Section 29: Remediation Recommendations

Remediation Recommendations and Penetration Testing

Introduction

  • Remediation recommendations are advice given to fix vulnerabilities found during a penetration test.

  • The goal is to turn findings into actions that enhance system security by providing solutions, not just identifying problems.

Domain 1: Engagement Management - Objective 1.5

  • Focus: Analyzing findings and recommending appropriate remediation reports.

System Hardening

  • Strengthening network areas using methods like network segmentation.

Authentication Recommendations

  • Strengthening identity verification through:

    • Self-identification

    • Key rotation

    • Password managers

Encryption

  • Determining the best encryption algorithms for data protection at:

    • Storage

    • Processing

    • Transmission

Patch Management

  • Keeping software updated to protect against known vulnerabilities.

Process Level Remediation

  • Fixing issues in how programs and applications operate.

Administrative Controls

  • Access management to ensure the right people have the right access.

  • Principles like:

    • Role-Based Access Control (RBAC)

    • Secure Software Development Life Cycle (SDLC)

Physical Controls

  • Tangible aspects of security, such as:

    • Locks

    • Security cameras

    • Active cards

Operational Controls and Policies

  • Broader security in day-to-day business operations, including:

    • Job rotation

    • Employee training

Implementing Recommendations Demo

  • Practical demonstration on putting suggestions into action.

Quiz and Review

  • A short quiz to assess learning, followed by a review of each question to ensure understanding.

Key Terms: Hardening and Patching

System Hardening

  • Making a host or device more secure by reducing its attack surface area.

  • Attack Surface: Services and interfaces that allow communication with a target system.

    • These services can be vulnerable to attacks.

    • System hardening aims to close unnecessary services to reduce the attack surface.

  • Vulnerability: Any service or interface enabled by default and left unconfigured.

    • These should be scanned, identified, and mitigated or remediated.

System Hardening Security Checklist

  1. Remove or disable unused devices: Anything not needed increases the attack surface.

    • Example: Disable Wi-Fi if not in use. Remove CD-ROM or floppy drives.

  2. Install OS, application, firmware, and driver patches regularly:

    • Apply patches promptly to prevent exploits.

    • Attackers reverse engineer patches to create exploits.

  3. Uninstall unnecessary network protocols:

    • Close unused ports (e.g., port 80 for web server, port 25 for mail server, port 22 for SSH).

    • Workstations should have minimal open ports.

    • Servers should only have ports open for necessary services.

  4. Uninstall/disable unnecessary services and shared folders:

    • Remove anything not in use to minimize the attack surface.

    • Uninstall preferred; disable if uninstall not possible.

  5. Enforce Access Control Lists (ACLs) on all system resources:

    • Control access to local and shared files/folders, printers, etc., using appropriate ACLs.

  6. Restrict user accounts to the least privilege needed:

    • Use user accounts instead of admin accounts when possible.

    • Avoid giving admin rights to standard users.

    • Utilize different account types (guests, users, super users, admins) appropriately.

  7. Secure the local admin or root account:

    • Rename the default admin/root account and change the password.

    • Example: Rename "administrator" to "jsonadm" or "root" to "root123".

    • Always change default passwords (e.g., "toor" for root).

  8. Disable unnecessary default user and group accounts:

    • Disable accounts not in use to harden the system and reduce the attack surface.

  9. Verify permissions on system accounts and groups:

    • Prevent permission creep, where users accumulate unnecessary permissions over time.

    • Regularly audit permissions to ensure users have appropriate access.

    • Example: Permissions should be removed when a user changes departments.

  10. Install anti-malware software: Update definitions automatically and regularly.

    • Scheduled scans are essential.

Hardening Against Availability Attacks

  • Focus on maintaining availability (confidentiality, integrity, availability triangle).

  • Power: Use UPS (Uninterruptible Power Supply) or battery backup for servers.

    • Ensures uptime during power outages; allows time for secondary power (e.g., generator) to come online.

  • Internet: Have backup internet connections (cellular modem, microwave, or satellite).

    • Ensures continued connectivity during primary connection failures.

Patch Management

  • Identifying, testing, and deploying OS and application updates.

  • Patches fix security bugs.

  • Process:

    1. Identify needed patches.

    2. Test patches before installation.

    3. Deploy patches across the network.

  • Patches are classified as:

    • Critical

    • Security critical

    • Recommended

    • Optional

    • Apply critical/security critical patches faster.

    • Risk appetite informs patch management decisions.

  • Tools: Patch management tool suites (e.g., Microsoft's System Center Configuration Manager (SCCM) , Endpoint Manager).

    • Designed for Microsoft systems but can detect issues on other systems.

Availability Risks of Patching

  • Reboot Downtime: Installing patches may require system reboots, causing downtime.

    • Plan maintenance windows for patching critical systems.

    • Cloud environments with redundant networks allow patching without downtime.

  • Legacy Systems: Older systems may require manual reboots and lack backups, increasing availability risks.

