- Welcome to lesson 14.
Given a scenario, apply common security techniques
to computing resources.
In this lesson, our first lesson in lesson 14, 14.1,
we're gonna focus in on securing baselines
and hardening targets.
Now, a secure baseline is gonna be a predefined set
of security configurations and practices
that are considered the minimum level of protection
for a system or a network.
Now, the purpose of a secure baseline
is to ensure that the fundamental security measures
are in place to protect against
common threats and vulnerabilities.
And it serves as our starting point
for establishing a secure environment.
And it can be used as a foundation to build upon.
The hardening is an ongoing activity.
It's the ongoing process of configuring security settings,
applying security patches,
and implementing least functionality,
we've talked about the principle of least functionality,
in order to reduce the system footprint,
minimize vulnerabilities
and exposure to threats and enhance resilience.
Now, if you're thinking, "I can't remember
what the principle of least functionality is,"
let's go through it.
The principle of least functionality
is that systems and devices should be configured
to provide only essential capabilities,
and specifically to prohibit or restrict the use
of any and all unnecessary functions, ports,
protocols, and services.
So let's look at some common hardening
and ancillary measures.
Physical, cybersecurity, redundancy,
backup, monitoring, assessments, testing and maintenance.
So physical is implementing security measures
to protect against physical attack.
Cybersecurity is implementing our firewalls,
our IDSs, our IPSs, our encryption,
our strong authentication.
Redundancy we just talked about in one of our last lessons.
Establishing redundant systems and failover capability.
Backup, which we talked about just earlier as well.
Having trustworthy copies of data and system configurations.
Monitoring, monitoring for threats
and any kind of anomalous activity.
Conducting assessments to identify new threats
and vulnerabilities.
Training, absolutely important.
Educating the user community
about potential threats and best practices.
And then certainly maintenance, which is timely maintenance
and firmware and software updates.
So we're gonna go through a number of very specific type
of hardening activities,
two different categories of systems,
devices, and infrastructures.
So we're gonna start with servers and workstations.
So three key things for hardening servers and workstations,
updates and patches, limiting admin privileges,
and encrypting our data.
We wanna make sure that we're regularly updating
the operating system, software and the firmware,
and we wanna apply patches promptly in alignment
with a severity level.
Now, I know there's always a lot of discussion
about does a patch have to go into a lab first
or should we try it on a subset of users?
And I think that all makes sense, except for my money,
when it's a critical patch,
I want it right out the door, right away.
I'm willing to take the other consequences
to know that I have patched a critical issue.
Then we also wanna limit administrative privileges
to prevent unauthorized system changes
and to minimize the potential impact of a compromise.
We know that an exploit, right,
happens in the security context
of the currently logged in user.
So we don't want a lot of admin privileges out there
that could be exploited.
And certainly, you know, the extreme of that,
of limiting admin privileges,
is moving to a zero trust environment.
And then encrypting our data.
To implement encryption for sensitive data at rest
and at transit.
And we can use FDE,
and that's full-disk encryption on workstations and servers
to protect data in case of physical theft.
Next, let's look at how we do some hardening
for embedded systems in IoT devices.
And of course, an IoT device is an embedded system,
but it has additional characteristics.
Physical security, which is securing access to the device
to prevent tampering.
Firmware updates to regular update embedded systems
and IoT devices with firmware updates.
And that's assuming that you can update the firmware,
just why it's so important to do that investigation,
that research early on before you buy the device
to make sure that it is upgradable.
And then secure configuration.
We wanna disable and remove any unnecessary service ports
or protocols to reduce the attack surface.
We also wanna make sure
that we're changing the default credentials.
And if we are only using passwords,
because maybe that's all it's allowing us to use,
that we're using strong, unique passwords.
For our switches and routers, three key things to do
is change our default credentials,
disable unused interfaces, and use secure protocols.
We wanna immediately change the default usernames
and passwords on switches and routers.
We've said this before, default credentials are well known.
They're published on the internet
and they're easily exploited by our attackers.
We wanna disable any unused interfaces.
So disable any unnecessary services
and interfaces on our switches and our routers,
again, to reduce the attack surface.
And lastly, we wanna use secure protocols.
We wanna disable insecure protocols such as Telnet,
which is clear text transmission and basic authentication,
and use secure alternatives like SSH, Secure Shell,
or HTTPS for remote management.
What about in the cloud?
Well, there's a lot we can do in the cloud,
but let's just talk about three things.
We can configure security groups
or use network access control lists, ACLs,
to control inbound and outbound traffic.
We can segment our cloud and subnets
to isolate different tiers of resources and applications.
And again, we're gonna circle back to encryption.
We wanna encrypt data at rest
and in transit within the cloud infrastructure.
