In this lesson,
we're going to discuss secure baselines.
Now, in the cybersecurity industry,
a secure baseline refers to a standard set of configurations
and controls that are applied to a system, network,
or application to ensure a minimum level of security.
Establishing a secure baseline helps organizations
to maintain consistent security postures
and mitigate common vulnerabilities across all
of our organization's digital assets.
So, let's take a moment and discuss
how a secure baseline is established, deployed,
and maintained in our organizations.
Now, the first stage is to establish a secure baseline.
And a secure baseline is established
by conducting a thorough assessment of your system, network,
or application that needs protection,
in order to identify the type of data being handled,
to understand the data's workflow,
and to evaluate any potential vulnerabilities and threats,
best practices, industry standards,
and compliance requirements
such as those outlined in frameworks like the ISO 27001
or the NIST Special Publication 800-53
are often used as our starting points
for defining a secure baseline.
Now, to establish a secure baseline configuration
for a given type of system,
like a specific laptop model that our organization uses
for all of our end users,
we're going to first get a copy of that brand new laptop
to use as our template.
Then, we're going to format it, install the operating system,
update it, configure it, and properly secure it,
all on that one laptop.
Once this is done, this laptop will now be checked
against our baseline configuration guidance
and scanned for any known
vulnerabilities or misconfigurations.
Now, once this is completed,
we now have a very secure laptop,
but it doesn't have any of the different programs
that our average users are going to need to perform their job.
So, we can now install all the applications
that are needed by our employees,
including things like an office suite,
endpoint detection response agent, a web browser,
and other tools like that,
based on their specific job roles.
Once all these tools are installed and configured,
we'll then scan the system again
for any known vulnerabilities and remediate those too.
Now, this may have taken us several hours
to create this new laptop and fully secure it,
so we don't want to have to do this each and every time
we hire a new employee.
So instead, we're going to create an image of this machine
and use that as our known good and secure baseline
for any new laptops that match this configuration
that we need to be able to set up for our employees.
This baseline will then be continually refined and secured
so it remains up to date
with the latest security patches, hotfixes, updates,
and service packs,
as the threat environment continues to evolve.
Now, in addition to creating the secure image
for new installations,
we also need to keep track of any group policies
and other configurations that we're going to create
and ensure they're validated and secured
before we deploy them to all of our other assets.
And so now that we have a secure baseline established,
we can now deploy it
across all of our organization's digital assets.
Deployment can involve configuring firewalls,
setting up user permissions,
implementing encryption protocols,
ensuring that anti-virus and antimalware solutions
are properly installed and updated.
Automated tools and scripts can be employed to ensure
that the secure baseline is going to be uniformly applied
across all your devices and systems
that are not installed using the disk image
that we created back in the first step.
So instead, we're going to be able to compare these assets
against our known good configurations,
ensure they all receive the proper configurations needed
to make sure they're secure and up to date
with all the latest configurations we've created.
For example, in a Windows domain environment,
administrators can use group policy objects known as GPOs
to apply a secure baseline
that dictates different policies like password policies,
user rights assignments, and audit settings,
across all the computers in a given domain.
Similarly, if you're working in a cloud-based environment
like AWS, organizations can utilize services like AWS Config
to define and deploy secure configurations
across all of their cloud-based resources.
Next, we need to maintain the secure baseline
on all of our assets.
Now, this is done by locking down our systems
so that our users can't install additional software
or modify our existing configurations.
Additionally, we're going to find
that maintaining a secure baseline
becomes an ongoing process.
We're going to conduct regular audits and monitoring,
and this is going to ensure that the baseline remains effective
and up to date with the latest threats and vulnerabilities
that we're seeing out in the marketplace.
This type of continuous monitoring can be done by tools
that will help us to identify deviations from the baseline,
and then trigger alerts for immediate remediation
by our security operations center team.
Over time, you're going to need to periodically review
and update your secure baseline
to align with changes in the organizational infrastructure,
business needs, and evolving threat landscapes too.
Now, to aid in maintaining your secure baseline,
you should also conduct training and awareness
with all of your employees
to ensure they understand the importance of adhering
to the secure baseline configurations.
Employees should be made aware of the potential risks
of deviating from the baseline,
and they should be encouraged
to report any suspicious activities
that they may notice when they're utilizing their systems.
So remember, the establishment, deployment, and maintenance
of a secure baseline is a critical practice
within the cybersecurity industry
that protects your organization's networks.
Secure baselines help to ensure
that an organization's digital assets
are consistently configured to resist attacks
and to mitigate known vulnerabilities and misconfigurations.
By continuously monitoring and updating
our secure baselines,
our organizations can enhance their security posture
and protect their valuable data and resources
from potential data breaches.