5.1 KiB
5.1 KiB
Host Security
- Common Criteria (CC)
- Security Target (ST)
- baseline: snapshot of the typical activity on your network on any given host.
OS Hardening
- Windows: Group Policy, Local Security Policy
- Unix: SystemV (AT&T), BSD (All the BSDS YES!)
- Linux: Many distributions.
- Patch Management - make sure you patch your shit yo
- Windows: Windows update to update the OS
- Linux/Unix: System package manager or recompile packages based on needs
- Hotfixes: specific customer request for a piece of software to be fixed. Usuaully hurried in nature.
- Windows: Service packs
- Windows Update Services: basically an update server that works like a proxy server. you can centralize and speed up windows updates times in your organization
- Firmware Updates: you have seen examples via IPMI updates on servers. Routers / Switches very important to have latest firmware updates applied.
- Driver updates: Make sure all the crapp windows software has been updated to latest drivers. linux will take care via the pkg manager.
- Endpoint Security: If they can't get to your individual hardended server because you have something like a firewall setup at your network endpoint, then you are doing it right!
- Physical Security: Access to USB port / network ports on servers, switches, routers
- Mac Filtering: Specifying which MAC addresses are allowed to connect to a specific network port.
- PNAC (Port Based Network Access Control) - performs some sort of authentication of the attached device before activating the port.
- EAPoL (Extensible Authentication Protocol over LAN) - authenticating devices using EAP or with PKI to pass authentication portion over to a RADIUS server. RADIUS server will check creds and give access denied or allow access. If access granted, switch will enable the VLAN tag that the port is setup with to enable network access.
Data Security
- data policy: describes the security controls that will be applied to protect data at each stage of its lifecycle.
- information classification and access control: unclassified (public) data, classified (private/restricted) data, confidential aka highly sensitive data, secret data, top-secret.
- classified, confidential, secret, and top-secret should be encrypted
- publication and distribution: storage and retrieval, distribution - what restrictions are there on making copies of the data, security - what is the security process if the document is compromised
- data states: data at rest, data in-transit, data in-use
- retention, storage, and destruction: retention aka archiving the data, destruction aka destroying the data
Personally Identifiable Information (PII)
Protect yourself from identity theft yo, limit the use of PII!
- PII - data that can be used to identify, contact, or locate an individual (or in the case of identity theft, to impersonate them).
- Examples: tattoos, social security number, usernames, passwords, email addresses, dobs, cc #
Data Encryption
Encrypt all the things
- file / folder encryption - many different filesystems that support encryption, efs and luks are some examples
- disk encryption: BitLocker, TrueCrypt(discontinued), Symantec Drive Encryption
- Hardware based encryption: TPM (Trusted Platform Module) - a little piece of hardware that stores the encryption key on it. starting to also be hardware based solutions that are meant to be installed as add-ons to bring load away from CPU.
- Removable media encryption: usb devices, yubikeys, many different kinds.
- Database encryption: most of the time it is better to encrypt files on the disk. encryption usually done at the column level so this is very CPU intensive.
Data Loss Prevention
Dont lose that data!
- a database that identifies confidential data that should not be lost.
- requires the following components: policy server - to configure confidentiality ruleset, endpoint agents - to enforce policy on client computers, network agents - scan communications at network borders and interface with web and messaging servers to enforce policy.
- rights management services: assigns file permissions based on different document roles(such as author, editor, or reviewer). Restrict printing and forwarding of documents, event when sent as file attachments, Restrict printing and forwarding of email documents.
Big Data
The new buzzword to throw around in todays IT world
- big data: an unstructured database set, usually setup into some sort of database management system.
Backup Plans and Policies
Do you have backups of your backups?
- backup types: full, incremental, differential
- keep your stuff backed up versionally - use version control, stupid.
- snapshots - meant to keep copies of open files, zfs, btrfs filesystems have this feature built-in to the filesystem.
- tapes: tapes are mainly used for archiving purposes. they use an autoloader to preload tapes. tapes are rotated. a good rotation policy - monthly, weekly, daily.
- is there an offsite backup solution in place?
- make you sure that you are testing backups to make sure you can restore everything from them