How do you secure and harden a system?

Automatic updates can be fraught with danger. You must have a very good testing pipeline in order to ensure you don't allow improper patches into a production environment, which can be even more risky than not patching at all!

Update the test environment first then run the regression/security tests. I prefer to create automated tests for this. Tools like Ansible are very useful for this.

"Prevention is better than cure ", I would start it in this way. There are a number of things that you can do to secure and harden your systems against cyberattacks. These include major key elements such as Patching operating systems and applications, Configuring firewalls and network security devices, Using strong passwords and multi-factor authentication, Encrypting data at rest and in transit Implementing intrusion detection and prevention systems Educating users about security best practices. The above key points if you taken it as very seriusly and implementing these security controls, you can help to secure and harden your systems.

Updating and patching the operating system and applications is a foundational step to secure and harden a system. Regular updates address security vulnerabilities, bugs, and performance issues that can be exploited by attackers or lead to system instability. This proactive approach prevents potential breaches and disruptions, enhancing overall system security. The use of tools like apt, yum, or Windows Update streamlines the management of updates and patches. Trusted sources for updates should be prioritized, and enabling automatic updates simplifies the process. By promptly updating and patching, individuals and organizations mitigate potential risks and ensure the stability and resilience of their systems

While updates and patching are essential activity to secure the server and also to meet the security compliance. However there are best practices to be followed before we actually patch the systems such as: - Collect system details and keep it handy for the reference in case things goes south. - Ensure you have recovery point of the system. - Review if there are any known bugs into the release. - Always test new patches on the non-prod environment first.

Yes, it's very important to make system and applications updated to fix new vulnerabilities. To make easier the task I use task Schedulers (cron on Linux) to plan updating on the best period to avoid troubling users

It's very important to define clearly your enterprise policies and implement it . Based on your policies configure your firewall to authorize only essentials traffics and choose security Options of these traffics

If your network has applications that are accessible to the internet, firewalls and routers will only get you so far, especially with web applications. Implementing a proxy such as CloudFlare to shape, route and secure your web traffic can save you from headaches with built in WAF protections and DDoS mitigation technology.

Use one of the top 10 firewall appliances, some are self explanatory, some come with support. This will block unauthorized traffic from reaching your systems.

In addition to well-configured firewalls and networks, it's important to configure limits on things such as failed logons. Windows accounts can be configured to prevent further logon attempts after a certain number of failed attempts using local security policy or group policy objects, and Linux systems can have the same configured via packages such as Fail2ban. This can dramatically slow down threat actors spraying passwords, giving time for these attempts to be identified, investigated, and remediated.

It is highly advisable to establish a protective layer in front of your infrastructure. This should include the use of firewalls, DDoS attack mitigation, and other security best practices to safeguard our infrastructure from malicious actors. Additionally, we must define finely-tuned access policies that restrict user access to our infrastructure, ensuring a high level of security.

Secure Network is very important for any organization. Prepare a network and firewall plan / policy on enterprise level and then implement it on standard way, It is better if we define policies as per department / tiering level / servers / desktops / CXOs.

Firewall are a good security tool (just see The Great Firewall of China as example), but if you dont know what your userbase are accessing, the solution will be a burden, Best to know first what you userbase are accessing than configure a Firewall in live mode

See if your Firewall has other active protection features you can enable like IPS/IDS to investigate traffic in real-time. Enable these features to receive content updates so they are scanning for newer threats often. Send Firewall logs to a security or SIEM tool that can help supplement your analysis of logs to help identify risky behaviors or trends. Another tip would be to place just as much log auditing importance on your outbound traffic as you do your inbound. Seeing if your outbound traffic is connecting to risky endpoints could indicate areas of risk.

By default Filesystems provide permissions on files . We can enforce it (essentially on shared Files) by NTFS permissions settings on Windows Native Filesystem permissions, POSIX Access Lists, Attributes on Linux

When it comes to managing user access and file permissions, consistency is important. To avoid individual permissions from getting configured one way for one user, and another way for another user merely by mistake, it's best to implement Role-based Access Controls (RBAC) and, where possible, manage permissions via group membership rather than directly assigning. Manually managing permissions for every user introduced a higher likelihood for human error during administration, thus lessening security.

