OS Hardening - Revision history

NSchulterer: Added section "Consequences of insufficient OS Hardening" and added more threats to the "Common Threats" section. Sources to new information added as well.

2024-01-08T21:04:15Z

Added section "Consequences of insufficient OS Hardening" and added more threats to the "Common Threats" section. Sources to new information added as well.

← Older revision		Revision as of 21:04, 8 January 2024
Line 20:		Line 20:
	== The goal of OS Hardening ==		== The goal of OS Hardening ==
	The primary objective of OS hardening is to elevate global security standards. Recent analytics indicate that just over 50% of Linux OS users have the latest version installed, while in Windows, only 35% are up-to-date—an indication of the need for more robust patch management. Implementing proactive measures can significantly increase these percentages. One effective strategy is to enhance automatic processes already present in many operating systems. These processes, including core automatic updates, should evolve to ensure critical fixes are promptly applied, even for users who may not proactively manage their updates.		The primary objective of OS hardening is to elevate global security standards. Recent analytics indicate that just over 50% of Linux OS users have the latest version installed, while in Windows, only 35% are up-to-date—an indication of the need for more robust patch management. Implementing proactive measures can significantly increase these percentages. One effective strategy is to enhance automatic processes already present in many operating systems. These processes, including core automatic updates, should evolve to ensure critical fixes are promptly applied, even for users who may not proactively manage their updates.

			== The consequences of insufficient OS Hardening ==

			The gravest consequence of inadequate system security is the occurrence of data breaches. In these scenarios, private personal information for individual users may be compromised, potentially impacting their daily lives. For businesses, such breaches can result in severe repercussions, including financial losses,
			regulatory fines, and damage to their reputation within their respective industries. For governments, the consequences can extend far beyond trust and reputation damage, potentially jeopardizing the safety and well-being of their citizens, as witnessed in the July 2023 US government hack.

			These breaches are often attributable to human error, which can stem from security vulnerabilities within the operating system or associated software. Such vulnerabilities could have been mitigated if users or administrators had regularly applied security updates and patches. One contributing factor to these errors is the lack of proper training for users or administrators.

