Notes

Sec29 - Remediation Recommendations

5 min read

System Hardening

  • Definition: Reduce a host’s attack surface by disabling/uninstalling unnecessary components

  • Checklist:

    1. Remove/Disable Unused Devices
    2. Regular Patching
    3. Uninstall Unused Network Protocols
    4. Disable Unnecessary Services/Shared Folders
    5. Enforce ACLs on Resources
    6. Least Privilege Accounts
    7. Secure Admin/Root Accounts
    8. Disable Default User/Group Accounts
    9. Verify Permissions on Accounts/Groups
    10. Install/Update Anti-Malware

  • Availability Hardening:

    • Power Outages: Use UPS/battery backup → keep servers online during outages
    • Internet Outages: Use multiple ISPs (primary, cellular, microwave, satellite)
    • Other Threats: Plan for hardware/network failures

Patch Management

  • Definition: Identify, test, deploy updates to fix vulnerabilities
  • Classification: Critical, Security-Critical, Recommended, Optional
  • Enterprise Tools: SCCM, Endpoint Manager
  • Risks:
    • Requires scheduled downtime; patches may introduce new issues
    • Sometimes no patch exists → apply compensating controls
  • Strategy:
    1. Regular Scanning (Nessus, Qualys) → identify missing patches
    2. Prioritize by severity (e.g., CVSS score)
    3. Controlled Deployment:
      • Test in non-prod environments
      • Schedule maintenance windows
      • Monitor post-deployment for new issues
    4. Documentation:
      • Record applied patches; update CMDB
    5. Mitigation for Unpatched Systems:
      • Network segmentation, increased monitoring, WAF, strict access controls
      • Risk acceptance only if compensating controls suffice

User Input Sanitization

  • Definition: Validate/sanitize all user inputs to prevent injection attacks
  • Principles:
    • Treat all inputs as untrusted
    • Use approved-listing—allow only known safe characters/patterns
    • Avoid relying solely on unapproved-listing (can be bypassed)
  • SQL Injection Example: Use parameterized quieres 
    SELECT * FROM users WHERE username = '" + username + "' 
	AND password = '" + password + "' #vulnerable
SELECT * FROM users WHERE username = ? AND password = ? #better
  • Remediation Steps:
    1. Identify all input points (forms, URL params, APIs)
    2. Implement input validation (approved-listing)
    3. Convert database calls to parameterized queries
    4. Sanitize output to prevent XSS
    5. Conduct regular security testing (automated scans, manual pen tests)
    6. Train developers on secure coding—emphasize input validation and parameterization

Network & Infrastructure Controls

  • Network Segmentation:
    • Divide network into isolated subnets → limit lateral movement
    • Methods:
      • Firewalls: Enforce policies between segments
      • VLANs: Separate broadcast domains on same physical network
      • ACLs: Granular access control to specific segments
  • Infrastructure Security:
    • Strong Authentication: MFA, certificate-based
    • Encryption: Data at rest/in transit
    • Regular Updates/Patching: OS, firmware, network devices
    • IDS/IPS: Monitor and block malicious traffic
  • Recommended Remediation:
    1. Review network architecture → identify unsegmented areas
    2. Implement VLANs, configure firewall rules
    3. Define ACLs for critical resources
    4. Enforce MFA for admin access
    5. Verify encryption protocols (TLS, IPSec) in use
    6. Schedule regular vulnerability scans and patching
    7. Deploy/configure IDS/IPS; train staff on monitoring and response

Authentication Recommendations

  • Multifactor Authentication (MFA):
    • Requires ≥2 factors:
      1. Something you know (password)
      2. Something you have (token, YubiKey)
      3. Something you are (biometric)
    • Implementation: Use diverse, independent factors; apply to all critical systems
  • Certificate Management:
    • Digital Certificates: Authenticate identities, enable encrypted channels
    • Practices:
      • Issue, renew, revoke as needed
      • Track expiration; automate renewals
  • Key Rotation:
    • Rotate cryptographic keys regularly → limit exposure
    • Automate rotation; use a secure key management system
  • Secrets Management:
    • Use password managers or vaults (e.g., HashiCorp Vault) to store/generate credentials
    • Ensure MFA protects manager vaults