In organizations, users routinely transition through different roles. Using a well defined process that is based on their position rather then an individual (for example RBAC) can help keep a user's access aligned with a least priviledge model. Without this process, users tend to gather extensive access that may not serve any business purpose.

Containerization theory still the best practice; you only access what you need to access and nothing more. Need more access? talk to your superior (or the pope)

Filesystems are only as strong as the weakest link (usernames and passwords). When possible, enforce NIST compliant password policies, enforce password rotation and implement 2FA!

If you automate your RBAC environment, user groups, roles and key accesses, you will reduce the risk for human error and thus have a better security and better chance of being in compliance with less risk and effort.

Use different local admin passwords on every system! I cannot overstate the importance of this :) LAPS is the simplest solution.

Use the principle of least privileges. This means giving users and applications only the permissions they need to do their jobs. Create departmental user group or group users by their task. This plays major role in system admin and user support.

Accessing the system as root from a terminal session should be denied to avoid error manipulation and command execution that could completely destroy your system. Root access should only be accessible from console (IPMI, hyper-v, vmware, kvm...) for maintenance purpose. Giving root access for a user should be done through sudo only and maintain by system administrator. Local user account creation should be avoid (especially in pre-prod and prod environment). They should be manage through LDAP (or other tools like keycloak) with AD connexion. Right permissions should be implemented depending on user profile with restricted access using ACL or RBAC. Audit should be implemented to track changes on the system by using standard (audit...)

If your OS requires an anti-virus for basic operation, then you've already lost. The place for malware analysis is in your disassembler, not any production host.

Protecting your system? Remember: Update Regularly: Ensure your software and definitions are always fresh. Auto-Scans: Set it and forget it; your system will remember. Diversify: Combine tools like Clamav with Malwarebytes or Windows Defender. Stay Notified: Turn on alerts; knowledge is power! Web Protection: Activate it and browse with peace of mind. Smart protection = Safe surfing! 🌐💻

There is no 100% secure system (it's true) but when you have a system with more holes than a swiss cheese, there is no miracle. Antivirus and Antimalware help a lot, but when you have a fragile system and users with little to no technical knowledge, it´s a road to disaster (best to have a OS install disk at hand 24hs a day)

Adding an additional layer of security such as browser-based detection works pretty well at preventing malicious downloads, accessing websites with shady certificates and restricting what cookies and sessions webpages access on your devices.

An XDR software can be a powerful ally because they use of AI to detect anomalous behavior throughout all your infrastructure and report unified analysis in all domains. They are proactive in nature. Traditional antivirus solutions fall short detecting threats and are reactive in nature, they use a lot of hardware resources to scan, detect and update.

Additionally, don't forget to test your backup restore points. It doesn't matter if you've backed up every night for the last ten years if something was misconfigured and the restore points are not usable when needed during a disaster recovery event! You can do this manually, with a script or other home-grown automation, or some platforms such as Veeam Backup & Replication have features which help to schedule and automate this validation.

Among the crucial aspects of a backup, ensuring secure storage and regulated permissions to access and restore backup data stand out. This data often holds security significance, and unauthorized access could potentially provide attackers with critical insights.

Hate to break it to you, your systems are probably already compromised. While prevention and detection are important, the ability to quickly recover is infinitely more important. Storage level snapshots are good, immutable backups are a must.

Always make sure to offsite or cold storage backups. This would be writing backups to tape, placing them in a read only system or writing them out to a cloud storage that does not share credentials with the rest of your environment. If your backups are on the same network as the rest of your environment it is subject to ransomware attacks.

Adding to this, consider integrating automated backup processes across multiple locations. This approach ensures crucial data is redundantly stored in various geographic regions, enhancing recovery capabilities and aligning with Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs). Furthermore, coupling automated backup with vigilant monitoring and notifications adds a proactive layer to data safety. This comprehensive strategy strengthens your overall system hardening approach, demonstrating a commitment to both preparedness and security.

