Security fundamentals

1. Security fundamentals Topic 2 Establishing and maintaining baseline security

2. Agenda • Trusted computing base • Evaluation and certification • Security baselines • Security templates and scripts • Maintaining a baseline

3. Trusted computing base • Represents the most secure computing environment that the organisation can provide • Includes all the protection mechanisms used to secure computing devices and infrastructure • Contains security baselines for specific computer systems • Baseline is the initial configuration that security is built on • Monitor the differences between your initial baseline and the current configuration and investigate causes

4. Trusted computing base goals • Ensures that only authorised people have access • They use systems in the manner intended • Data remains confidential

5. Trusted computing base components Includes all elements of the computing environment • Hardware – computers, peripherals and network devices • Firmware – BIOS chips • Software – operating system, application and custom • Procedures – administrative regulations, access control, backup schedules, training requirements

6. Creating a trusted computing base • Inventory all elements of computer security • Document all elements of computer security • Monitor and account for changes • Make changes and configuration management • Protect from new threats

7. Threats to a trusted computing base External threats: • Originate from outside the trusted computing base (not necessarily outside the organisation) • From attackers, natural disasters, insufficient enforcement Internal threats: • Problems with the trusted computing base • Inadequate monitoring (for changes and deviations) • Noncompliance with procedures • Poor design • Failure to update the trusted computing base

8. Evaluation and certification Compliance with formal standards for security • TCSEC – Trusted Computer System Evaluation Criteria • Orange Book set of standards for commercial operating systems • Several levels of security • C2 is the highest level for commercial systems • ITSEC – Information Technology Security Evaluation Criteria • Similar standards to TCSEC

9. Evaluation and certification Compliance with formal standards for security • Common criteria • CCITSE Common Criteria for Information Technology Security Evaluation • ISO standard • Set of processes for evaluating security features and capabilities • The security rating of a product evaluated in one country is recognised in other countries • ISO 17799 • Information security standard • Generic security policy that describes general security settings but not system specific configurations

10. Security baselines • A detailed description of how to configure and administer a device or systems so that it provides the best possible security • What hardware to use and BIOS settings • Procedures for physically securing a computer • Media to use for installing an OS or service, installation options and post installation configuration • Rules regarding content to be used • Procedures for reviewing the installation, monitoring and making changes to the configuration • Rules for who can access a server and authentication methods implemented • Documentation and record keeping requirements

11. Security baseline guidelines Guidelines for file systems • Use NTFS not FAT and use permission assignments for access control • Principle of least privilege • Only minimal permissions required to perform a specific task • Avoid Full Control and the Everyone group • Put users into groups and assign permissions to the group • Use permission inheritance- general permissions at a higher level and exceptions at a lower level • Assign permissions for local and network access • Encrypt files that must be kept private

12. Security baseline guidelines Guidelines for services/daemons • Every running service is a potential entry point • Enable only services that are required • Default configurations are not the most secure • Restrict the actions that can be performed by the service by running the system in a custom user account and not as administrator or root • Consider which services start automatically • Apply security updates • Secure files and configurations used by the service/daemon

13. Security baseline guidelines Guidelines for critical applications • Only use critical business applications • Typically email, database and accounting • Apply security updates • Secure files and configurations used by the service • Install only required components • Grant appropriate access levels

14. Security baseline guidelines Guidelines for other applications • Remove all unnecessary applications – reduce the surface area of attack • PS or task manager to list running processes • Ensure users don’t install unauthorised programs (standard user accounts) • Prevent users from accessing system and program files on the hard drive

15. Security baseline guidelines Guidelines for network communications • Disable unnecessary protocols • Network access • Restrict open ports • Enable packet filters • Require authentication to access network or network resources • IPSec to secure communications and require computers authenticate with each other • Encrypt network traffic • IPSec to encrypt for privacy • SSH (Secure Shell) • SSL (Secure Sockets Layer)

16. Security templates System security settings fall into the following categories: • Account policies: User accounts – password requirements, account lockouts, who can perform tasks • Local policies: How the system is audited, who can access logs, user rights assignment, and other settings • Event log: Who can access event logs, how event logs are sorted and retained • Restricted groups: Which users are members of which groups • System services: Specify start up behaviour and permissions for services • Registry: Sets permissions to access the registry • File systems: Set permissions to access specific files and folders

17. Scripts • Automated alternative to using security templates • Windows Scripting Host (WSH) • Shell scripts • Perl scripts • C scripts

18. Maintaining a security baseline Existing security benchmarks http://www.cisecurity.com • Remain informed about current threats and vulnerabilities • CERT/CC advisories • Mailing lists (eg SecurityFocus™, Bugtraq) • Hardware/software vendor websites • Update security baselines to reflect new emerging security requirements

19. Securing against known vulnerabilities Apply security updates: • Hotfixes: fast release for one or more issues, perhaps less testing of hotfix • Security Rollup Packages: several critical hotfixes with more testing • Service Packs: all fixes available and included in previous service packs – extensive testing

20. Securing against known vulnerabilities Acquiring security updates • Verify the authenticity of the update – is it really from the vendor? • Check digital certificates – guarantees it is from the author and that it hasn’t been modified • Checksums: hash MD5 computation to check integrity • Cryptographically sign the hash (eg with Pretty Good Privacy (PGP))

21. Summary • What a trusted computing base is • Security evaluation and certification criteria available • What security baselines are • Security templates and scripts that help automate security application • Practises for maintaining our baselines