Encryption Recommendations

  • Definition: Convert plaintext to ciphertext to protect confidentiality
  • Best Practices:
    • Use strong algorithms (e.g., AES for symmetric, RSA for asymmetric)
    • Encrypt data at rest (disk, databases) and in transit (TLS/SSL)
  • Wireless Encryption:
    • WPA2: AES-based; widely adopted
    • WPA3: Enhanced key management; protects against brute-force
  • Network Communication:
    • SSH: Encrypts remote admin sessions
    • Enterprise methods: PEAP, EAP-TTLS, EAP-FAST for 802.1X authentication
  • Export Regulations:
    • EAR License Exception ENC: U.S. rules governing encryption exports
  • Recommended Remediation:
    1. Ensure all sensitive data (databases, files) uses AES-256 or better
    2. Enforce TLS 1.2/1.3 for all web and API traffic
    3. Validate WPA2/WPA3 on wireless networks; disable legacy protocols
    4. Implement SSH for all remote access; disable Telnet/FTP
    5. Use enterprise 802.1X with PEAP/EAP-TTLS/EAP-FAST where feasible
    6. Audit key management practices → secure, rotate keys regularly

Process-Level Remediation

  • Definition: Change operational procedures to improve security without direct system modifications
  • Recommended Remediation:
    1. Identify processes that introduce risk (e.g., cleartext protocols)
    2. Evaluate replacing with secure methods (SSH, VPN tunnels)
    3. Automate security tasks (password changes, log reviews)
    4. Train staff on updated workflows; monitor adherence

Administrative Controls

  • RBAC (Role-Based Access Control):
    • Assign permissions based on job functions
    • In Windows domains: implement via security groups reflecting org hierarchy
    • Benefits: Enforces least privilege; scales with user turnover
  • Password Policies:
    • NIST SP 800-63B guidelines:
      • Length: 8–64 ASCII characters
      • Complexity: discouraged; focus on length
      • No forced frequent changes (unless compromised)
      • Password history: prevent reuse (e.g., last 25)
    • Use Password Managers: Encourage strong, unique passwords
  • Policies & Procedures:
    • Maintain/updating: MDM, remote access, password, RBAC policies
    • Integrate lessons from pen tests → revise policies accordingly
  • SDLC Security Integration:
    • Eight phases: Plan, Requirements, Design, Develop, Test/Validate, Release, Certify/Accredit, Change/Config Management
    • Embed security checks (code reviews, vulnerability scans, UAT, peer reviews) throughout SDLC
  • Recommended Remediation:
    1. Implement RBAC; map roles to least privilege
    2. Update password policies per NIST; remove complexity mandates; enforce length/histories
    3. Deploy an organization-wide password manager protected by MFA
    4. Review and update security policies post-pen test
    5. Integrate security controls into SDLC (vulnerability scans, code reviews)

Physical Controls

  • Access Control Hardware:
    • Badge Readers: RFID, smart cards; require badge+PIN for two-factor
    • Biometric Readers: Fingerprint, retina, voice; combined with PIN
    • Mantraps (Access Vestibules):
      • Automated: Badge+PIN entry → one door at a time
      • Manned: Security verifies identity
  • Protecting Data Center Equipment:
    • Standard rack dimensions (48U, 50” depth, 20” width)
    • Lock racks/cabinets; designate key custodian; log key access
  • Employee Training:
    • ROI: 69% (SMB), 248% (Enterprise) (Forrester)
    • Focus on physical security (badging, tailgating prevention) and technical security (malware/anti-phishing)
  • Video Surveillance:
    • Wired preferred over wireless (resistant to jamming)
    • Fixed vs. PTZ cameras based on coverage needs

Operational Controls & Policies

  • Job Rotation:
    • Rotate duties periodically → detect fraud, cross-train staff, ensure redundancy
  • Mandatory Vacations:
    • Require time off → uncover fraudulent or malicious activities during absence
  • User Training:
    • Annual or as needed; cover current threats, best practices; specialized IT/admin training
  • Time-of-Day Restrictions:
    • Limit system access to business hours → reduce off-hour risk
  • Recommended Remediation:
    1. Define and document operational controls (rotation, vacations, access windows)
    2. Automate enforcement (can’t access systems outside allowed hours)
    3. Monitor adherence; audit logs to verify controls are in place

Graph View