Strategies for preventing intrusions:
- White-lists
- Patch vulnerabilities
- Restrict privileges
- Defense in depth
Process to avoid threats when building a system:
- Assess risks
- Secure underlying OS then apps
- Secure critical content
- Secure network
- Maintain security
System security planning process:
- Purpose + Stored types of information + Applications/Services
- Categories of users + Privileges + Accessible types of information
- Authentication
- Administrator
- System information access
- System management (local/remote)
- Additional security
Steps to hardening the OS:
- Install OS + last patches
- Configure OS
- Install + configure additional security controls
- Test OS
Initial steps to setup an OS:
- Install OS
- Protect network
- Harden OS
- Install the minimum
- Secure boot
- Validate devices
- Install patches
- Test patches
Security maintenance includes:
- Monitor logs
- Backup
- Recover
- Test
- Update
Backup:
Making copies of data regularly
Archive:
Keeping copies of data over a long time
Local exploit:
Software vulnerability exploited for elevated privileges
Remote exploit:
Software vulnerability in a network server triggered by a remote attacker
Chroot jail:
Restriction on server’s view to just a specified directory (jail)
User Account Control (UAC):
Controls that assure users use administrative rights only when required
Virtualization:
Abstraction of resources used by software running in virtual machines
Hypervisor:
Resource broker between hardware and VM
Hypervisor:
Resource broker between hardware and VM
Hypervisor functions:
- Execute VMs
- Emulate devices
- Execute privileges
- Manage VM lifecycle
- Administrate platform and software
Full virtualization variations:
- Native
- Hosted
Software Defined Networks (SDNs):
Segments of the same physical network spanning multiple servers
Virtualization security concerns:
- Guest OS isolation
- Hypervisor monitors guest OS
- Virtualized environment security
Virtual firewall:
Firewall for traffic between systems in the same virtualized environment
