>> Endpoint Security Hardening, Part 2.
The learning objectives for this lesson
are to differentiate secure boot configurations,
to explore hardware-based encryption technologies,
and to explore host-based protection technologies.
Let's get started. Secure boot configurations.
Currently, we have two main types
of secure boot configurations.
The first is the basic input/output system, or BIOS,
and also the unified extensible
firmware interface or UEFI.
Both of these are designed for
the booting and the loading of an operating system.
They could be for both computers or other devices.
BIOS uses the Master Boot Record,
or MBR, for boot information,
whereas the UEFI uses
a GUID partition table known as the GPT.
UEFI is more advanced and
allows for boot integrity checks.
Trusted Platform Module or TPM.
These are specifications for
hardware-based storage of encryption keys,
hashed passwords, and other identification data.
It's part of a chipset or also it
could be an embedded function in the CPU.
Each TPM has a hard-coded, unique,
and unchangeable asymmetric private
key known as the endorsement key.
This is used to create subkeys.
However, when a TPM owner takes ownership of
the TPM and this will destroy the subkeys.
TPMs are becoming more and more common because it is
an embedded technology that's already built onto
our device to allow us to store keys,
and it did cause some problems
when Windows 11 came out because
Windows 11 was stating that you
had to have a TPM to be able to use it,
and this caused problems for a lot of
people who had older computers that
might not be able to
migrate over to Windows 11 because of that.
We could also use secure boot.
This prevents computers from being
hijacked by a malicious operating system.
It's configured with a digital certificate from
a valid operating system vendor and then the
firmware checks the bootloader to
ensure that the certificate is valid.
This requires UEFI, but not a TPM.
We can also use measured boot.
This uses platform configuration registers,
or PCRs, that are in
the TPM at every stage of the boot process.
It validates the hashes of key
>> boot firmware, bootloader,
>> kernel, and drivers to
ensure that they have not been
altered during the boot process.
Hardware-based encryption technologies,
attestation services.
These are hardware-backed attestation that ensure
the integrity of
the startup and runtime operations of a device.
We can use remote attestation services that provide
a central way of interfacing
with these locally installed devices.
OEMs will add a secure boot data portion to
the nonvolatile RAM or
NVRAM during the manufacturing of the device.
This will contain the signature database,
the revoked signature database,
and the key enrollment database.
Hardware security module, or HSM.
These are network appliances that offer
centralized PKI management for the network.
They can offer key escrow for devices.
Comparing them to a certificate server,
a hardware security module offers
a smaller attack surface and they're also tamper-evident.
This helps to protect against insider threats.
The form factor these devices come
in could include rack-mount,
plug-in PCIe adapters,
and also USB peripherals.
The trusted computing group, or TCG,
maintains a list of self encrypting drives known as SEDs.
They have their own specs for this and they're known
as the TCG Opal 2.0.
Opal 2.0 is designed to be completely
transparent to the system or the operating system.
It incorporates FIPS 140-2
and IEEE 1667 encryption standards
and it uses an onboard encryption processor
to keep the contents of the hard drive encrypted.
Host-based protection technologies. Now,
we're all familiar with antivirus software and
originally this was just signature-based
that would scan files looking to see if anything
matched the signatures that were
in the antivirus database,
but now antivirus software has evolved
and to become anti-malware software, but not only that,
the techniques that it uses to find different points of
attack or malicious activity have
also improved over time as well.
Now, we're looking to see
if processes are being launched
and we can intercept them
and then it will look for a signature match.
We're also not looking just for viruses
anymore because now we need to look for trojans,
spyware, rootkits, and ransomware.
The Common Malware Enumeration, or CME,
this is where malware will be
tagged with an identifier so that it can be
researched for its symptoms and
its methods and that the malware will be used,
and we can use this to help
update our technology to ensure that when
a new technique is noticed that
we're able to create a way of
preventing that or catching
it and then pushing that out to
our customers through their anti-malware software.
We can also use application controls.
This determines which software
can be run and also by whom.
The software can be limited to
run only during work hours and then from
certain directories and then only if it
matches a specific digital signature.
We can use this to block software installs as
well through the use of allow list and block lists.
This is a very handy type thing
to use where, for example,
in some of our sites that use electronic medical records,
we have those EMR set to not be allowed to be
used on workstations after business hours.