	== Security Baselining ==		== Security Baselining ==
Line 141:		Line 148:
	; Application Exploit		; Application Exploit
	: Application exploits utilize programming errors to take advantage of the system with the goal in mind to have some kind of privilege escalation and accessing files that should normally not be accessible to a not authorized user.		: Application exploits utilize programming errors to take advantage of the system with the goal in mind to have some kind of privilege escalation and accessing files that should normally not be accessible to a not authorized user.
	; Buffer Overflow		; [[Buffer Overflows\|Buffer Overflow]]
	: Buffer overflows are a subtype of an application exploit. As they are one of the more common attacks out there we examine them closer. Buffer overflow is the practice of exploiting unprotected size-unrestrained memory buffers. The goal of such an attack is the modification of the return pointer of a program, enabling the attacker to jump to an arbitrary location in memory. ~~For more info, please visit [[Buffer Overflows]]~~		: Buffer overflows are a subtype of an application exploit. As they are one of the more common attacks out there we examine them closer. Buffer overflow is the practice of exploiting unprotected size-unrestrained memory buffers. The goal of such an attack is the modification of the return pointer of a program, enabling the attacker to jump to an arbitrary location in memory.
	; Race Condition		; Race Condition
	: Race conditions can occur when concurrent processes can read or write on the same memory location. This attack is also known as time-to-check and time-of-use (TOC/TOU) as a shared value is checked and subsequently used to exploit some kind of software bug.		: Race conditions can occur when concurrent processes can read or write on the same memory location. This attack is also known as time-to-check and time-of-use (TOC/TOU) as a shared value is checked and subsequently used to exploit some kind of software bug.
	: For example, an attacker can create a symbolic link to a file in the precise moment a privileged program wants to write to it. If this symbolic link points to \textit{/etc/passwd}, the privilege program unwillingly overwrites the password file, allowing the attacker root access to the machine		: For example, an attacker can create a symbolic link to a file in the precise moment a privileged program wants to write to it. If this symbolic link points to \textit{/etc/passwd}, the privilege program unwillingly overwrites the password file, allowing the attacker root access to the machine
			; Privilege Escalation
			: It is an exploitation technique that grants attackers elevated access to resources typically protected from regular users or programs. This enables them to perform actions otherwise restricted to administrators or software developers. This exploit poses a significant threat, with a track record of effectiveness and a growing popularity in recent years.
			; [[Denial of Service Attacks]]
			: It is an exploitation technique that leverages flaws in network protocol implementations or exhausts a target system’s resources through brute force. Its primary objective is to disrupt normal service provision or block access to resources, potentially causing the target to freeze or even crash.
			; [[Sniffing&Spoofing\|IP Spoofing]]
			: It typically entails an attacker attempting to transmit network packets with a falsified IP address to a system, thereby deceiving the recipient. This deceptive practice involves forging the source address of a transmission with the aim of illicitly gaining entry into a secure system. IP Spoofing can be employed for various malicious activities, including launching a Denial of Service (DoS) attack, conducting anonymous port scanning, or deceiving access controls.
			; SSH Security Issues
			: SSH security issues are often overlooked compared to those of other technologies. This misconception stems from the belief that SSH is inherently secure by default; however, the default configuration of SSH is, in reality, vulnerable. Notably, SSH version 1 should \textit{never} be employed due to its inherent
			security risks. Moreover, root user login, username/password logins, weak en-
			cryption algorithms, and default port settings are among several potential entry
			points for attackers attempting to breach your system.
	; Other Attacks		; Other Attacks
	: There are many more techniques attacking the CIA requirements of an operating system. Many malicious actors attack the confidentiality as it usually has the most value to an adversary.		: There are many more techniques attacking the CIA requirements of an operating system. Many malicious actors attack the confidentiality as it usually has the most value to an adversary.
Line 303:		Line 321:
	* [SGP20] Patrick St ̈ockle, Bernd Grobauer, and Alexander Pretschner. Automated implementation of windows-related security-configuration guides. In 2020, 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 598–610, 2020.		* [SGP20] Patrick St ̈ockle, Bernd Grobauer, and Alexander Pretschner. Automated implementation of windows-related security-configuration guides. In 2020, 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 598–610, 2020.
	* [fIS22] CIS Center for Internet Security. Our mission is to develop and promote timely best practice solutions, www.cisecurity.org. CIS, 2022. accessed: 2022-11-19.		* [fIS22] CIS Center for Internet Security. Our mission is to develop and promote timely best practice solutions, www.cisecurity.org. CIS, 2022. accessed: 2022-11-19.
			* Donald A Tevault. Mastering Linux Security and Hardening: Protect your Linux systems from intruders, malware attacks, and other cyber threats. Packt Publishing Ltd, 2020.
			* Shuangxia Niu, Jiansong Mo, Zhigang Zhang, and Zhuo Lv. Overview of linux vulnerabilities. In 2nd International Conference on Soft Computing in Information Communication Technology, pages 225–228. Atlantis Press, 2014.
			* Michael Bartock, Suzanne Lightman, Ya-Shia Li-Baboud, James McCarthy, Karen Reczek, Joseph Brule, Karri Meldorf, Doug Northrip, Arthur Scholz, and Theresa Suloway. Foundational pnt profile: Applying the cybersecurity framework for the responsible use of positioning, navigation, and timing (pnt) services. Technical Report NIST IR 8323r1, National Institute of Standards and Technology, Gaithersburg, MD, January 2023.


Line 310:		Line 331:
	* https://www.niap-ccevs.org/Product/Archived.cfm?par303=Microsoft%20Corporation		* https://www.niap-ccevs.org/Product/Archived.cfm?par303=Microsoft%20Corporation
	* https://www.trentonsystems.com/blog/system-hardening-overview		* https://www.trentonsystems.com/blog/system-hardening-overview
			* https://ubuntu.com/blog/what-is-system-hardening-definition-and-best-practices
			* https://www.reuters.com/world/us/chinese-hackers-stole-60000-emails-us-state-department-microsoft-hack-senate-2023-09-27/

	[[Category:Documentation]]		[[Category:Documentation]]

NSchulterer: General text and grammar clean up to make the article clear and coherent, sometimes fixing very messy sentences/word usage.

2024-01-08T16:30:26Z

General text and grammar clean up to make the article clear and coherent, sometimes fixing very messy sentences/word usage.

