>> Endpoint Security- Hardening Part 1.
This is a big topic and I've divided it into
two lessons so that we can
make sure and cover everything.
The learning objectives for
this video are: discover hardening techniques,
define software patching and device protection,
and also explore mandatory access control.
Let's get started. Hardening is
the process of making changes to
the configuration of an operating system
or application to help secure it.
You create a standard or
a secure configuration for devices that allow
for all necessary apps to still
function but to secure the device.
The configuration should be
saved so it can be deployed again in the future.
Hardening Techniques.
The first step is to
remove unnecessary services and protocols.
For example, if you don't need
a web server software running on your computer,
then disable it, or if you can, actually remove it.
If the system doesn't need to send email,
remove all email server software.
Disable any network interfaces that aren't needed.
A lot of computers now will
come with multiple interfaces,
for example, an Ethernet port and a Wi-Fi port.
If you're using ethernet and not the Wi-Fi,
it's best to disable it so that attackers can't
use that as a back way in for your network.
Look for listening ports on the device,
and then block any that can't be
disabled with a host firewall.
Verify all user accounts on the device are
needed and they have the appropriate level of access.
A common problem in modern IT
today is what we call capability creep.
For example, at some point you may give
access rights to a user
when they only needed them temporarily,
but when that need was no longer there,
no one went back and removed
those capabilities or those access rights.
Over time, these accumulate until you have users
that have way more
privilege and access than they actually need.
The last one is disable
USB ports if they're not expressly needed.
This will help prevent people from
plugging in flash drives,
or maybe their mobile device to use as
an external device to help control data exfiltration.
Best Practice Configurations. Now,
this is already a fairly complicated process,
but there are groups that have published
best practice guidelines that
you can use for your own enterprise.
For example, the US
Department of Defense Security Technical
Implementation Guides or STIGs,
and the Center for Internet Security CIS benchmarks.
These have all the best practices
for a given operating system or
hardware device that you can use to
create your own best
practices guideline for your enterprise.
Patching. This is a big one.
Software vulnerabilities are discovered every day.
As we continue to increase
the number of software applications
that we're using on our PCs,
our mobile devices, our servers,
keeping up with all of those and making sure they're all
patched is a very daunting process.
What is required as a patch management process to
ensure that all the vulnerabilities are
patched in the appropriate timeframe.
Patch management can be manual,
automated, or be a combination of both.
To create a patch management program,
you're going to want to look at a few things.
The first is,
to have a specific person or team assigned
the responsibility for obtaining
and reviewing the security bulletins.
If you don't know there's a vulnerability
out there, you can't patch it.
Next is a way to patch
all devices regardless of their operating system,
or the applications that might be installed.
You also want to consider
patch management for your Cloud resources
that may not be the same as that
you would use on your local networks.
When you have all the patches available for you,
you want to review and classify the updates that
you're installing into urgent,
important, and non-critical.
You also want to have a way to test
patches before you actually deploy them to live systems.
I'm sure if you've been in IT for any length of time,
you have seen where
Microsoft updates have caused
machines to blue screen after they reboot.
This will help prevent that.
You can test the patches on
a little lab system or a lab network that you
create to ensure that it doesn't create
any additional problems for
you after the patch is installed.
Then you're going to want to have
logging capabilities to ensure
that once those patches are
installed it didn't create any new issues for you.
Then the ability to immediately
push out approved updates.
Finally, you want to do periodic evaluation and
then full rollouts for non-critical patches.
Preventative Security Measures.
These are extra little things you can do on
your systems to help prevent attacks.
The first one is local drive encryption.
This protects the data when the system isn't running.
For example, if you had a laptop that maybe
had some protected health information on it,
and the laptop was stolen,
then this would help protect the data on that laptop.
Some examples of this are Microsoft's BitLocker,
TrueCrypt, and Linux's cryptsetup.
Enable no execute and execute never.
These are set in the CPUs to keep areas of memory
separated that are designated for instructions or data.
Then lastly, disable CPU virtualization support.
This can cause issues for guest isolation,
and also allow data to leak
from one virtual machine to another.
Virtualization can also be used by
malware to help hide itself from detection.
Secure encrypted enclaves, memory encapsulation.
These are protected areas of
memory in a database engine that
only allows the data to be decrypted on the fly in a CPU,
a sock, or a protected region.
Shell restrictions control what
a shell is allowed to do. Pretty basic.
Then lastly, Access Space Layout Randomization,
ASLR, buffer overflow prevention controls.
These make it difficult to guess
the memory locations of executables in stored memory.
Moving onto mandatory access control.
Before we go into this,
I wanted to point out that the acronym
MAC is used for several things in IT and cybersecurity.
But in this particular occurrence,
we're using it for mandatory access control.
This is a fairly big item for the test.
Mandatory access control is
based on security clearance levels.
Then rather than setting
access controls on resources, instead,
every object and subject is
given an access level with its own label.
If you're using a hierarchical approach,
subjects may access anything in their level or below.
They wouldn't be able to go up a level.
Subjects may also not change
an object's label or rules on their own account.
One key thing to remember about
MAC is that it's non-discretionary.
That is a testable item.
SELinux. Execution control decides
what software or scripts may be installed on
a system beyond its current baseline configuration.
In Linux, this is achieved using
a MAC kernel module
known as the Linux Security Module or LSM.
SELinux is an example of an LSM.
AppArmor is another common example.
SEAndroid. Android uses MAC
through a process known as SEAndroid.
Apps are run in sandboxes.
This keeps them isolated from
each other and other parts of the system.
In addition, when apps are installed,
specific permissions are granted,
such as the access to SMS texting,
the ability to make calls, or view contacts.
If you're an Android user and you install an app,
you've probably seen this before when
the install process will tell you
this app is requesting the following permissions.
You can choose whether to allow or deny that from there.
Let's summarize what we discussed in this lesson.
We discussed system hardening,
and also the best practices for that;
how you can get resources online to help you create
your own hardening process in your own network.
Patch management, why it's important,
and how to go about doing it in your own organization.
Mandatory access controls,
and then we gave some examples
with SELinux and SEAndroid.
Let's hit some questions.
Question number 1, true or false?
MAC requires that all subjects be classified with labels?
This is true. That is a key item
for MAC is that
every object or subject have its own label.
Number 2, true or false?
Local drive encryption can prevent
a ransomware attack since
the encryption will prevent
the malware from reading your data.
This is false. Local drive encryption
only protects the data when the operating system is off.
If the operating system is running,
the malware can read the encrypted data
at the same access level that the
current logged in user can do.
It's not going to protect you from a ransomware attack.
Number 3, which of
the following is not a part of hardening?
Remove unnecessary services,
install the latest version of Microsoft Office,
verify all accounts on the system are necessary,
or close unnecessary ports.
This is a little bit of a trick question because if
Microsoft Office is necessary in your enterprise,
then you're going to want to deploy
the most current version when you deploy systems.
However, the test is usually
looking for what is the best answer,
and since not every organization uses Microsoft Office,
it would not be a part of
a hardening process that is
a generalized approach for everyone.
However, the other three,
removing unnecessary services, verifying all accounts,
and closing ports would be.
Number 4, true or false?
A patch management process should push out
all patches as soon as they're
available to decrease the chances of compromise.
This is false. Patches should first be
classified and then tested before deployment.