The computer stay on because they need to be updated or
have different things ran on
them as part of managed services,
but no one needs to be accessing the EMR.
A lot of times when an attacker would get in,
they can login to the EMR and then steal the data through
that workstation and then just
send it straight out of the network.
There's no reason for that type of
thing to be running after business hours,
so we set those not to be able to be run.
We can also use host-based firewalls.
This is a firewall that's run on
a single host and it will protect that host only.
It's not a network firewall.
It will use packet filtering,
ACLs to allow or block traffic on that given host.
We can also use redundant and self-healing hardware.
This is because we need availability for our devices.
Availability is critical,
it's part of the CIA triad.
We can use redundant components,
such as power supplies, or drives,
and even computers in clusters to help
ensure that we have a level of redundancy there.
Self-healing hardware can detect
and react if components are
going to fail in a way
that allows for continued operation.
It can also be pre-emptive by
detecting and then alerting to an impending failure.
A good example of this at
a very basic level are redundant power supplies.
A lot of servers can come with
two power supplies in them and if one fails,
the other automatically picks up and
keeps on going and then you
get an alert to let you know that you need to
come and replace the one that died.
This is a really good way to
ensure the server stays up and running.
If you're looking at keeping
critical devices up and
running because sometimes it's not just a server,
you might need redundant firewalls.
When you're looking at this, you need to decide
what is critical and then what can you
put into it that would allow it to stay up and
running given specific failures that
you've determined in your risk assessment would
be likely or possible in your scenario.
Just like we have intrusion
detection systems for the network,
we also had them for our hosts.
Host-based intrusion detection systems or
HIDS are similar to the ones we use on our network,
but they're only on a single system.
They're going to monitor the OS logs, files,
and processes and they may also use
file integrity monitoring because
certain files in the system should never change,
and if they do, that could be
an indication of malicious activity.
Host-based intrusion prevention systems,
or HIPS, do the same thing,
but they also add the ability to respond to the anomalies
by either stopping the processes
are blocking the traffic.
We also can use endpoint detection and response, or EDR.
This is a centralized managed solution
and it's usually available from a Cloud portal that
monitors many systems at once and it's looking
for malicious activity across all the systems.
It will use artificial intelligence
and machine learning to monitor
user and system behavior and use that for analysis.
By watching all the devices in context,
a more realistic assessment can be formed.
Then once the assessment has
been determined to be malicious,
then it can respond and these responses are automated.
What's really interesting about this is you can have
these EDRs installed on your endpoints,
but they're also going to be installed on
tens of thousands of other end points around the world.
What this managed solution is
offering is they're scanning all of these at
the same time where someone in another country may be
exposed to a specific type of attack and
when the EDR responds to it,
they're going to be able to use
the machine learning and
the artificial intelligence to update
their own central detection system
and then push that out to all the customers.
You're getting the benefit in
almost real time of
an attack that happens nowhere near you,
but you're going to get the protection from it.
This is the new way, it
seems to be the industry is shifting
because we can react much faster to intrusions this way.
Finally, we have user and entity behavior analytics,
or UEBA.
They scan the indicators from
our intrusion detection systems and
logging systems looking for anomalies.
It's often integrated with our SIEMs.
It will use a baseline and then compare
the entity activity to that baseline.
Entities are machine accounts across devices.
It's dependent on AI to
reduce false positives because
you're going to get a lot of them,
especially in a large enterprise environment.
Examples of this would be
Microsoft Advanced Threat Analysis and
Splunk's UEBA. Let's summarize.
We discussed BIOS versus UEFI.
We also went over the Trusted Platform Modules or TPM.
We discussed various types of
host-based protection technologies
and hardware-based encryption technologies.
Let's do some sample questions.
Question 1, a blank can
filter network traffic from a single host and block
applications from connecting. Host-based firewall.
Question 2, sometimes it's
known as an allow/block list for applications,
this determines what apps are allowed to run and by whom.
Application controls.
Blank is a specification for
hardware-based storage of keys
that can be used for
encryption and identification purposes.
Trusted Platform Module, or TPM.
Finally Question 4,
TCG maintains the TCG Opal
2.0 specifications for this type of device.
Self-encrypting drives, or SEDs.
I hope this lesson was
helpful for you and I'll see you in the next one.