OPERATING SYSTEM SECURITY

Strategies

 The 2010 Australian Signals Directorate (ASD) lists the “Top 35

Mitigation Strategies”
 Over 85% of the targeted cyber intrusions investigated by ASD in 2009
could have been prevented
 The top four strategies for prevention are:
 White-list approved applications
 Patch third-party applications and operating system vulnerabilities
 Restrict administrative privileges
 Create a defense-in-depth system
• These strategies largely align with those in the “20 Critical
Controls” developed by DHS, NSA, the Department of
Energy, SANS, and others in the United States
Operating System Security

 Possible for a system to be compromised during the installation process

before it can install the latest patches
 Building and deploying a system should be a planned process designed to
counter this threat
 Process must:
 Assess risks and plan the system deployment
 Secure the underlying operating system and then the key applications
 Ensure any critical content is secured
 Ensure appropriate network protection mechanisms are used
 Ensure appropriate processes are used to maintain security
System Security Planning

The first step in deploying a

Plan needs to new system is planning
identify appropriate
personnel and
training to install Planning should
and manage the include a wide
system security assessment
of the organization

Planning process needs to

determine security
requirements for the Aim is to maximize
system, applications, data, security while
and users minimizing costs
System Security Planning Process

The purpose of the

system, the type of Who will administer the Any additional security
information stored, the system, and how they will measures required on the
applications and services manage the system (via system, including the use
provided, and their local or remote access) of host firewalls, anti-
security requirements virus or other malware
protection mechanisms,
and logging

The categories of users of What access the system

the system, the privileges has to information stored
they have, and the types of on other hosts, such as file
information they can or database servers, and
access how this is managed

How access to the

How the users are
information stored on the
authenticated
system is managed
Operating Systems Hardening

 First critical step in securing a system is to secure the base operating system
 Basic steps
 Install and patch the operating system
 Harden and configure the operating system to adequately address the
identified security needs of the system by:
 Removing unnecessary services, applications, and protocols
 Configuring users, groups, and permissions
 Configuring resource controls
 Install and configure additional security controls, such as anti-virus,
host-based firewalls, and intrusion detection system (IDS)
 Test the security of the basic operating system to ensure that the steps
taken adequately address its security needs
Initial Setup and Patching

Overall The integrity and

boot process source of any
must also be additional device
secured driver code must
be carefully
validated

System security Initial

begins with the installation Should stage and
installation of should install validate all
the operating the minimum Critical that the patches on the
necessary for system be kept up test systems
system the desired to date, with all
critical security before deploying
system
related patches them in
installed production

Full
Full installation
installation
Ideally new and
and hardening
hardening
process
process should
should
systems should occur
be constructed occur before
before the
the
system
system isis deployed
deployed
on a protected to
network to its
its intended
intended
network location
location
 Remove
Unnecessary
Services, When performing the initial
Applications, installation the supplied
Protocols defaults should not be used
 Default configuration is set to
maximize ease of use and
functionality rather than
If fewer software packages security
are available to run the risk is  If additional packages are
reduced needed later they can be
System planning process installed when they are required
should identify what is
actually required for a given
system
  System planning process should
consider:
Configure Users,
Groups, and  Categories of users on the system

Authentication  Privileges they have

 Types of information they can

access

 How and where they are defined

and authenticated
Not all users with access to a  Default accounts included as part of
system will have the same the system installation should be
access to all data and resources secured
on that system
 Those that are not required should
Elevated privileges should be be either removed or disabled
restricted to only those users
that require them, and then only  Policies that apply to
authentication credentials
when they are needed to configured
perform a task
 Install
Configure
Additional
Resource
Security
Controls
Controls

 Once the users and groups are

defined, appropriate permissions
 Further security possible by
can be set on data and resources installing and configuring
additional security tools:
 Many of the security hardening  Anti-virus software
guides provide lists of
recommended changes to the
 Host-based firewalls
default access configuration  IDS or IPS software
 Application white-listing
 Checklists are included in
security hardening guides
Test the System
Security There are programs
specifically designed to:
 Review a system to ensure that a
system meets the basic security
requirements
 Scan for known vulnerabilities
Final step in the process of and poor configuration practices
initially securing the base
operating system is security
Should be done following the
testing
initial hardening of the system
Goal: Repeated periodically as part
 Ensure the previous security of the security maintenance
configuration steps are correctly process
implemented
 Identify any possible vulnerabilities
Application Configuration

