> 00:02:58,830 of securing a systems configuration 88 88 00:02:58,830 --> 00:03:01,380 and settings to reduce IT vulnerabilities 89 89 00:03:01,380 --> 00:03:04,110 and the possibility of being compromised. 90 90 00:03:04,110 --> 00:03:05,880 As we're dealing with system hardening, 91 91 00:03:05,880 --> 00:03:07,290 we're going to make sure that we are doing it 92 92 00:03:07,290 --> 00:03:09,600 because hardening is one of the most effective things 93 93 00:03:09,600 --> 00:03:11,880 we can do as a preventative measure 94 94 00:03:11,880 --> 00:03:14,100 when designing our system security. 95 95 00:03:14,100 --> 00:03:15,840 We want to make sure we're doing all this 96 96 00:03:15,840 --> 00:03:17,310 before there's an incident, 97 97 00:03:17,310 --> 00:03:18,900 but if we have an incident, 98 98 00:03:18,900 --> 00:03:20,820 that means we must have missed something. 99 99 00:03:20,820 --> 00:03:23,730 And so now it's important to go back and harden again. 100 100 00:03:23,730 --> 00:03:26,100 Now when you start dealing with all of these things, 101 101 00:03:26,100 --> 00:03:27,720 what are the kind of actions 102 102 00:03:27,720 --> 00:03:29,010 that you need to be performing 103 103 00:03:29,010 --> 00:03:31,080 when conducting system hardening? 104 104 00:03:31,080 --> 00:03:32,730 Well, there's a lot of them. 105 105 00:03:32,730 --> 00:03:35,910 We can start out by deactivating unnecessary components. 106 106 00:03:35,910 --> 00:03:37,710 If there's hardware or software 107 107 00:03:37,710 --> 00:03:40,410 or network ports or operating system processes 108 108 00:03:40,410 --> 00:03:43,470 and services or any applications that you're not using, 109 109 00:03:43,470 --> 00:03:46,050 go ahead and turn them off and disable them. 110 110 00:03:46,050 --> 00:03:48,240 Something that is there and open or installed 111 111 00:03:48,240 --> 00:03:49,530 can be a vulnerability, 112 112 00:03:49,530 --> 00:03:52,440 so if you don't need it, go ahead and remove it. 113 113 00:03:52,440 --> 00:03:55,920 The second thing, we want to disable any unused user accounts. 114 114 00:03:55,920 --> 00:03:58,080 Again, this is a vulnerable area for us. 115 115 00:03:58,080 --> 00:04:01,290 If we have default system accounts like guests or admin, 116 116 00:04:01,290 --> 00:04:03,990 those should be disabled if nobody's using them. 117 117 00:04:03,990 --> 00:04:06,060 Every account that's there on your system 118 118 00:04:06,060 --> 00:04:07,860 is a potential intrusion vector, 119 119 00:04:07,860 --> 00:04:09,120 so we want to make sure we're disabling 120 120 00:04:09,120 --> 00:04:10,770 anything that's not being used. 121 121 00:04:10,770 --> 00:04:12,810 And this goes for your user accounts as well. 122 122 00:04:12,810 --> 00:04:15,540 If you have a user who's been away for more than 30 days, 123 123 00:04:15,540 --> 00:04:17,370 go ahead and disable that account. 124 124 00:04:17,370 --> 00:04:19,890 When they come back, you can turn it back on. 125 125 00:04:19,890 --> 00:04:21,180 Our third thing we want to think about 126 126 00:04:21,180 --> 00:04:23,520 is how we're going to implement patch management. 127 127 00:04:23,520 --> 00:04:25,410 Again, I mentioned this before, 128 128 00:04:25,410 --> 00:04:27,930 part of system hardening is patching bugs. 129 129 00:04:27,930 --> 00:04:30,480 And so if we have a good patching program in place, 130 130 00:04:30,480 --> 00:04:32,970 we want to make sure patch management is part of that 131 131 00:04:32,970 --> 00:04:34,140 throughout all of our systems 132 132 00:04:34,140 --> 00:04:36,990 as part of a good vulnerability mitigation program 133 133 00:04:36,990 --> 00:04:38,520 with our systems. 