How can you harden your servers against malware and malicious software?

Make sure to update your servers and any software that is installed to the latest versions. Cyber threat actors will often exploit vulnerabilities to accomplish their objectives. If you have Windows Servers, utilize Windows Server Update Services (WSUS) to deploy updates when they are pushed out by Microsoft. You can also use vulnerability scanners such as Nessus to regularly scan for vulnerabilities so they can be identified and remediated.

Regularly updating software is indeed one of the most straightforward and effective measures for enhancing server security. By keeping the operating system, applications, and other components up-to-date, known vulnerabilities and bugs are addressed, thereby reducing the potential for exploitation by malicious entities. The use of automation tools for this process, such as Windows Update, yum, apt, or cron, is a prudent approach. It ensures consistency in updates and minimizes disruption by scheduling them during off-peak hours. This is a fundamental practice in maintaining robust cybersecurity defenses.

Security in layers! - Regular updates - OS + Apps - Disable ports and services that are not needed - EDR - not just antivirus - Full-stack firewall at the perimeter and endpoint (inbound and outbound rules) - Security Boundaries (VPC, VLANS, etc.) - BACKUPS (scheduled and tested) - IAM - (MFA where possible, strong passwords where the system does not support MFA) No generic accounts, and routinely audits access. - Continuous vulnerability and risk audit.

I think it's important to inventory what you have before you attempt to update or harden anything. Lists such as this often assume naively that you have a good handle on what you already have, but my experience is most brownfield organizations do not. Spend time to inventory both software and hardware assets, then make an appopriate patching and update schedule considering the availability and security requirements of the assets.

By combining the following measures, organizations can significantly strengthen their servers against malware and malicious software, reducing the risk of security breaches and data compromise. The measures are as follows; regular software and antivirus updates, firewalls and least privilege access authorization, data encryption with regular backups, monitor logs and ensuring app security, making sure to disable unnecessary services, and implementing segmentation.

Host-based firewalls are a must when protecting your servers. If this is a Windows Server, utilize Windows Firewall. If it’s a Linux Server, utilize iptables. It’s important to disable any ports and services on the server that aren’t necessary. Common ports to look at blocking or disabling are SMB (port 445) and Remote Desktop Protocol (RDP, port 3389). These are ports that can be used for lateral movement by cyber threat actors. I also recommend utilizing network firewalls for defense in depth, which block the traffic at the network layer as opposed to the application layer.

Effective firewall configuration is vital for server security. It should be set to permit only necessary traffic, blocking unauthorized or potentially harmful access. Regular reviews and adjustments of firewall rules are important to keep pace with new security threats and changing network environments. A well-configured firewall acts as a formidable barrier against malware intrusions. Start with a whitelist model ideally where everything is blocked and selectively allowed based on business needs.

Install reliable market tested antivirus and anti-malware software, configured to run regular scans and updates making sure real-time protection is enabled.

The malware of today is much more advanced and requires stronger defenses. I would recommend Endpoint Detection and Response (EDR) as opposed to traditional Anti-Virus (AV). EDR is considered the“next generation” of AV. It uses Artificial Intelligence and Machine Learning as opposed to signatures to detect malware. It also enables your IT staff to respond to the incident by quarantining the endpoint and collecting information from the endpoint that may aid in the investigation. You can use this on all endpoints, not just servers.

Proper configuration of a firewall is a critical step in server hardening. A well-configured firewall acts as a robust barrier, controlling incoming and outgoing network traffic based on predefined rules and policies. This helps in blocking potential threats and unauthorized access while allowing legitimate traffic. Utilizing tools like iptables, ufw, firewalld, or Windows Firewall for rule configuration is a sound approach. Regular review and auditing of firewall logs are equally important, as they provide insights into network activity and help in identifying suspicious or unauthorized actions. This practice is essential for maintaining a secure and resilient network environment

Implementing robust antivirus and antimalware solutions provides essential protection. These tools offer real-time monitoring and defense against known malware, with regular updates necessary to counteract new threats. Scheduling comprehensive system scans aids in detecting hidden malware, enhancing server security.

Set up a Next Generation firewall to filter incoming and outgoing network traffic. Configure the firewall to block all by default and allow only necessary services and ports. This Next Gen firewall usually comes with Intrusion Detection/Prevention Systems (IDS/IPS). It monitors the network traffic for suspicious activities and potential attacks, it can also take necessary action to prevent or mitigate threats.

Strong passwords, Multi-Factor Authentication (MFA), and separation of duties are essential for controlling access to your servers. I would recommend using the NIST recommended 16 character passphrases for everything including server access. You should always enable MFA to verify the user’s identity. You should also never use the same account you use to check your email and surf the internet with as the account you use to log into your servers. Always have separate accounts with different passphrases.

I would strongly endorse the implementation of access control measures as a vital component of server hardening. Access control is crucial in defining and regulating who can view or use resources in a computing environment. This approach is instrumental in mitigating unauthorized access and potential internal or external threats. The use of tools such as SSH, RDP, VPN, and LDAP for securing remote access and authentication aligns well with best practices. Furthermore, employing strong passwords, encryption, and multi-factor authentication is paramount in safeguarding credentials and sensitive data. These measures are fundamental in establishing a robust security posture for any organization's server infrastructure.

When implementing access control, be sure to consider the firewall setup above. It is generally not wise to expose anything directly to the internet that you cannot keep patched and up to date immediately. Access control should be as fine grained as you can make it, and you should certainly not use administrative accounts for everyday activity.

Rigorous access control policies are key to server security. Applying least privilege principles restricts user access to essential functions, reducing the risk of malware infiltration. Strong password policies and multi-factor authentication, especially for administrative accounts, further fortify access control measures, safeguarding against unauthorized entry.

User access control is very important for keeping away unauthorized users. Implement multi-factor authentication (MFA), and limit remote access with secondary authentication.

Continual monitoring of server operations helps in early detection of malware symptoms, such as unusual resource usage, anomalous network traffic, or unauthorized access attempts. Implementing effective monitoring systems that alert administrators to suspicious activities enables quick response, mitigating malware impacts.

Regularly review server logs to detect anomalies or signs of a security breach. Log analysis can provide early indications of suspicious activities that may require investigation.

Immutable backups are table stakes these days to even get cyberinsurance. Typically in a backup situation we want to follow a 3-2-1 rule. This rule dictates that you maintain 3 copies of your data (One primary, two backups) across two different media (Could be seperate disk libraries, or disk and tape) and one of them should be offline or immutable to ensure it is not destroyed with the primary data by threat actors.

Regularly back up critical data, and store backups securely. In the event of a malware attack or system failure, having up-to-date backups is crucial for quick recovery without significant data loss.

Not to mention, your backups should be stored in distinct physical locations at least a mile apart but ideally in different countries.

Develop and strictly follow strong configuration architecture for backups management. This lets you recover quickly in the event of a malware attack or data loss.

Implement CIS controls. Begin by reviewing which CIS control set to apply to the server based on OS and role. Analyse each control contained within the chosen set with service owners, security, and IT/infrastructure teams to determine which are applicable to the specific server, as some will not be required or cannot be applied based on existing business needs. Once the specific controls within the set are determined to be applicable, enact these controls using a custom GPO applied to the OU containing the servers to ensure they are always applied. Use a product such as Tenable to scan for CIS configuration settings to evidence compliance with controls for reporting and ongoing monitoring.

If possible and applicable, consider using the 'immutable infrastructure' approach, where ideally everything is defined in code and deployed and maintained via automated pipelines. This way all the maintenance is moved to the definition phase and becomes more testable.