-: Hardening and patching. 2 2
In this lesson, we're going to talk about two key terms 3 3
and I know I've used these words before, 4 4
but we've never really defined them. 5 5
These are hardening and patching. 6 6
Now, when I talk about system hardening, 7 7
this is the process by which a host or other device 8 8
is made more secure 9 9
through the reduction of a device's attack surface area. 10 10
Now, what does that mean 11 11
when I talk about an attack surface area? 12 12
Well, when I talk about an attack surface, 13 13
I'm talking about the services and the interfaces 14 14
that allow a user or program 15 15
to communicate with a target system. 16 16
This allows all of these different services that are there 17 17
to be vulnerable for somebody to attack them, right? 18 18
And that's the idea of system hardening, 19 19
is I want to close down as many of those as I don't need 20 20
because that will end up hardening my system 21 21
and reducing that attack surface. 22 22
Now, any service or interface that is enabled 23 23
through the default installation and left unconfigured 24 24
should be considered a vulnerability. 25 25
And so, you should scan that, you should identify it 26 26
and then mitigate or remediate that 27 27
based on what you need to do 28 28
as part of your system hardening. 29 29
Now, when we start talking about system hardening, 30 30
I have this wonderful system hardening security checklist. 31 31
These are 10 major areas that you need to check 32 32
when you're trying to harden a given system. 33 33
First, you need to remove or disable devices 34 34
that are not needed or used. 35 35
For example, are you using wifi? 36 36
If not, disable it and take out the wifi card. 37 37
Are you using a CD-ROM or a floppy drive? 38 38
If not, take those things out. 39 39
Anything you don't need, you should remove or disable 40 40
because anything you don't need 41 41
is another thing that's open 42 42
and could be used by an attacker 43 43
and that makes it part of our larger attack surface. 44 44
So by removing it, we are going to harden our system 45 45
and reduce the attack surface. 46 46
The second thing is we want to install operating system, 47 47
application firmware and driver patches regularly. 48 48
If Microsoft knows there's a vulnerability in Windows 49 49
and they put out a patch on Patch Tuesday, 50 50
you should be downloading that patch, 51 51
testing that patch 52 52
and then deploying that patch across your network 53 53
because you want to make sure you are patched regularly 54 54
and up to date with the latest security precautions. 55 55
Because if somebody has a patch out there, 56 56
bad guys will usually reverse engineer that patch 57 57
and create an exploit. 58 58
So you need to make sure that you are patched 59 59
to prevent those exploits 60 60
from being effective against your systems. 61 61
The third thing I want you to think about 62 62
is uninstalling all unnecessary network protocols. 63 63
Now what I mean here is not necessarily your wifi, 64 64
but instead all of those network protocols 65 65
that might be used on your system. 66 66
Are you running a web server? 67 67
If you're not, close port 80. 68 68
Are you running a mail server? 69 69
If not, close port 25. 70 70
Are you running an SSH server? 71 71
If not, close port 22. 72 72
As a standard workstation, 73 73
you really should have no ports that are open 74 74
unless you have something open 75 75
for something like a host-based intrusion detection system 76 76
to be able to receive reports and send reports back. 77 77
Other than that, everything should be 78 78
pretty much locked down on a system. 79 79
On a server, you should only have the ports open 80 80
for the services you need. 81 81
So if you're running a file server 82 82
or a web server or an email server, 83 83
those ports should be open, 84 84
but everything else should be closed. 85 85
The fourth thing we want to look at 86 86
is uninstalling or disabling all unnecessary services 87 87
and shared folders. 88 88
Anytime you have something that is open 89 89
or shared or a service, 90 90
that is, again, something that is increasing 91 91
your attack surface. 92 92
So again, you're seeing the common theme here. 93 93
Anything you're not using, 94 94
go ahead and uninstall it or disable it. 95 95
I prefer to uninstall it 96 96
because that way nobody else can enable it, 97 97
but if you can't uninstall it, 98 98
then you should at least disable it. 99 99
Fifth, you need to enforce access control lists 100 100
on all system resources. 101 101
This means if you have local system files 102 102
or folders or shared files in folders or printers, 103 103
all of those things have to be controlled 104 104
using the appropriate access control list 105 105
and we'll talk more about access control later on 106 106
as we define the four different types. 107 107
But for now, just remember, 108 108
you want to make sure you're enforcing access control 109 109
using the appropriate ACLs. 110 110
Number six, we want to restrict user accounts 111 111
to the least privilege needed. 112 112
You'll hear this concept a lot in security, 113 113
always use least privilege. 114 114
If you can do this with a user account 115 115
and not use an admin account, 116 116
go ahead and use a user account. 117 117
If you're a user, do you need to have admin rights? 118 118
