SynerComm's Tech TV series CIS Top 20 Critical Security Controls #3
1 like551 views
The document discusses securing hardware and software configurations according to Critical Security Control 3. It recommends establishing standard secure configurations for operating systems and applications through hardening guides. Master images should be stored securely and configurations enforced through automated tools to prevent unauthorized changes. Free tools mentioned include CIS benchmarks and FOG for imaging, while commercial tools include Qualys for compliance assessments and Deep Freeze for image management. The overall message is that organizations must securely configure all systems according to standards and manage configurations over time through automation.
SynerComm's Tech TV series CIS Top 20 Critical Security Controls #3
- 1. Tech TV Series COLLABORATE, INNOVATE, VALIDATE CIS Top 20 #3 Secure Configuration of Hardware and Software Lisa Niles – CISSP, Chief Solution Architect 1
- 2. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • Critical Governance and the CIS Critical Security Controls 2
- 3. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • How the CIS Critical Security Controls can help? 3
- 4. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • Sample: • Governance item #1: Manage the known cyber vulnerabilities of your information and make sure the necessary security policies are in place to manage the risk. • At a minimum, you should be able to identify and manage the large volume of known flaws and vulnerabilities found in information technology and processes. The flowing CIS Critical Security Controls are the primary means to establish a baseline of responsible practices that can be measured, managed and reported. • CSC3: Secure Configurations of Hardware and Software • CSC#4: ContinuousVulnerability Assessment and Remediation 4
- 5. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • CIS CSC focus on various technical aspects of information security • Outside of the technical realm, a comprehensive security program should also take into account: • Numerous additional areas of security • Policies • Procedures • Process • Organizational structure • Physical security. 5
- 6. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE • What am I trying to protect? • Where are my gaps? • What are my priorities? • Where can I automate? 6 CIS Top 20 Critical Security Controls
- 7. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 7
- 8. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 8
- 9. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls Implementing the Controls: • Carefully plan • Organizational structure • “Governance, Risk, and Compliance (GRC)” program. • Program managers 9
- 10. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 10 Basic Security Hygiene (Back to the Basics!) • Know what you have (Inventory HW &SW) • Limit what you don’t NEED (EOL, Services, Networks, Rights) • Update your software • Secure Default Configurations • Employ Process Controls
- 11. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 11
- 12. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE 12 CIS Top 20 Critical Security Controls
- 13. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE • Control #3 • Secure Configuration of Hardware and Software • Key Principle Control: • Establish, implement, and actively manage (track, report on, correct) the security configuration of laptops, servers, workstations, mobile devices using rigorous configuration management and change control process in order to prevent attackers from exploiting vulnerable services and settings. 13 CIS Top 20 Critical Security Controls
- 14. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE How to Get Started Step 1. Gap Assessment. Step 2. Implementation Roadmap Step 3. Implement the First Phase of Controls Step 4. IntegrateControls into Operations Step 5. Report and Manage Progress 14 CIS Top 20 Critical Security Controls
- 15. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE Why is CIS Control 3 critical? • CSC #3 is all about preventing exposure due to misconfiguration. 15 CIS Top 20 Critical Security Controls
- 16. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 16 System 3.1 Establish standard secure configurations of your operating systems and software applications. Standardized images should represent hardened versions of the underlying operating system and the applications installed on the system. These images should be validated and refreshed on a regular basis to update their security configuration in light of recent vulnerabilities and attack vectors. System 3.2 Follow strict configuration management, building a secure image that is used to build all new systems that are deployed in the enterprise. Any existing system that becomes compromised should be re-imaged with the secure build. Regular updates or exceptions to this image should be integrated into the organization’s change management processes. Images should be created for workstations, servers, and other system types used by the organization. System 3.3 Store the master images on securely configured servers, validated with integrity checking tools capable of continuous inspection, and change management to ensure that only authorized changes to the images are possible. Alternatively, these master images can be stored in offline machines, air-gapped from the production network, with images copied via secure media to move them between the image storage servers and the production network. System 3.4 Perform all remote administration of servers, workstation, network devices, and similar equipment over secure channels. Protocols such as telnet, VNC, RDP, or others that do not actively support strong encryption should only be used if they are performed over a secondary encryption channel, such as SSL, TLS or IPSEC. System 3.5 Use file integrity checking tools to ensure that critical system files (including sensitive system and application executables, libraries, and configurations) have not been altered. The reporting system should: have the ability to account for routine and expected changes; highlight and alert on unusual or unexpected alterations; show the history of configuration changes over time and identify who made the change (including the original logged-in account in the event of a user ID switch, such as with the su or sudo command). These integrity checks should identify suspicious system alterations such as: owner and permissions changes to files or directories; the use of alternate data streams which could be used to hide malicious activities; and the introduction of extra files into key system areas (which could indicate malicious payloads left by attackers or additional files inappropriately added during batch distribution processes). System 3.6 Implement and test an automated configuration monitoring system that verifies all remotely testable secure configuration elements, and alerts when unauthorized changes occur. This includes detecting new listening ports, new administrative users, changes to group and local policy objects (where applicable), and new services running on a system. Whenever possible use tools compliant with the Security Content Automation Protocol (SCAP) in order to streamline reporting and integration. System 3.7 Deploy system configuration management tools, such as Active Directory Group Policy Objects for Microsoft Windows systems or Puppet for UNIX systems that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals. They should be capable of triggering redeployment of configuration settings on a scheduled, manual, or event-driven basis.