134 134 00:04:38,520 --> 00:04:39,750 Our fourth thing we want to consider 135 135 00:04:39,750 --> 00:04:41,700 is how we're going to restrict host access 136 136 00:04:41,700 --> 00:04:43,320 to different peripherals. 137 137 00:04:43,320 --> 00:04:45,510 How are we going to make sure that people aren't using USB 138 138 00:04:45,510 --> 00:04:47,790 or Bluetooth as an attack vector? 139 139 00:04:47,790 --> 00:04:49,710 This, again, is something we need to think about, 140 140 00:04:49,710 --> 00:04:52,830 and if we don't need those things for a business case, 141 141 00:04:52,830 --> 00:04:54,360 we can go ahead and disable them. 142 142 00:04:54,360 --> 00:04:55,920 Going back to our first step, right? 143 143 00:04:55,920 --> 00:04:58,380 Deactivating unnecessary components. 144 144 00:04:58,380 --> 00:05:00,090 Our fifth and final thing we want to consider 145 145 00:05:00,090 --> 00:05:02,250 is how we're going to restrict shell commands. 146 146 00:05:02,250 --> 00:05:05,130 Now, shell commands are issued through the command shell 147 147 00:05:05,130 --> 00:05:07,860 and these should be disabled for most users on your system 148 148 00:05:07,860 --> 00:05:09,480 except your administrators. 149 149 00:05:09,480 --> 00:05:11,190 If nobody has a valid business case 150 150 00:05:11,190 --> 00:05:13,050 of why they need command line access, 151 151 00:05:13,050 --> 00:05:14,940 go ahead and shut that down. 152 152 00:05:14,940 --> 00:05:17,520 That's just one more attack vector that we can harden 153 153 00:05:17,520 --> 00:05:19,860 and shut down and keep away from the attackers. 154 154 00:05:19,860 --> 00:05:21,330 Now, to summarize all of this, 155 155 00:05:21,330 --> 00:05:24,600 I really have three simple mottos for system hardening, 156 156 00:05:24,600 --> 00:05:26,850 and if you keep these in mind during your exam, 157 157 00:05:26,850 --> 00:05:28,957 you're going to do well because you can always think, 158 158 00:05:28,957 --> 00:05:30,300 "Should I get rid of this? 159 159 00:05:30,300 --> 00:05:31,560 Should I block this? 160 160 00:05:31,560 --> 00:05:33,060 Should I use this mitigation?" 161 161 00:05:33,060 --> 00:05:35,880 And if it's one of these three mottos, you probably should. 162 162 00:05:35,880 --> 00:05:39,600 The first one is uninstall anything you aren't using, 163 163 00:05:39,600 --> 00:05:42,750 that includes hardware, software, programs, 164 164 00:05:42,750 --> 00:05:43,583 anything like that. 165 165 00:05:43,583 --> 00:05:45,480 If you don't need it, uninstall it, 166 166 00:05:45,480 --> 00:05:47,640 because it's just an intrusion vector. 167 167 00:05:47,640 --> 00:05:51,210 Second, if you need it, make sure you patch it frequently. 168 168 00:05:51,210 --> 00:05:53,520 Again, scan, patch, scan. 169 169 00:05:53,520 --> 00:05:54,780 You're going to scan your network, 170 170 00:05:54,780 --> 00:05:57,180 find the vulnerabilities, patch those vulnerabilities, 171 171 00:05:57,180 --> 00:06:00,330 and then scan again to see what vulnerabilities remain. 172 172 00:06:00,330 --> 00:06:02,070 And finally, my third motto, 173 173 00:06:02,070 --> 00:06:04,740 always restrict users to the least privilege. 174 174 00:06:04,740 --> 00:06:07,860 Again, if you can't turn it off and you can't patch it, 175 175 00:06:07,860 --> 00:06:09,360 you want to make sure you restrict it 176 176 00:06:09,360 --> 00:06:10,920 and you mitigate that risk. 177 177 00:06:10,920 --> 00:06:12,990 And one of those things is your users. 178 178 00:06:12,990 --> 00:06:15,480 Users do a lot of stupid things in our networks, 179 179 00:06:15,480 --> 00:06:17,550 but if we restrict them to the least privilege, 180 180 00:06:17,550 --> 00:06:19,410 we can limit the damage they can do. 181 181 00:06:19,410 --> 00:06:20,940 So keep those three mottos in mind 182 182 00:06:20,940 --> 00:06:22,490 and you'll do well on the exam.