Compensating Controls

  • Patches May Not Exist: Older software or systems may lack available patches due to vendor obsolescence.

  • Use compensating controls instead:

    • Legacy systems

    • Proprietary systems

    • ICS SCADA

    • IoT devices

  • Example: If an old file system requires port 445 open, block it from the internet via a firewall. Ensure it is only accessible internal to the network.

User Input Sanitization

Definition

  • Ensuring all input data from users is clean, valid, and safe before being processed by the application.

  • Crucial for preventing injection attacks like SQL injection and cross-site scripting (XSS).

Basic Aspect

  • Treat all user input as untrusted and potentially harmful.

  • Always validate, filter, and sanitize any data provided by users.

Key Characteristic

  • Involves both approved and unapproved listing techniques.

    • Approved Listing: Allows only certain characters or patterns known to be safe.

    • Unapproved Listing: Removes or escapes characters known to be dangerous.

    • Relying solely on unapproved listing is often insufficient.

Example: Login Form

  • Use parameterized queries or prepared statements instead of directly inserting values into SQL queries.

  • Treat user input as data rather than executable code to prevent SQL injection.

Vulnerable SQL Statement

  • Query is constructed by directly concatenating user inputs (username and password) into the SQL string.

  • User inputs are directly inserted into the SQL query without any filtering or validation.

  • Susceptible to SQL injection because whatever the user inputs is directly set into the function without any filtering or validation.

SELECT∗FROMusersWHEREusername=′SELECT * FROM users WHERE username = ' + username + ′ANDpassword=′' AND password = ' + password + ′;';

SQL Injection Example

  • If an attacker inputs username = ' or '1'='1 and password = ' or '1'='1:

SELECT∗FROMusersWHEREusername=′′or′1′=′1′ANDpassword=′′or′1′=′1′SELECT * FROM users WHERE username = '' or '1'='1' AND password = '' or '1'='1';

  • This query will always return true, bypassing authentication.

Corrected Code

  • Use parameterized inputs where placeholders (question marks) are used for username and password.

  • Actual values for username and password are supplied separately from the query, typically through a prepared statement.

  • Even if an attacker tries to input a malitious string, it will be treated as plains string rather than part of the SQL code.

SELECT∗FROMusersWHEREusername=?ANDpassword=?SELECT * FROM users WHERE username = ? AND password = ?;

How to Recommend Remediation

  1. Identify all input points: Review the application to identify all user input points such as forms, URL parameters, and API endpoints.

  2. Implement input validation: Use a tool like SonarQube.

  3. User Parameterized queries: Update your database queries to user Paramaterized queries for prepared statements.

  4. Sanitize Output: Sanitze any data before displaying it back to the user to prevent XSS attack, and use the appropriate encoding functions to escape special characters.

  5. Conduct Regular Security Testing: Automate scans and manual pen tests to identify any new vulnerabilities , and make sure you train the proper people.

  6. User Training: Educate develpers with secure coding principles.

Network and Infrastructure Controls

Network Segmentation

  • Dividing a larger network into smaller, isolated segments or subnets.

    • Enhances security, improves performance, and manages traffic effectively.

    • Limits the spread of malware, controls access to sensitive data, and reduces the attack surface. The most basic aspect is separating the critical systems.

  • Organizations typically have VLANs for different departments (e.g., admins, HR, accounting).

Key Characteristics

  • Use of firewalls, VLANs, and Access Control Lists (ACLs).

    • Firewalls: for strict access policies between segments.

    • VLANs: to create separate broadcast domains within the same physical network.

    • ACLs: for granular control over which devices and users can access specific network segments.

Infrastructure Security Controls

  • Measures to protect physical and virtual components of the IT environment:

    • Servers

    • Storage systems

    • Network devices

    • Hardware and software assets

  • Designed to ensure:

    • Integrity

    • Confidentiality

    • Availability

Examples of Infrastructure Security Controls

  • Strong authentication mechanisms

  • Encryption to protect data (at rest and in transit)

  • Rapid patching to fix known vulnerabilities

  • Intrusion Detection and Prevention Systems (IDPS)

Importance

  • Contain security incidents

  • Prevent unauthorized access

  • Protect sensitive information

  • Without these controls, attackers can move laterally, access critical systems, and exfiltrate data.

How to Recommend Remediation

  1. Review current network architecture: Redesign that includes the segmentation of networks and critical systems.

  2. VLANs and Firewalls: Implement VLANs and configure firewalls to enforce policy between the segment.

  3. Assess Existing Infrastructure: Ensure strong secure mechanisms are inplace.

  4. Conduct Regular Vulnerability Assessments: And apply patches updates and properly.

  5. Deploy and configure IDPS: To monitor blocked suspicious activities.

  6. Educate: IT staff and users about the importance of these

Authentication Recommendations

Multifactor Authentication (MFA)

  • Security process requiring users to provide two or more verification factors to gain access.

    • Factors: Something you know (password), something you have (security token), something you are (biometrics).