Show changes

BAras at 16:42, 6 January 2023

2023-01-06T16:42:52Z

@@ Line 79: / Line 79: @@
 Misconfigurations weaken a system's security by creating vulnerabilities that are frequently hard to find. According to a recent research [CDF18], ignorance  and lack of knowledge are the main causes of security misconfigurations from the operators' point of view. Utilizing already-existing security-configuration manuals is one method for overcoming the lack of knowledge. Each rule describes why it should be used and what parameter should be changed to increase system security, as shown in the following figure [SGP20]:
-[[File:rule.PNG|600px]]
+There are more than 3,000 GPO settings for Windows 10 and more than 1,800 for Internet Explorer 11 to offer a better understanding of the complexity of securing Windows.
-An illustration of a rule from a security configuration manual for Windows.
+This demonstrates the necessity of utilizing specified baselines to aid harden Windows devices.The following list of Microsoft tools are the ones that are most frequently used
 == Operating System Security Evaluation ==
@@ Line 276: / Line 301: @@
 * [CDF18] Kevin Borgolte Constanze Dietrich, Katharina Krombholz and Tobias Fiebig. Investigating system operators’ perspective on security misconfigurations. In Proceedings of the 2018 ACM SIGSAC Conference on Computerand Communications Security, 2018.
 * [SGP20] Patrick St ̈ockle, Bernd Grobauer, and Alexander Pretschner. Automated implementation of windows-related security-configuration guides. In 2020, 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 598–610, 2020.
 ; Links
 * https://www.redhat.com/en/about/press-releases/red-hat-adds-common-criteria-security-certification-red-hat-enterprise-linux

BAras at 16:32, 6 January 2023

2023-01-06T16:32:00Z

← Older revision	Revision as of 16:32, 6 January 2023
Line 81:	Line 81:


		[[File:rule.PNG\|600px]]
		An illustration of a rule from a security configuration manual for Windows.

BAras at 16:25, 6 January 2023

2023-01-06T16:25:48Z

← Older revision		Revision as of 16:25, 6 January 2023
Line 75:		Line 75:

	Logs from the auditing daemon Auditd provide for verbose logging and even the recording of individual syscall usages by the system administrator. Numerous configuration factors, both at the operating system level and the application level, are required for the Linux operating system to be secure.		Logs from the auditing daemon Auditd provide for verbose logging and even the recording of individual syscall usages by the system administrator. Numerous configuration factors, both at the operating system level and the application level, are required for the Linux operating system to be secure.

			== Windows Hardening ==

			Misconfigurations weaken a system's security by creating vulnerabilities that are frequently hard to find. According to a recent research [CDF18], ignorance and lack of knowledge are the main causes of security misconfigurations from the operators' point of view. Utilizing already-existing security-configuration manuals is one method for overcoming the lack of knowledge. Each rule describes why it should be used and what parameter should be changed to increase system security, as shown in the following figure [SGP20]:



Line 267:		Line 272:
	* [Pro] Promapp. Business process management - www.nintex.com. Accessed: 2022-11-07		* [Pro] Promapp. Business process management - www.nintex.com. Accessed: 2022-11-07
	* [At22] Cybersecurity Researchers At. Linux devices ’increasingly’ under attack from hackers, warn security researchers — zdnet. Cybersecurity Researchers, 2022.		* [At22] Cybersecurity Researchers At. Linux devices ’increasingly’ under attack from hackers, warn security researchers — zdnet. Cybersecurity Researchers, 2022.
			* [CDF18] Kevin Borgolte Constanze Dietrich, Katharina Krombholz and Tobias Fiebig. Investigating system operators’ perspective on security misconfigurations. In Proceedings of the 2018 ACM SIGSAC Conference on Computerand Communications Security, 2018.
			* [SGP20] Patrick St ̈ockle, Bernd Grobauer, and Alexander Pretschner. Automated implementation of windows-related security-configuration guides. In 2020, 35th IEEE/ACM International Conference on Automated Software Engineering (ASE), pages 598–610, 2020.
	; Links		; Links
	* https://www.redhat.com/en/about/press-releases/red-hat-adds-common-criteria-security-certification-red-hat-enterprise-linux		* https://www.redhat.com/en/about/press-releases/red-hat-adds-common-criteria-security-certification-red-hat-enterprise-linux