No, you just need to be able to access the computer 119 119
and run your systems. 120 120
And so, you'll have these different things 121 121
like guests and users and super users and then admins 122 122
and you only want to use admin accounts when you have to 123 123
because there's a high level of privilege 124 124
associated with them 125 125
and that would also increase your attack surface. 126 126
Next, we want to look at number seven 127 127
which is to secure the local admin or root account. 128 128
And one of the ways to do this 129 129
is by renaming it and changing the password. 130 130
Everybody knows on a Linux system, 131 131
the root account is called root. 132 132
Everybody knows on a Windows system 133 133
the administrator account is called administrator. 134 134
So you should disable those two accounts 135 135
and instead create another super user 136 136
that is called something else. 137 137
So instead of calling it administrator, 138 138
I might call it Jason ADM. 139 139
Or if instead of calling it root, 140 140
I might call it root 123. 141 141
Whatever you want to do 142 142
to try to make it at least a little bit harder 143 143
for the attacker is a good thing. 144 144
And then, always make sure you change that default password. 145 145
If you have the default password 146 146
of T-O-O-R for root, which is root spelled backwards, 147 147
you are going to get hacked really, really quickly. 148 148
And so, you want to make sure you keep those things in mind 149 149
and always change those passwords. 150 150
Number eight, you want to disable unnecessary default user 151 151
and group accounts. 152 152
Again, if you're not using it and you don't need it, 153 153
you should go ahead and disable it. 154 154
This also helps harden your system 155 155
and reduce your attack surface. 156 156
Number nine, we want to verify permissions 157 157
on system accounts and groups. 158 158
This is because we can see things that happen 159 159
like permission creep 160 160
where people gain permissions over time 161 161
and they never get those permissions taken away. 162 162
For example, I worked at one company for almost a decade 163 163
and every time I moved positions, 164 164
they added different security controls. 165 165
They said, "Oh, 166 166
well now you work in accounting," for instance. 167 167
"So you need access to the accounting share drives," 168 168
but you might still have your access 169 169
to the human resource files 170 170
because you were in human resources last. 171 171
And then you move over to the tech side 172 172
and now you've got all three accesses. 173 173
And so, what should happen is every time 174 174
you move to a new department, 175 175
your permissions should get taken away 176 176
and only the permissions you need should be added. 177 177
This is the idea of verifying permissions 178 178
on the accounts and on the groups. 179 179
This should also be done routinely, 180 180
whether that's monthly or quarterly, 181 181
against your entire system 182 182
to make sure everyone has the right permissions 183 183
for what they need. 184 184
And number 10, you always want to make sure 185 185
you're installing anti-malware software 186 186
and you need to update its definitions 187 187
automatically and regularly. 188 188
So just having antivirus software in your computer 189 189
is not good enough. 190 190
It needs to check every single day for the latest updates 191 191
and scheduled to automatically do its scans. 192 192
This will help keep your system protected. 193 193
If you do these 10 things, 194 194
your system is going to be pretty strong 195 195
and pretty well hardened. 196 196
Now the other thing you need to consider 197 197
is how are you going to harden your systems 198 198
against availability attacks? 199 199
Remember, we have three sides of the triangle, 200 200
confidentiality, integrity and availability. 201 201
Everything we just talked about 202 202
was a lot to do with confidentiality and integrity. 203 203
It's making sure our data is the way we want it to be 204 204
and that only the right people can read it. 205 205
But if we want to start focusing on availability, 206 206
what can we do? 207 207
If I have a server, 208 208
it should be powered by an UPS or a battery backup. 209 209
This will make sure that it can stay online 210 210
even if the power goes down in the facility 211 211
and that'll give it enough time 212 212
for your secondary power to come online, 213 213
which might be a generator for instance. 214 214
This is the idea of how you can make sure 215 215
you're protected against availability attacks 216 216
that have to do with power outages. 217 217
But power outages aren't the only thing 218 218
we have to worry about. 219 219
For instance, in my area, 220 220
we have an issue with our primary internet connection. 221 221
If power is out in town for more than an hour, 222 222
we lose our primary internet connection. 223 223
So we have a backup internet connection, 224 224
we have a backup cellular modem. 225 225
In addition to that, we have a backup microwave connection 226 226
or a satellite connection. 227 227
And so, that way, we have multiple different paths 228 228
so we won't be offline. 229 229
That's the idea of making sure 230 230
you're protecting yourself against availability. 231 231
