Instructor: Configuration Baselines. 2 2
In this lesson, we're going to talk about the concept 3 3
of a configuration baseline. 4 4
Now, a configuration baseline is all of the settings 5 5
for services and policy configurations 6 6
that you use for a server that's operating 7 7
within a particular application role. 8 8
So when you look at a particular server 9 9
in an application role, like a web server, 10 10
or a file server, or a print server, or a mail server, 11 11
each of those is going to have its own configurations. 12 12
There's different programs you have installed. 13 13
There's different policies you've incorporated. 14 14
All of that stuff is based on that particular baseline. 15 15
Now, this baseline is important because to create it, 16 16
you're going to set up everything the way you want 17 17
and then you're going to do a vulnerability scan. 18 18
As you go forward and you do this scan, 19 19
you're going to figure out exactly what vulnerabilities 20 20
exist in that baseline. 21 21
You're going to mitigate them down and remediate them 22 22
down to an acceptable level. 23 23
And then you're going to scan 'em again, 24 24
and that becomes your baseline. 25 25
Now, everything that goes on beyond that 26 26
would be considered a deviation. 27 27
Anytime you make a change from that baseline, 28 28
this is a deviation. 29 29
And this must be remediated or that risk, 30 30
that baseline exception that you're doing, 31 31
has to be accepted. 32 32
And again, this goes back to your risk appetite. 33 33
Now, to do this, we use things like security templates 34 34
and baselines. 35 35
And these exist from a lot of different sources. 36 36
You might get it from a vendor, 37 37
such as Microsoft has one for Windows operating systems. 38 38
You might get it from a third party 39 39
or even your regulatory organization. 40 40
If you're going to do something that involves credit card data, 41 41
you're actually going to have a baseline that you get 42 42
from the regulatory organization for that, which is PCIDSS. 43 43
And they would say, here's our security template, 44 44
this is all the things you need to do 45 45
for this particular operating system. 46 46
This is the idea of using these baselines. 47 47
And the idea behind a baseline 48 48
is you have something that is known. 49 49
If I've configured my servers to be within this baseline, 50 50
then I know what security risk exist 51 51
and I know what my level of appetite is 52 52
for this particular system. 53 53
And anything that changes from that 54 54
goes beyond and becomes a deviation. 55 55
Now, one of the places you can get 56 56
these type of security templates and baselines 57 57
is known as the Center for Internet Security, or CIS. 58 58
Now, CIS is a non-profit that publishes 59 59
well-known, top 20 critical security controls. 60 60
And essentially, these are best practices. 61 61
They tell you how you should configure things. 62 62
For instance, if you look at the top 5 out of these top 20, 63 63
we have the Inventory of Authorized 64 64
and Unauthorized Devices. 65 65
We have the Inventory of Authorized 66 66
and Unauthorized Software. 67 67
We have Secure Configurations for Hardware and Software 68 68
on Mobile Devices, Laptops, Workstations, and Servers. 69 69
We have Continuous Vulnerability Assessment and Remediation. 70 70
And we have the Controlled Use of Administrative Privileges. 71 71
All of these things have benchmarks 72 72
and security templates associated with them. 73 73
Now, for each of these top 5 that I listed 74 74
and the top 20 at large, 75 75
the CIS is going to provide benchmarks 76 76
as a series of best practices and design recommendations. 77 77
And if you follow them, 78 78
your systems are going to be more secure and more safe. 79 79
To find these, you can go to the website 80 80
for the Center for Internet Security. 81 81
And in here, a lot of these 82 82
are going to be free for you to use, 83 83
but there are some that require a paid membership 84 84
or subscription fee. 85 85
Again, this is something that you don't have to memorize 86 86
for the exam or read all of them. 87 87
But in the real world, these are really helpful 88 88
when you're trying to create the baselines 89 89
for your particular servers and services. 90 90
Now, this brings us to the last concept 91 91
that we want to talk about in this lesson, 92 92
which is the idea of a compensating control. 93 93
Now, I have a baseline and I have risk, 94 94
and there's additional risks and changes 95 95
that are being done. 96 96
And sometimes I can't put 97 97
the right security control in place 98 98
according to that baseline. 99 99
So what do I do? 100 100
Well, I use a compensating control. 101 101
A compensating control is a type of security control 102 102
that acts as a substitute for a principal control. 103 103
Essentially, when I take a compensating control and use it, 104 104
I need to make sure that compensating control 105 105
gives me the same levels of security assurances 106 106
as the control that it's replacing. 107 107
So if I have something that is an unpatched system, 108 108
for instance an ICS or SCADA system, 109 109
and I can't patch it, what can I do? 110 110
Well, if I can't patch it, I need to do something 111 111
that gives me just as much protection. 112 112
One of the things I could do is I could create a VLAN 113 113
and I can add isolation, 114 114
and that isolation could be more robust 115 115
than actually patching the service. 116 116
So I can use this unpatched server 117 117
inside this isolated environment 118 118
that has no network connectivity to the outside. 119 119
And that would be just as secure as patching it up fully. 120 120
And so, based on that, that would be considered 121 121
a compensating control by performing that isolation 122 122
instead of using the directed things, which was a patch.