- 17. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 17 CSC 3.1 Establish standard secure configurations of your operating systems and software applications. Standardized images should represent hardened versions of the underlying operating system and the applications installed on the system.These images should be validated and refreshed on a regular basis to update their security configuration in light of recent vulnerabilities and attack vectors. CSC 3.1 Procedure: Standardize configuration of operating system. The organization: 1. IT department to build hardened OS configuration data base. 2. IT department will update hardened configurations as high risk vulnerabilities are identified. 3. IT department will push confirmation updates out to active devices Metrics: 1. The IT department will maintain a list hardened configurations 2. The IT department will audit configurations monthly.
- 18. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE • CSC 3 Procedures andTools • Start with publicly developed, vetted, supported benchmarks, security guides or checklists: • CISecurity.org • NIST (checklists.nist.gov) • DISA STIG’s • Many tools available to measure (agent or agentless) 18 CIS Top 20 Critical Security Controls
- 19. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls •How to start.. • Automated discovery tool (MBSA) for Windows • Use you CSC #1 & #2 inventories • Network devices (Firewalls, switches, routers, wifi) • Create system baselines (CISecurity.org) 19
- 20. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 20
- 21. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 21
- 22. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-1 Establish and ensure the use of standard secure configurations of your operating systems. • FreeTools • DISA STIGs - DoD recommended secure systems baselines including phones, applications, OSes, network devices, etc... • MBSA - assessing missing security updates and less-secure security settings within MicrosoftWindows • Cisecurity.org Baselines, hardening guides and templates. • CommercialTools • Qualys - Policy Compliance – automatic tech control assessment across network ***Also available for cloud resources • skybox - Policy Compliance, firewall audit, network map andmodeling 22
- 23. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-2 Follow strict configuration management, building a secure image that is used to build all new systems that are deployed in the enterprise. • FreeTools • Cisecurity.org Baselines, hardening guides and templates. • FOG - Free and Open Source imaging from a central server based on Linux. • CommercialTools • Deep Freeze - Build a clean image, revert to it easily with a reboot. • ManageEngine OS Deployer 23
- 24. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-3 Store the master images on securely configured servers, validated with integrity checking tools capable of continuous inspection, and change management to ensure that only authorized changes to the images are possible. • FreeTools • FOG - Free and Open Source imaging from a central server based on Linux. • CommercialTools • Deep Freeze - Build a clean image, revert to it easily with a reboot. • ManageEngine OS Deployer-OS Deployer automates the disk imaging and deployment process • Avecto - Offers Privilege Management, Application Control, and Sandboxing 24
- 25. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-4 Do all remote administration of servers, workstation, network devices, and similar equipment over secure channels. • This is referring to protocols, such as RDP, SSH, etc... • FreeTools • MRemoteNG - All-in-one for remote access. does NOT support encryptedVNC. • UltraVNC - Offers a server and client which can provide encryptedVNC • CommercialTools • RealVNC - Feature richVNC server/client • RemoteDesktopManager - Feature rich RDP client • Centrify - Secure and manage super user, service, and application accounts on servers and network devices, both on-premises and in the cloud. 25
- 26. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-5 Utilize file integrity checking tools to ensure that critical system files (including sensitive system and application executables, libraries, and configurations) have not been altered... • This is basically referring to a HIDS. • FreeTools • AlienVault OSSIM - HIDS, SEIM, Inventory, Service Monitor, and more. • OSSEC - used in OSSIM, it is just the HIDS portion. • OpenHIDS -Windows only • CommercialTools • Tripwire - heterogeneous server monitoring acrossWindows, Linux, Solaris, AIX and HP-UX platforms. 26
- 27. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-6 Implement and test an automated configuration monitoring system that measures all secure configuration elements that can be measured through remote testing using features such as those included with tools compliant with Security Content Automation Protocol (SCAP), and alerts when unauthorized changes occur. • FreeTools • AlienVault OSSIM - HIDS, SEIM, Inventory, Service Monitor, and more. • OSSEC - used in OSSIM, it is just the HIDS portion. • OpenHIDS -Windows only • SCM – Microsoft’s Security Compliance manager • nmap –Security Scanner, Port Scanner, & Network ExplorationTool. • CommercialTools • ForeScout - see devices, control them and orchestrate system-wide wired and wireless campus, data center, cloud and operational technology deployments without agents. • Qualys – Unparalleled visibility and control of all your assets • Skybox – as mentioned earlier 27
- 28. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls • 3-7 Deploy system configuration management tools, such as Active Directory Group Policy Objects for MicrosoftWindows systems or Puppet for UNIX systems that will automatically enforce and redeploy configuration settings to systems at regularly scheduled intervals. • FreeTools • Salt - Meant for deploying change management to ANY scale. Great for cloud deployments with OpenStack. • Puppet - GPMC for Linux. Kind of. • CommercialTools • Chef -The Chef client is installed on each server, virtual machine, container, or networking device you manage.The client periodically polls Chef server latest policy and state of your network. If anything on the node is out of date, the client brings it up to date. • Ansible - Deploy apps. Manage systems. Centrally managed. 28
- 29. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 29
- 30. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 30
- 31. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 31
- 32. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 32
- 33. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 33 • Center for Internet Security (CIS): https://www.cisecurity.org/ • NIST Cyber Security Framework (CSF): http://www.nist.gov/cyberframework/ • CIS Critical Security Controls (CSC): https://www.cisecurity.org/critical-controls.cfm • Auditscripts resources (provided by James Tarala, CSC Editor): https://www.auditscripts.com/free-resources/critical-security- controls/ • STIG https://iase.disa.mil/stigs/Pages/index.aspx
- 34. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE CIS Top 20 Critical Security Controls 34
- 35. TECHTVSERIES COLLABORATE,INNOVATE,VALIDATE Thank you for Attending. Hope you can join us for the Complete CISTop 20 CSC Tuesday March 6th CIC CSC #4 – ContinuousVulnerability & Remediation 35 CIS Top 20 Critical Security Controls