Now, I only talked about power and internet here, 232 232
but there are lots of other things 233 233
that are threats to your availability 234 234
and you need to think through these 235 235
as you're building out your server farms and your systems 236 236
because that is one of the ways 237 237
you can harden those systems, 238 238
is making sure they're resilient 239 239
against these availability attacks. 240 240
Now, the last thing I want to talk about here 241 241
is the second part of this topic. 242 242
We talked about hardening, 243 243
now we're going to talk about patching 244 244
and this comes down to patch management. 245 245
Patch management involves identifying, 246 246
testing and deploying operating system 247 247
and application updates. 248 248
As I mentioned, patches are going to be there 249 249
to help you fix security bugs. 250 250
When Microsoft knows there's a bug in their software, 251 251
they're going to release a patch. 252 252
You need to identify that you have the appropriate software 253 253
that needs to be patched, 254 254
you need to make sure that you test that patch 255 255
before installing it, 256 256
and then you need to deploy that across your network 257 257
so everything gets updated. 258 258
These patches are often classified as critical, 259 259
security-critical, recommended and optional. 260 260
If it's a critical or a security critical, 261 261
you probably should make sure you get those out quicker. 262 262
If it's something that's optional, 263 263
you could probably wait a little while on that. 264 264
And again, this all goes back to your risk appetite 265 265
and risk management. 266 266
Now, when you're trying to conduct patch management 267 267
at the enterprise level, 268 268
you're going to need some sort of patch management tool suite. 269 269
There are lots of different tool suites out there, 270 270
but two of the most common are made by Microsoft. 271 271
Microsoft has the System Center Configuration Manager 272 272
or SCCM and the Endpoint Manager, 273 273
as you can see here on the screen. 274 274
These are designed to support both Microsoft systems 275 275
as well as having some ability 276 276
to detect things on other systems as well, 277 277
but really they're primarily focused on Microsoft systems. 278 278
Now, one of the things you have to be aware of 279 279
when you're dealing with patch management 280 280
is that just patching 281 281
is actually an availability risk in itself 282 282
because when I install a patch, 283 283
I actually can put that onto a critical system 284 284
and then that system needs to be rebooted. 285 285
When I do that, that might take five, 10, 15 minutes 286 286
to reboot that server 287 287
and that means that server is down for that time. 288 288
So you need to make sure you're planning 289 289
when these patches are going to go out. 290 290
You can't just do it in the middle of the workday. 291 291
You're going to have to have a downtime window 292 292
or a maintenance window for you to be able to install 293 293
those patches to critical systems 294 294
if you don't have a fully redundant network that's built. 295 295
Luckily, most of our organizations 296 296
have moved to the cloud now. 297 297
Most of us have a fully redundant network built out, 298 298
so we can take a single server offline, 299 299
patch it and then bring it back up. 300 300
But if you're still working 301 301
with some of these older legacy systems, 302 302
you may have to reboot the system manually 303 303
and you may not have a backup. 304 304
And so, that would be an availability risk 305 305
that you have to consider. 306 306
Finally, when we talk about patches, 307 307
you have to remember that patches don't always exist. 308 308
You might have a piece of software 309 309
that's really, really old 310 310
or a system that's really, really old 311 311
and manufacturer just doesn't even exist anymore, 312 312
they've gone out of business, 313 313
in which case there is no patch available. 314 314
Instead, you'll have to use compensating controls. 315 315
So if you're looking for patches that don't exist, 316 316
things like legacy systems, proprietary systems, 317 317
ICS/SCADA or Internet of Things systems and devices 318 318
and you can't find it, 319 319
you may have to either take that thing off the network 320 320
if you can assume that business risk 321 321
or you're going to put in compensating controls 322 322
to overcome the fact 323 323
that you can't patch that vulnerability. 324 324
Now, what do I mean by this? 325 325
Let's say you had an older network file system 326 326
and it requires Port 445 to be open 327 327
for it to be able to share those files. 328 328
Well, we don't want to have port 445 open to the internet 329 329
because that would be a vulnerability. 330 330
So a compensating control 331 331
if I can't patch this software against a given vulnerability 332 332
is to make sure that this file server 333 333
is only available internal to the network 334 334
and I can block it from getting out of the firewall 335 335
or anything outside the firewall 336 336
from getting to this file server. 337 337
By doing this, I put a compensating control in place 338 338
such as blocking port 445 from the internet 339 339
and that can solve the problem of an exploit over port 445 340 340
that this older proprietary system may be vulnerable to.