Okay, circling back to our ICS,
our industrial control systems and SCADA systems.
What are our key hardening activities?
Well, thinking about isolation, secure remote access,
and limiting end-of-life, end-of-support.
So with isolation,
we wanna implement strict network segmentation
to isolate our ICS and our SCADA components
from other networks.
And we may also wanna consider air-gapping
critical ICS and SCADA components
from external or any untrusted network
to provide an extra layer of security.
For secure remote access,
we wanna limit access and use VPN's,
virtual private networks with strong encryption
and multifactor authentication, MFA, for remote access.
And of course, we wanna limit
end-of-life and end-of-support.
So we wanna maintain a schedule to ensure compliance
with end-of-life and end-of-support dates.
I should have had you start counting at the very beginning
of this course, how many times I was gonna say that to you.
And I'm probably gonna say it a couple more,
but I can't stress how important it is.
So there are some great resources out there
to help you with hardening.
So let's go through the resources that are available.
From the manufacturer or developer,
hardware manufacturers and software developers
often provide documentation and security guidelines
for their products.
Government resources.
We've looked at a lot of resources from NIST,
the National Institute of Standards and Technology already,
and they offer a ton more.
They offer resources and guidelines
related to all types of cyber and information security
and information technology,
and quite a few that relate directly to hardening security.
Industry alliances, industry alliances
such as the Cloud Security Alliance, the CSA,
and the IoT, the Internet of Things Security Foundation,
IoTSF, again, publish numerous hardening recommendations.
And then there are quite a few online forums
and communities that you wanna take advantage of and join.
Communities of cybersecurity professionals who share, right,
their in-the-field knowledge.
And you wanna become a sharer as well.
So as you gain more and more knowledge, you know,
participate in those online forums and communities
and share your knowledge.
All right, that, my friends,
brings us to a three-second challenge.
Are you ready?
Five challenge questions, three seconds each.
First one, number one.
A predefined set of minimum security configurations.
One, two, three.
That's gonna be our secure baseline.
Number two, the ongoing process of enhancing resiliency.
One, two, three, starts with the letter H.
That's gonna be hardening.
Number three, the principle that systems and devices
should be configured to provide only essential capabilities.
We've talked about this one quite a few times.
One, two, three, this is gonna be least functionality.
Number four, to disallow connections
to any untrusted network
or any trusted network that has connections
to an untrusted network.
One, two, three, of course, that's gonna be our air-gap.
And lastly, number five, a secure replacement for Telnet.
I only mentioned it in passing this time,
but we have mentioned it a number of times.
Secure replacement for Telnet.
Why do we wanna replace Telnet?
Because Telnet is a clear text protocol
with very basic authentication.
So what are you gonna replace it with?
One, two, three, and that's gonna be Secure Shell, SSH,
or for remote management, you may also consider HTTPS,
which is HTTP plus TLS.
Hey, that brings us to a Security-in-Action.
Looks like a pretty straightforward one here,
all about hardening.
You've been tasked with hardening the Windows servers
in your data center.
Where do you begin?
So that's a really simple question, right?
You've been tasked with hardening the Windows servers
in your data center, were do you begin?
Well, it sounds simple, but I don't know.
Where do you start?
Go ahead and put me on pause, write down your approach
and come on back and we'll talk through it together.
Well, first of all, we wanna determine
if there are any secure configuration baselines right now.
So before we start doing new things, let's see what we have.
If not, your effort's gonna need to be directed
to developing, getting authorization
and implementing new secure baselines.
Now, assuming there are secure configuration baselines,
you wanna check to see if there's currently
any hardening processes and/or documentation.
And if not, you're gonna wanna create them.
And then of course, you wanna do research and say,
"What are the best practices out there?"
You know, "What should I be doing for hardening
my Windows servers in the data center?"
And there's some great resources out there.
Resources for hardening Windows servers include Microsoft,
go out to their site, NIST,
the National Institute of Standard and Technology,
the Center for Internet Security, that's the CIS.
And if you haven't been there yet,
you definitely wanna go out to cisecurity.org.
It's a fantastic site
and it has all kinds of hardening baselines,
as well as taking advantage of community forums.
But if you are gonna make any changes
to the existing secure configuration baselines,
make sure that you follow the change control procedures
in your organization.
And then ultimately, if it's changing configurations, right,
we're going to have to make some version changes
or updates to our configuration management.
So knowing how to approach this
and then how to follow it all the way through
that, my friends, is security in action.
There is your word cloud.
There's quite a bit there,
but a lot of these aren't new topics.
A lot of these we've talked about a couple of times already
just within a different context.
But go ahead, go through all of these.
Make sure you can speak to them,
you're comfortable with them, you can explain them.
And when you're ready, head on over to the next lesson.
I'll be waiting for you there.