Embedded Files
12.7.2016
Below are listed recommendations and selected security controls related to IT and Operation and Maintenance networks.
Processes related
- Global procedures
- TTM/SDLC process
- Identity Management process
- Vulnerability Management
- Firewall rules management
- Patch Management
- Change Management
- Incident Management
Organization related
- Security Operation Center
- RACI
Infrastructure related
- Firewalls
- VPNs/VPNC, IPSec,
- Transmission encryption
Desktops related
- Antivirus, HIPS, Firewall
- Proxy, IDS, SSL inspection
- Mail security
- MS Domain Group Policy
- 802.1.X
- Thin clients
Servers related
- Hardened templates
- Compliance profiles
- HIPS
- Proxy
- Data anonymization
Security infrastructure
- Log Management
- Vulnerability scanners
- Remote connection monitoring (Session recording)
- SIEM
- DLP
- Honeypots
- Proxy
- OTP / RSA
- CA
- Physical security
Global Procedures
Define the minimum security baseline:
- minimum logging level
- minimum authentication level
- data encryption requirements
- separation of privileges
- retention of data policy
- sharing of account restriction, system account, application accounts
- Remote access
- Encrypted protocols requirements
- ...
Audit the systems to match for this requirements.
Try to prepare the audit policy which could be checked on the systems in automated way. I.e. compliance check by vulnerability/compliance check scanners (auditd, syslog config check, ...)
Security Operation Center
Dedicated team should be assigned for security operation
Receiving and monitoring the events from:
- SIEM
- IDS, IPS events
- Access to Log Management
- Netflow
- Session recordings
- Any other security consoles
- Defined rights and process for incident investigations
- For common events, the working instructions should be created
Inventory
Important is to have a maintained IP plan.
- owners of the subnets should be identified
- identify every host and the owner of the host (engineering, operation team, vendor/support)
- the SW and application could be additionally identified
The well documented IP plan is required mainly to schedule the automatic scans, understand the FW logs and netflows and also during the incidents investigations.
Identity Management
Process & Technology:
- Provisioning, deprovisioning process of new users
- Management of user roles and user rights
- Auto Provisioning of multiple systems / most common systems (domain, intranet, VPNC, Citrix, LDAP, …)
- Regular auditing of the user rights / roles
- Possible to extend to provision e.g. Linux, DB accounts
Firewall rules management
Process & Technology:
- Defined global security rules & policy for ACLs (e.g. telnet not allowed, ACLs should be opened from more secure segment, to less secure, interactive protocols not allowed inside datacenter …)
- Process & workflow how ACLs are created and removed
- Regular auditing of ACLs from firewalls (products exists on market)
- Autoclose ACLs if hitcount is 0 for some time
- netflow or at least firewall logs required
- also anomaly detection possible from netflow (products exists on market)
Desktop security
- Security procedure for user
- Technology:
Encrypted filesystem
Local firewall (block network interfaces if no connection to management server: I.e. connection not over VPN or not in corporate network)
HIPS
Antivirus
DLP (at least block USB or monitor)
Mail security
Procedure & Technology:
- Default sign mails with certificate (Outlook settings, Group Policy)
- Default encrypt emails (Outlook settings, Group Policy)
- Antispam & Antivirus on Mail gateway
- Possbile DLP on mail gateway
Vulnerability Management
Procedure & Technology:
Procedure:
- Define procedure across the company (including RACI, e.g. see SANS Implementing a Vulnerability Management Process)
Technology:
- Install vulnerability scanners
- Regularly scan from most exposed perimeters (Internet, Office LAN, inside data center/without ACLs towards selected systems)
- Put systems into such regular scanning / vulnerability management (selection in TTM process)
- Auto create tickets and assign them
- Perform compliance checks at least with minimum set of rules. Create custom or use available compliance profiles.
Log Management
Procedure & Technology:
Procedure:
- Define what and how should be logged
Technology:
- Syslog / logstash
- Elastic search + Kibana
- Or commercial products
SIEM
Event correlation, creation of security incidents
Many commercial products available
Requires SOC + log management
Session Recordings
Procedure & Technology
Mainly for interactive sessions
Technology:
- ICA, RDP, HTTPs/HTTP, SSH (Commercial products exists)
- Possible to do policy based routing to recording platform or bastion mode
- Also for HTTP/HTTPs inside intranet / office LAN try to use HTTP proxy (SSL inspection) to record the sessions
- Advanced: Possible anomaly detection from recorded sessions
Proxy
Most time well implemented, but some recap
- should authenticate user
- should block bad reputation links
- could contain categories which are not allowed because of corporate policy
- block self-signed certificates (Block let's Encrypt CA and possibly some other CAs)
- embedded antivirus
- possible SSL inspection
- possible embedded DLP Servers should also use proxy, no direct access
Malware protection
Basic:
- Antivirus (not sufficient)
Medium:
- IDS on proxy (e.g. Suricata + Emerging threats) to detect some back-connects (if proxy is running on vSphere, just use VDS port mirroring)
- Better to have IDS on every gateway to external domain (every proxy server, DNS servers)
- Analyze DNS queries
Advanced:
- Auto-sandbox solution, analyzing executable content download over proxy, SMTP gateway, etc.
DLP
- SSL inspection on proxy (not very popular by employees)
- Internal CA from group policy
- Proxy decrypts SSL and forward it to DLP server using ICAP or embedded DLP on proxy server
- DLP agents on desktops
- DLP on mail gateway
=> need to define regular expression and sensitive words, could be like CDRs, MSISDN, IMSI, … But attacker with knowledge could evade this detection
Honeypots
Easy, put few into selected VLANs
Very effective to get initial visibility
There are free, commercial or you can use just psad for linux on existing servers
Integrity checks
Regular integrity checks of core routers or critical systems
- also ask vendor to propose solution
- regularly check the integrity of firmware or OS on core routers or systems which process the significant amount of user traffic
- install HIDS with integrity checks on critical systems (e.g. use OSSEC)
OTP
For remote access or sensitive systems use One Time password solution
- use commercial or possibly try free (LinOTP)
- or just use Google PAM and Google Authenticator or Radius PAM with freeRadius (OATH perl module) and LDAP backend
Pentests & Red Team exercises
- Pentest are very effective to understand the attacker perspective
- Put in place procedure that internal security department is allowed to perform ad-hoc or regular pentest on testbed or non critical infrastructure
- Allow also social engineering tests towards employees to increase the security awareness
Report abuse