  • Enhances security by requiring multiple forms of verification.

Key Characteristics of Effective MFA

  • Ensure factors used are diverse and independent.

    • Combining a password (something you know) with a mobile app-generated code (something you have) is a common approach.

    • Reduces the likelihood of a successful breach.

Certificate Management

  • Administration of digital certificates used to establish trust and secure communications over networks.

  • Authenticates the identity of devices, users, and applications, and enables encrypted communications.

  • Ensuring all certificates are valid, up to date, and trusted.

    • Includes issuing new certificates, renewing expiring ones, and revoking compromised certificates.

Key Rotation

  • Changing cryptographic keys regularly to limit the amount of data encrypted with the same key.

  • Reduces the risk of a key being compromised.

  • Involves automating the process to ensure keys are rotated regularly and securely.

  • Maintain a secure key management system to store and handle these keys.

Secrets Management Solutions (Password Managers)

  • Tools that help users generate, store, and manage their passwords securely.

  • Encrypt stored passwords, requiring the user to remember only one master password to access all credentials.

  • Enhances security by allowing users to create strong, unique passwords for each account.

  • Reduces the risk of password reuse and weak passwords.

Why These Recommendations Are Important

  • Implementing MFA, proper certificate management, regular key rotation, and using secrets management solutions are vital measures to protect an organization from various attack vectors.

  • Helps ensure that access to systems is secure, communications are trusted, and sensitive information remains protected.

How to Recommend Remediation

  1. Multifactor Authentication: Ensure solutions are configured to user diverse and independent factors.

  2. Review: Management practices.

  3. Establish and Robust Key Rotation policy: Use a secure key management system and store keys. The rotation process should be automated.

  4. Secrets Management: Deploy a secret measurement like password manager for all users. Passwords that are strong and unique should be in each account.

Encryption Recommendations

Encryption Defined

  • Converting plain text into ciphertext to prevent unauthorized access.

  • Ensures that only authorized parties with the decryption key can read the original information.

Basic Purpose

  • To protect the confidentiality of data (at rest and in transit).

  • Ensures data remains unreadable and secure, even if intercepted by unauthorized individuals.

  • Using strong industry standards Encryption.

Essential Components

  • Using Strong Encryption Algorithms

    • Data at rest: Encrypting databases , and back ups.

    • Data in transit: Security communication over networks

  • Review the key: Manage them securely , prevent them from comrpomising, Store secure, regular rotation.

  • Wireless Networks: verify Enterprise authentication methods.

    • Verify wpa2 and wpa3 implemented and configured properly

  • Ensure to conduct audit for encryption policies, and unencrpted systems.

How to recommend Remediation

  1. Assess Use: Asses to data storage, data transmison policy; assess standard algorithm is implemented.

  2. Review Key: Key Management , and if Keys are rotated to prevent from compromising.

  3. Audits: Ensure that you conduct audit for compliance with regulation.

Patch Management Recommendations

Defined

  • A process of tracking managing applying patch in a controlled way.

  • Sometimes technology limitations, require to use putting compensating controls insted.

Core Aspects

  • Ensuring systems are updated with latest version , maintain secure. And the process helps stability by addressing know issues with software and hardware.

How ot recommend Remedation

  1. Compherhensive batch mangmeent proper.

  2. Test Control environment and documented which part have been applied.

  3. Ensure and update Patch mangment.

  4. And conducting test session.

Example

  • Suppose is a critical new bility , the patch mangment begin the and find the patch.
    Once the verified deploy a scheduled maintances

  • records are updated, after , and if not mitigate to controls and reduce the risk.

Process Level Remediation

Definition

  • Resolving security findings by changing how a process is carried out rather than directly modifying or patching the underlying systems.

    • Often used when technical challenges make it difficult to alter the systems themselves.

Basic Aspect

  • Adjusting workflows or methods to enhance security without requiring significant changes to the underlying technology.

    • Useful in legacy systems or constrained environments.

Key Characteristics

  • Focus on altering operational procedures.

    • Migrate from non-secure channels (Telnet) to secure channels (SSH).

Recommendations to pentest

  • Identify process with security risk that is implement

  • Conduct regular Training sessions.

Administrative Controls Overview

Role Based Access Control

  • Permissions are based on assigned groups.
    Based on those groups or roles.

Minimum password requirements

  • Depending on password configuration will result in increasing, or decreaing from attacking

  • Strong password with acceptable length and complexity

Secure software policy cycle

  • if the organization is their own application you provide security with their engagement
    Goal of software development is to determine what will be successful and test , release it and support this throughout it's ife cycle.

Physical security controls

  • often physical accessing if easier to remote access.
    alot more organizations call form social engineering attacks.
    Overcomig prevent mechanisms of employee training. Is also great investment

  • Implement the video surveillance and prevent detection to figure out to are.

operation Controls

  • With operation controls is using job rotation and user training and time of the these all should to have make essential make impact security