There is a phrase that say "When you have a one backup, you have none..." but is worst when if this lone Backup are in the main site (just remember the WTC in New York in 9/11, how many companies have ceased to exist because the main HQ was in the towers and the main IT structure was located there without any second Backup site)

If you have Backup & DR systems but do not test them, you are falling behind. Testing these and ensuring your business can come back online in a certain timeframe with a developed plan is critical!

A well thought out disaster recovery plan is essential to any enterprise looking to protect not only the data, but the reputation of the business. Having a way to protect data is important, but having a methodology to continue working alongside the disaster is essential for the business to survive.

While backup of data and system always proves to be love saving in critical situations. However the backup must be scheduled at the when it can be executed with more accuracy this will help us to get more successful restoration cases e.g. we don't want to backup at the time when the files/data are constantly modified this may leave us with inconsistent data.

I have found it important to take the time to look deeply not just at performance bottlenecks in an environment, but also where a system may be over provisioned. Overprovisioning is a problem in many environments due to the ease of giving more resources to a system as a "just in case". A great way to help show the business impact of a monitoring system is to show how it can save money in an environment.

I would also consider using a monitoring solution like SCOM, where you can create a dashboard, reports and alerts. By using alerts in SCOM you can stop issues before they become a problem. you can also remediate errors by actions (running a command line / execute script or application).

"Defender for Endpoints" is a powerful tool for finding other vulnerabilities and detecting behavioural changes which may be a threat that is otherwise escaping conventional AV, all in a streamlined dashboard with advanced Threat Hunting queries you can run. Now available on Server OS from non-Azure machines via Azure Arc.

Large environments are difficult to monitor with great efficiency. One tip is to configure systems to send their logs and events to a security or SIEM solution. These solutions can help analyze well know behaviors automatically as well as seeing trends across multiple sources that are not visible from an individual system's logs. These tools can also be set up with well-known alerts like logins of sensitive accounts, unsecure behaviors, etc. Investigate using a security framework (like CIS or NIST guidelines) to help structure your monitoring and auditing baselines.

Sometimes these tools cannot grow at the same pace as the business. It is very important to put the same effort to the scalability of your monitoring tools as the productive environment. Using technologies like Prometheus and Grafana you can add a layer of business intelligence to the data being collected for compliance or audit, and you have better overall visibility of the events to be able to react quickly and proactively.

Standard audit tool like auditd can be implemented to track changes on linux/unix filesystem and produce detailed report about it and identify area that needs to be improve

Hardening is not only software-wise activities. Hardware and surrounding play important roles as well. An instabile electricity, improper power supply, shortage of HA (RAID) and Air condition always affects the system and it’s services.

As with most things in security, we should always take a risk-based approach. Completing a Threat Modeling exercise will inform decisions around how much hardening is necessary and which additional layers of non-technical controls should be considered.

Security and configuration baseline for all systems is also important, this can be written in a certain procedure that contains all baseline configuration that should be implemented on any new or existing system.

Always good to keep your system up to date with patches and antivirus updates. Best practice is not to open emails from people you don’t know and report spam emails.

With continuous improvement methodologies you can be in constant review and testing of your internal processes. This way there will be less risk and faster changes to improve not only security but all internal processes and policies.

I secured my system with Archers and an Alligator Pit—bringing in the coldest, hardest Gators from Florida. No trouble so far.

Some of the best ways to ensure your systems are secure is to leverage compliance benchmarks (like CIS) and compliance as code/policy as code automated configuration tools such as Puppet or Ansible. These tools remove the human risk factor of missing configurations. In addition, tools like Puppet perform drift remediation to ensure systems stay compliant even if something changes a configuration after the fact.

Always remember to harden the delivery service (IIS, Apache, HTTPD JBOSS etc...) with such items as enabling production configurations, provising virtual hosts and deadending unknown hosts & directory security etc... Firewall backend services to only accept connections from their upstream services. Enable authentication even if the traffic is "internal" for the likes of memory caching or ELK. Always encrypt the internal connections or segregat the traffic into private spesfic VLANs. Run a WAF for added hardening to stop SQL injections etc...