BAras at 16:18, 6 January 2023

2023-01-06T16:18:19Z

@@ Line 51: / Line 51: @@
 # Verify the configurations of the device, the device setups, and so on.
 # Verify the device’s compliance.
-The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another.
+The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another [Dun20]:
 [[File:Baselining.PNG|600px]]
 == Operating System Security Evaluation ==
@@ Line 243: / Line 266: @@
 * [Dun20] Mark Dunkerley. Mastering Windows Security and Hardening. Packt Publishing, 2020.
 * [Pro] Promapp. Business process management - www.nintex.com. Accessed: 2022-11-07
 ; Links

BAras at 16:09, 6 January 2023

2023-01-06T16:09:38Z

← Older revision		Revision as of 16:09, 6 January 2023
Line 47:		Line 47:

	The following four steps are an illustration of a procedure:		The following four steps are an illustration of a procedure:
	1. Set up a new Windows 10 device.		# Set up a new Windows 10 device.
	2. Verify that the device is provided with internet connection.		# Verify that the device is provided with internet connection.
	3. Verify the configurations of the device, the device setups, and so on.		# Verify the configurations of the device, the device setups, and so on.
	4. Verify the device’s compliance.		# Verify the device’s compliance.
	The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another.		The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another.

BAras at 16:04, 6 January 2023

2023-01-06T16:04:41Z

← Older revision		Revision as of 16:04, 6 January 2023
Line 53:		Line 53:
	The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another.		The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another.

			[[File:Baselining.PNG\|600px]]

	== Operating System Security Evaluation ==		== Operating System Security Evaluation ==

BAras at 15:58, 6 January 2023

2023-01-06T15:58:11Z

← Older revision		Revision as of 15:58, 6 January 2023
Line 17:		Line 17:

	== The goal of OS Hardening ==		== The goal of OS Hardening ==
	The principal goal of this hardening process is to increase the security standards in the whole world. Analytics found out that in the Linux OS just a little bit above 50% have the newest version of the OS installed. In Windows just 35% which is a pretty small number. For this reason the patch-management will need to be much more involved in the process which will in advance take this low percentages much higher as without it. Also an valid method could be an automatic process which are already included in many OS but also with this process users are not using it properly. The automatic process needs to evolve to the next level which means that the core has to be fully automatic updated when an critical fix went out to public so users ~~which~~ are lazy are also getting the updates ~~which~~ they need.		The principal goal of this hardening process is to increase the security standards in the whole world. Analytics found out that in the Linux OS just a little bit above 50% have the newest version of the OS installed. In Windows just 35% which is a pretty small number. For this reason the patch-management will need to be much more involved in the process which will in advance take this low percentages much higher as without it. Also an valid method could be an automatic process which are already included in many OS but also with this process users are not using it properly. The automatic process needs to evolve to the next level which means that the core has to be fully automatic updated when an critical fix went out to public so users who are lazy are also getting the updates that they need.

	== Security Baselining ==		== Security Baselining ==

	Security baselining is the method of putting a minimal set of guidelines in place and configurations for ~~your~~ environment e.g. establishing a minimal Windows device setup [Dun20]		Security baselining is the method of putting a minimal set of guidelines in place and configurations for the environment e.g. establishing a minimal Windows device setup [Dun20].
			The creation of a baseline offers a minimally defined norm that will assist in assuring a better secure environment if the organisation or the organisational institution deploys systems and devices.
			Baselines can range from checklists or spreadsheets that someone uses to ensure sure the predetermined security controls have been implemented to a taken snapshot or picture that is already preloaded with the predefined security rules, depending on the size of your business.
			An aspect of the baseline, it is important to confirm that policies, standards, and processes are in place, are clearly defined, and have received the approval of the leadership and all other stakeholders who are responsible for e.g. data protection. It is essential to have these specified for security, compliance, and auditing reasons. To begin, policies for the firm are to be established and defined. The baselines are then to be constructed using the standards as the framework.

