1

Infrastructure Hardening

2

Objectives

Why hardening infrastructure is important?

Hardening Operating Systems, Network and Applications

3

Security Baselines

The process of baselining involves both the

Configuration of the IT environment

Disabling of non-essential services

The baselining process involves the hardening the key components

Operating Systems

Network

Applications

4

Operating System Hardening

System is configured to limit the possibility of either internal or external attack.

While the methods for hardening vary from one operating system to another the concepts involved are largely similar regardless of whether Windows, UNIX, Linux, MacOS X or any other system is being baselined.

5

Operating Systems Hardening techniques

Disable Non-essential services - For example, unless a host is functioning as a web or mail server there is no need to have HTTP or SMTP services running on the system.

Update vendor supplied Patches and Fixes (Security Updates)

Password Management

Strong passwords

Enforcing the regular changing of passwords

Disabling of user accounts after repeated failed login attempts

Remove unnecessary accounts

Guest, unused and unnecessary user accounts

When employees leave an organization

6

Operating Systems Hardening techniques

File and Directory Protection – Through the use of Access Control Lists (ACLs) and file permissions.

File and File System Encryption –

All disk partitions are formatted with a file system type with encryption features (NTFS in the case of Windows)

Enable Logging - Operating system is configured to log all activity, errors and warnings.

File Sharing - Disable any unnecessary file sharing

7

Network Hardening

Updating Software and Hardware

Ongoing process

All networking software together with the firmware in routers are updated with the latest vendor supplied patches and fixes

Password Protection

Routers and wireless should be protected with strong passwords

Disable and remove unnecessary Protocols and Services –

For example, in a pure TCP/IP network environment it makes no sense to have AppleTalk protocols

8

Network Hardening

Ports

Unneeded ports blocked by a firewall and associated services disabled on any hosts within the network

For example, a network in which none of the hosts acts as a web server does not need to allow traffic for port 80 to pass through the firewall

Wireless Security

Wireless networks must be configured to highest available security level.

For older access points WEP security should be configured with 128-bit keys.

Newer routers should implement WPA security measures.

9

Network Hardening

Restricted Network Access

There should be a firewall between the network and the internet.

Other options include the use of Network Address Translation (NAT) and access control lists (ACLs).

Authorized remote access should be enabled through the use of secure tunnels and virtual private networks.

10

Application Hardening

All applications and services installed on network based host systems must be included in the security hardening process to ensure that they do not provide a weak link in the security defenses.

A number of common operating system based services are installed by default and need to be reviewed.

11

Web Servers

For non-public sites authentication methods should be put in place and for sites that are only to be accessible by internal users

Intranet approach should be used so that external access is prevented by a firewall

Secure web based transactions - SSL communication

Web server logs should be reviewed routinely for suspicious activity. Any attempts to access unusual URLs on the web server typically indicate an attempt to exploit problems in outdated or Unpatched web servers

Latest vendor supplied patches

12

Email Servers

Unneeded configuration options of the mail server software are disabled

All the latest vendor supplied updates are applied

Relay prevention options should be activated

Authentication must be used to ensure that only authorized users are able to send and receive email messages

13

FTP Servers

The purpose of the File Transfer Protocol (FTP) is to allow files to be downloaded from and uploaded to remote servers.

Access can be in the form of:

Anonymous FTP

Authenticated FTP

Anonymous FTP accounts should be used with caution and monitored regularly.

In the case of authenticated FTP it is essential that Secure FTP be used so that login and password credentials are encrypted, rather than transmitted in plain text.

14

DNS Servers

Domain Name Servers (DNS) provide the translation of human friendly names for network destination (such as a web site URL) to the IP addresses understood by routers and other network devices.

Steps should be taken to ensure DNS software is updated regularly and that all access to servers is authenticated to prevent unauthorized zone transfers.

Access to the server may be prevented by blocking port 53, or restricted by limiting access to the DNS server to one or more specified external systems.

15

Am I Vulnerable?

Have you performed the proper security hardening across the entire application stack?

Do you have a process for keeping all your software up to date? This includes the OS, Web/App Server, DBMS, applications, and all code libraries.Is everything unnecessary disabled, removed, or not installed (e.g. ports, services, pages, accounts, privileges)?Are default account passwords changed or disabled?Is your error handling set up to prevent stack traces and other overly informative error messages from leaking?Are the security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries understood and configured properly?

A concerted, repeatable process is required to develop and maintain a proper application security configuration.

16

Example Attack Scenarios

Scenario #1: Your application relies on a powerful framework like Struts or Spring. XSS flaws are found in these framework components you rely on. An update is released to fix these flaws but you don’t update your libraries. Until you do, attackers can easily find and exploit these flaw in your app.

Scenario #2: The app server admin console is automatically installed and not removed. Default accounts aren’t changed. Attacker discovers the standard admin pages are on your server, logs in with default passwords, and takes over.

17

Example Attack Scenarios

Scenario #3: Directory listing is not disabled on your server. Attacker discovers they can simply list directories to find any file. Attacker finds and downloads all your compiled Java classes, which they reverses to get all your custom code. They then find a serious access control flaw in your application.

Scenario #4: App server configuration allows stack traces to be returned to users, potentially exposing underlying flaws. Attackers love the extra information error messages provide.

18

How Do I Prevent This?

19

How Do I Prevent This?

20

How Do I Prevent This?

21

How Do I Prevent This?

22

How Do I Prevent This?

23

Questions

24

Security Training

Presentation prepared by

Nishi KumarSystems Architect

Processing Professional ServicesFIS

OWASP CBT Project LeadOWASP Global Education Committee