Securing and hardening a system is a vital skill for any system administrator. It involves applying best practices and tools to protect the system from unauthorized access, malware, data breaches, and other threats. In this article, we will cover some of the key steps and concepts that you should know to secure and harden a system.
One of the first and most important steps to secure and harden a system is to update and patch the operating system and the applications regularly. Updating and patching can fix vulnerabilities, bugs, and performance issues that could be exploited by attackers or cause instability. You should also enable automatic updates or use a tool like apt , yum , or windows update to manage updates and patches.
Automatic updates can be fraught with danger. You must have a very good testing pipeline in order to ensure you don't allow improper patches into a production environment, which can be even more risky than not patching at all!
Update the test environment first then run the regression/security tests. I prefer to create automated tests for this. Tools like Ansible are very useful for this.
"Prevention is better than cure ", I would start it in this way. There are a number of things that you can do to secure and harden your systems against cyberattacks. These include major key elements such as Patching operating systems and applications, Configuring firewalls and network security devices, Using strong passwords and multi-factor authentication, Encrypting data at rest and in transit Implementing intrusion detection and prevention systems Educating users about security best practices. The above key points if you taken it as very seriusly and implementing these security controls, you can help to secure and harden your systems.
Updating and patching the operating system and applications is a foundational step to secure and harden a system. Regular updates address security vulnerabilities, bugs, and performance issues that can be exploited by attackers or lead to system instability. This proactive approach prevents potential breaches and disruptions, enhancing overall system security. The use of tools like apt, yum, or Windows Update streamlines the management of updates and patches. Trusted sources for updates should be prioritized, and enabling automatic updates simplifies the process. By promptly updating and patching, individuals and organizations mitigate potential risks and ensure the stability and resilience of their systems
While updates and patching are essential activity to secure the server and also to meet the security compliance. However there are best practices to be followed before we actually patch the systems such as: - Collect system details and keep it handy for the reference in case things goes south. - Ensure you have recovery point of the system. - Review if there are any known bugs into the release. - Always test new patches on the non-prod environment first.
Another essential step to secure and harden a system is to configure the firewall and the network settings. A firewall is a software or hardware device that filters incoming and outgoing network traffic based on rules and policies. You should use a firewall to block unwanted or malicious connections, allow only the necessary ports and services, and monitor the network activity. You should also use a tool like iptables , ufw , or windows firewall to configure the firewall rules. Additionally, you should secure the network by using encryption, authentication, and VPN protocols.
It's very important to define clearly your enterprise policies and implement it . Based on your policies configure your firewall to authorize only essentials traffics and choose security Options of these traffics
If your network has applications that are accessible to the internet, firewalls and routers will only get you so far, especially with web applications. Implementing a proxy such as CloudFlare to shape, route and secure your web traffic can save you from headaches with built in WAF protections and DDoS mitigation technology.
Use one of the top 10 firewall appliances, some are self explanatory, some come with support. This will block unauthorized traffic from reaching your systems.
In addition to well-configured firewalls and networks, it's important to configure limits on things such as failed logons. Windows accounts can be configured to prevent further logon attempts after a certain number of failed attempts using local security policy or group policy objects, and Linux systems can have the same configured via packages such as Fail2ban. This can dramatically slow down threat actors spraying passwords, giving time for these attempts to be identified, investigated, and remediated.
It is highly advisable to establish a protective layer in front of your infrastructure. This should include the use of firewalls, DDoS attack mitigation, and other security best practices to safeguard our infrastructure from malicious actors. Additionally, we must define finely-tuned access policies that restrict user access to our infrastructure, ensuring a high level of security.
A third step to secure and harden a system is to implement user and file permissions. User permissions control what actions and resources a user can access on the system. File permissions control what operations a user can perform on a file or a directory. You should use user and file permissions to limit the privileges and access of users, especially the root or administrator accounts. You should also use a tool like useradd , usermod , chmod , or chown to manage user and file permissions.
By default Filesystems provide permissions on files . We can enforce it (essentially on shared Files) by NTFS permissions settings on Windows Native Filesystem permissions, POSIX Access Lists, Attributes on Linux
When it comes to managing user access and file permissions, consistency is important. To avoid individual permissions from getting configured one way for one user, and another way for another user merely by mistake, it's best to implement Role-based Access Controls (RBAC) and, where possible, manage permissions via group membership rather than directly assigning. Manually managing permissions for every user introduced a higher likelihood for human error during administration, thus lessening security.
In organizations, users routinely transition through different roles. Using a well defined process that is based on their position rather then an individual (for example RBAC) can help keep a user's access aligned with a least priviledge model. Without this process, users tend to gather extensive access that may not serve any business purpose.
Containerization theory still the best practice; you only access what you need to access and nothing more. Need more access? talk to your superior (or the pope)
Filesystems are only as strong as the weakest link (usernames and passwords). When possible, enforce NIST compliant password policies, enforce password rotation and implement 2FA!
A fourth step to secure and harden a system is to install and run antivirus and anti-malware software. Antivirus and anti-malware software can detect, prevent, and remove viruses, worms, trojans, ransomware, spyware, and other malicious software that can infect or damage the system. You should install and run antivirus and anti-malware software regularly, update the definitions, and scan the system for any threats. You should also use a tool like clamav , malwarebytes , or windows defender to install and run antivirus and anti-malware software.