	== Security Policies, Standards and Procedures==		== Security Policies, Standards and Procedures==
			After these baselines are established, policies and procedures is to be developed to apply the baselines and support the achievement of the ultimate result. In the long run, deploying baselines without clear policies, procedures, and a framework is not presumed as effective and leaves the business open to risk.
			Additionally, having these foundations in place provides a platform with ensuring leadership participation and sign-off, which sends a consistent message to the company about the significance of each associate in its success.[Dun20]
			It is strongly advised to start with the fundamentals if the business does not already have any rules in place that pertain to, for example, Windows security. In order to protect the devices, at the very least, the following few examples are to be mentioned in a policy [Dun20]:
			* Security updates
			* Firewall
			* Encryption
			* A password policy, multi-factor authentification (MFA) and biometrics

			A policy that demands that all systems be maintained up to date with the most recent security updates is an example.
			Policies are followed by standards, which are obligatory and describe the specifics of each policy. In addition to providing details on the technology to be used, standards help maintain consistency within an organization.
			A few examples of standards regarding windows servers for the proposed elements described in the preceding section include the following [Dun20]:
			* Windows Update for Business is to be used to setup all Windows 10 computers, while Windows Servers use either Windows Server Update Services (WSUS) or Azure Update Management. The business use case will specify and store update
			schedules.
			* On all Windows end-user devices and servers, the Windows firewall is to activate and set up. The connection requirements are to be defined.
			* Using BitLocker and/or Azure Disk Encryption, all Windows servers and end-user workstations are to be encrypted.
			* PINs and Windows Hello biometrics are to install, and accounts require utilizing passwords with a minimum of 12 characters. Passwords requisite updates yearly and contain capital, lowercase, number, and special characters
			The detailed instructions including a step-by-step guidance required to complete a repetitive operation or process are known as procedures. These collections or set of guidances are meant to help with the implementation of the stated policies, standards, and as well as guidelines to achieve a specific aim.
			Procedures require updates periodically as technology and software versions advance. A third-party tool is also an option with the aim of being more organized and completing procedures. One instance is a program called Nintex Promapp [Pro], which aids in documenting and sharing your company’s procedures [Dun20].

			The following four steps are an illustration of a procedure:
			1. Set up a new Windows 10 device.
			2. Verify that the device is provided with internet connection.
			3. Verify the configurations of the device, the device setups, and so on.
			4. Verify the device’s compliance.
			The following figure shows an overview of policies, standards, procedures and baselines and how they are linked to one another.


Line 56:		Line 78:
	* EAL 2: Ubuntu 16.04 (2018)		* EAL 2: Ubuntu 16.04 (2018)

	It has to be noted that examination takes a long time to ~~conducted~~ and only applies to one specific version. This is one of the reasons why such investigations are performed rarely. Additionally, they are very costly, leading to only a marginal gain for the product.		It has to be noted that the examination takes a long time to conduct and only applies to one specific version. This is one of the reasons why such investigations are performed rarely. Additionally, they are very costly, leading to only a marginal gain for the product.

	== Common Threats ==		== Common Threats ==
Line 220:		Line 242:
	* Tevault, Donald A. Mastering Linux Security and Hardening: Secure your Linux server and protect it from intruders, malware attacks, and other external threats. Packt Publishing Ltd, 2018.		* Tevault, Donald A. Mastering Linux Security and Hardening: Secure your Linux server and protect it from intruders, malware attacks, and other external threats. Packt Publishing Ltd, 2018.
	* [Dun20] Mark Dunkerley. Mastering Windows Security and Hardening. Packt Publishing, 2020.		* [Dun20] Mark Dunkerley. Mastering Windows Security and Hardening. Packt Publishing, 2020.
			* [Pro] Promapp. Business process management - www.nintex.com. Accessed: 2022-11-07

	; Links		; Links

BAras at 15:42, 6 January 2023

2023-01-06T15:42:27Z

@@ Line 18: / Line 18: @@
 == The goal of OS Hardening ==
 The principal goal of this hardening process is to increase the security standards in the whole world. Analytics found out that in the Linux OS just a little bit above 50% have the newest version of the OS installed. In Windows just 35% which is a pretty small number. For this reason the patch-management will need to be much more involved in the process which will in advance take this low percentages much higher as without it. Also an valid method could be an automatic process which are already included in many OS but also with this process users are not using it properly. The automatic process needs to evolve to the next level which means that the core has to be fully automatic updated when an critical fix went out to public so users which are lazy are also getting the updates which they need.
 == Operating System Security Evaluation ==
@@ Line 204: / Line 219: @@
 * Verizon. 2019 Data Breach Investigations Report. Technical report, 2019.
 * Tevault, Donald A. Mastering Linux Security and Hardening: Secure your Linux server and protect it from intruders, malware attacks, and other external threats. Packt Publishing Ltd, 2018.
 ; Links