Hardening

Hardening

Process of enhancing system, application, or network security. Strengthen overall security posture and resilience against cyberattacks

Change Default Configuration settings

Default settings are usually not secure. To mitigate issues, Change the default password to a strong, long, and complex one, Disable any unneeded ports and protocols on the system and choose the encrypted version of ports like HTTP or SMTP, Check for any open ports on the devices

Restricting Applications

Make sure only certain applications can be downloaded, like using an allowlist or blocklist

Blocklisting

Entails preventing listed applications from running, allowing all others to execute. Less secure than allowlist

Allowlisting

A security measure that permits only allowed applications to run on the OS. Must be updated each time one of the apps are updated. Very secure but hard to manage

Least Functionality

Involves configuring systems with only essential applications and services, aims to provide only the necessary applications and services. Unneeded applications should be restricted or uninstalled to reduce vulnerabilities

Secure Baseline Image

A standardized workstation setup, including OS, essential applications, and strict policies in corporate networks

Services

Background applications that operate within the OS, executing a range of tasks

Trusted Operating Systems (TOS)

Designed to provide a secure computing environment by enforcing stringent security policies that usually rely on mandatory access controls

What trusted operating systems usually have to meet security standards

Mandatory Access Control, Using microkernels by minimizing the trusted base and reducing attack surface and vulnerabilities. good EAL rating

SE Linux (Security Enhanced Linux)

Set of controls that are installed on top of another Linux distribution. A default context-based permission system that uses Mandatory Access Control instead of DAC. Includes in CentOS and Red Had Enterprise Linux. Lets information be classified and protected. User, Role, and Type contexts

User context

Defines which users can access an object, including common contexts like 'unconfined_u,' 'user_u,' 'sysadm_u,' and 'root'

Role Context

Defines what roles can access a given object

Type Context

Groups objects together that have similar security requirements or characteristics. Most important type

Level

Used to describe the sensitivity level of a given file, directory, or process. Optional 4th context

Disabled Mode

Turns off SELinux, relying on default DAC for access control

Enforcing Mode

Enforces all SELinux security policies, preventing policy violations

Permissive Mode

Enables SELinux but doesn't enforce policies, allowing processes to bypass security policies

SELinux Policy

Describes access permissions for users, programs, processes, files, and devices

Targeted Policies

Only specific processes are confined to a domain, while others run unconfined

Strict Policies

Every subject and object operates under MAC, but it's more complex to set up

Context-Based Permissions

Permission schemes that are defined by various properties for a given file or process

Hotfix

A software patch that solves a security issue and should be applied immediately after being tested in a lab environment

Update

Provides a system with additional functionality, but it doesn’t usually provide any patching of security related issues. Often introduce new vulnerabilities

Service Pack

Includes all the hotfixes and updates since the release of the operating system

What is needed for good patch management

Assigning a dedicated team to track vendor security patches. Establishing automated system-wide patching for OS and applications. Including cloud resources in patch management. Categorizing patches as urgent, important, or non-critical for prioritization. Create a test environment to verify critical patches before production deployment. Maintaining comprehensive patching logs for program evaluation and monitoring. Establishing a process for evaluating, testing, and deploying firmware updates. Developing a technical process for deploying approved urgent patches to production. Periodically assessing non-critical patches for combined rollout

Patch Management

Planning, testing, implementing, and auditing of software patches

Planning in patch management

Creating policies, procedures, and systems to track and verify patch compatibility

Testing in patch management

Do this to prevent the patch from causing additional problems

Implementation in patch management

Deploy the patch to all devices that need it, can be manually or automated

Patch Ring

Implement patches one group (or ring) at a time

Auditing in patch management

Scan network to ensure the patch was installed correctly. Determine if there are any unexpected problems as a result of the patch

Group Policy

A set of rules and policies that can be applied to users or computer accounts within an operating system

Security Templates

A group of policies that can be loaded through one procedure

Baselining

Process of measuring changes in the network, hardware, or software environment

Full-Disk Encryption

Encrypts the entire hard disk drive to protect all the data stored on it

Partition Encryption

Similar to full-disk, but only applied to a partition on the hard drive device

Volume Encryption

Used to encrypt a set space on the storage medium. Creates an encrypted container that can house various files and folders

File-Level Encryption

Used to encrypt an individual file

Database Encryption

Secures the entire database, extending to multiple storage devices, or cloud storage

Record-Level Encryption

Used to encrypt individual record or rows within a database

Secure Baseline

Standard security configuration applied to guarantee minimum security for a system, network, or application

How to set up a secure baseline?

Install, update, configure, and secure the operating system on the reference device. Check the device against baseline configuration guides and scan for known vulnerabilities or misconfigurations. Install required applications (e.g., Microsoft Office suite, endpoint detection and response agents). Scan for vulnerabilities in the installed applications and remediate them. Create an image of the reference device as the "known good and secure baseline”

Secure Baseline Usage Process

Configure, Deploy with security configurations, Maintain and monitor, keep employees trained and aware