If your OS requires an anti-virus for basic operation, then you've already lost. The place for malware analysis is in your disassembler, not any production host.
Protecting your system? Remember: Update Regularly: Ensure your software and definitions are always fresh. Auto-Scans: Set it and forget it; your system will remember. Diversify: Combine tools like Clamav with Malwarebytes or Windows Defender. Stay Notified: Turn on alerts; knowledge is power! Web Protection: Activate it and browse with peace of mind. Smart protection = Safe surfing! ????
There is no 100% secure system (it's true) but when you have a system with more holes than a swiss cheese, there is no miracle. Antivirus and Antimalware help a lot, but when you have a fragile system and users with little to no technical knowledge, it′s a road to disaster (best to have a OS install disk at hand 24hs a day)
Adding an additional layer of security such as browser-based detection works pretty well at preventing malicious downloads, accessing websites with shady certificates and restricting what cookies and sessions webpages access on your devices.
An XDR software can be a powerful ally because they use of AI to detect anomalous behavior throughout all your infrastructure and report unified analysis in all domains. They are proactive in nature. Traditional antivirus solutions fall short detecting threats and are reactive in nature, they use a lot of hardware resources to scan, detect and update.
A fifth step to secure and harden a system is to backup and restore data. Backup and restore data is the process of creating copies of the system's data and settings and storing them in a safe location. Backup and restore data can help you recover from data loss, corruption, or theft in case of a disaster, attack, or error. You should backup and restore data regularly, verify the integrity of the backups, and test the restoration process. You should also use a tool like rsync , tar , or windows backup to backup and restore data.
Additionally, don't forget to test your backup restore points. It doesn't matter if you've backed up every night for the last ten years if something was misconfigured and the restore points are not usable when needed during a disaster recovery event! You can do this manually, with a script or other home-grown automation, or some platforms such as Veeam Backup & Replication have features which help to schedule and automate this validation.
Among the crucial aspects of a backup, ensuring secure storage and regulated permissions to access and restore backup data stand out. This data often holds security significance, and unauthorized access could potentially provide attackers with critical insights.
Hate to break it to you, your systems are probably already compromised. While prevention and detection are important, the ability to quickly recover is infinitely more important. Storage level snapshots are good, immutable backups are a must.
Always make sure to offsite or cold storage backups. This would be writing backups to tape, placing them in a read only system or writing them out to a cloud storage that does not share credentials with the rest of your environment. If your backups are on the same network as the rest of your environment it is subject to ransomware attacks.
Adding to this, consider integrating automated backup processes across multiple locations. This approach ensures crucial data is redundantly stored in various geographic regions, enhancing recovery capabilities and aligning with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). Furthermore, coupling automated backup with vigilant monitoring and notifications adds a proactive layer to data safety. This comprehensive strategy strengthens your overall system hardening approach, demonstrating a commitment to both preparedness and security.
A sixth step to secure and harden a system is to audit and monitor the system. Audit and monitor the system is the process of reviewing and analyzing the system's logs, events, performance, and behavior. Audit and monitor the system can help you identify and troubleshoot any issues, anomalies, or incidents that could affect the security or functionality of the system. You should audit and monitor the system regularly, enable logging and alerting, and use a tool like syslog , top , or windows event viewer to audit and monitor the system.
I have found it important to take the time to look deeply not just at performance bottlenecks in an environment, but also where a system may be over provisioned. Overprovisioning is a problem in many environments due to the ease of giving more resources to a system as a "just in case". A great way to help show the business impact of a monitoring system is to show how it can save money in an environment.
I would also consider using a monitoring solution like SCOM, where you can create a dashboard, reports and alerts. By using alerts in SCOM you can stop issues before they become a problem. you can also remediate errors by actions (running a command line / execute script or application).
Large environments are difficult to monitor with great efficiency. One tip is to configure systems to send their logs and events to a security or SIEM solution. These solutions can help analyze well know behaviors automatically as well as seeing trends across multiple sources that are not visible from an individual system's logs. These tools can also be set up with well-known alerts like logins of sensitive accounts, unsecure behaviors, etc. Investigate using a security framework (like CIS or NIST guidelines) to help structure your monitoring and auditing baselines.
Sometimes these tools cannot grow at the same pace as the business. It is very important to put the same effort to the scalability of your monitoring tools as the productive environment. Using technologies like Prometheus and Grafana you can add a layer of business intelligence to the data being collected for compliance or audit, and you have better overall visibility of the events to be able to react quickly and proactively.
Standard audit tool like auditd can be implemented to track changes on linux/unix filesystem and produce detailed report about it and identify area that needs to be improve
Hardening is not only software-wise activities. Hardware and surrounding play important roles as well. An instabile electricity, improper power supply, shortage of HA (RAID) and Air condition always affects the system and it’s services.
As with most things in security, we should always take a risk-based approach. Completing a Threat Modeling exercise will inform decisions around how much hardening is necessary and which additional layers of non-technical controls should be considered.
Security and configuration baseline for all systems is also important, this can be written in a certain procedure that contains all baseline configuration that should be implemented on any new or existing system.
Always good to keep your system up to date with patches and antivirus updates. Best practice is not to open emails from people you don’t know and report spam emails.
With continuous improvement methodologies you can be in constant review and testing of your internal processes. This way there will be less risk and faster changes to improve not only security but all internal processes and policies.