 May include:
 Creating and specifying appropriate data storage areas for application
 Making appropriate changes to the application or service default configuration
details
 Some applications or services may include:
 Default data
 Scripts
 User accounts
 Of particular concern with remotely accessed services such as Web and file
transfer services
 Risk from this form of attack is reduced by ensuring that most of the files can only
be read, but not written, by the server
Encryption Technology

Is a key
enabling
technology that
may be used to If secure network Cryptographic
file systems are
secure data services are provided another use of
both in transit using TLS or IPsec If secure network
Must be services are
encryption
and when configured and suitable public and
provided using
stored appropriate private keys must be SSH, appropriate
cryptographic generated for each of server and client
keys created, them keys must be
created
signed, and
secured
Security Maintenance

Process of maintaining security is continuous

Security maintenance includes:
 Monitoring and analyzing logging information
 Performing regular backups
 Recovering from security compromises
 Regularly testing system security
 Using appropriate software maintenance processes to patch and update
all critical software, and to monitor and revise configuration as needed
Logging
In the event of a system
Key is to ensure you capture
Can only inform you about breach or failure, system
the correct data and then
bad things that have already administrators can more
appropriately monitor and
happened quickly identify what
analyze this data
happened

Generates significant
Information can be generated Range of data acquired
volumes of information and it
by the system, network and should be determined during
is important that sufficient
applications the system planning stage
space is allocated for them

Automated analysis is
preferred
 Data Backup and Archive

Performing regular Backup Archive Needs and policy

backups of data is a relating to backup
critical control that and archive should
assists with be determined
maintaining the The process of The process of
during the system
making copies of retaining copies of
integrity of the data at regular data over extended planning stage
system and user data intervals periods of time in
order to meet legal
and operational
requirements to
access past data
May be legal or
Kept online or
operational
offline
requirements for
the retention of data

Stored locally or
transported to a
remote site
• Trade-offs include
ease of
implementation
and cost versus
greater security
and robustness
against different
threats
Linux/Unix Security

Patch management
• Keeping security patches up to date is a widely recognized and critical control
for maintaining security

• Application and service configuration

• Most commonly implemented using separate text files for each application and
service
• Generally located either in the /etc directory or in the installation tree for a
specific application
• Individual user configurations that can override the system defaults are located
in hidden “dot” files in each user’s home directory
• Most important changes needed to improve system security are to disable
services and applications that are not required
Linux/Unix Security

Users, groups, and permissions

• Access is specified as granting read, write, and execute permissions to
each of owner, group, and others for each resource
• Guides recommend changing the access permissions for critical
directories and files
• Local exploit
Software vulnerability that can be exploited by an attacker to gain elevated
privileges

• Remote exploit
Software vulnerability in a network server that could be triggered by a remote
attacker
Linux/Unix Security

Remote access controls Logging and log rotation

• Several host firewall programs may • Should not assume that the default
be used setting is necessarily appropriate
• Most systems provide an
administrative utility to select which
services will be permitted to access
the system
Linux/Unix Security

chroot jail
• Restricts the server’s view of the file system to just a specified portion
• Uses chroot system call to confine a process by mapping the root of the
filesystem to some other directory
• File directories outside the chroot jail aren’t visible or reachable
• Main disadvantage is added complexity
Windows Security

Users administration
Patch management and access controls
• “Windows Update” and • Systems implement
“Windows Server Update discretionary access controls
Service” assist with regular
resources
maintenance and should be
used • Vista and later systems include
• Third party applications also mandatory integrity controls
provide automatic update • Objects are labeled as being of
support low, medium, high, or system
integrity level
• System ensures the subject’s
integrity is equal or higher than
the object’s level
• Implements a form of the Biba
Integrity model
Windows Security
Users Administration and Access Controls
Windows systems also define
privileges Combination of share and
• System wide and granted to user NTFS permissions may be used
accounts to provide additional security
and granularity when accessing
files on a shared resource

User Account Control (UAC) Low Privilege Service Accounts

• Provided in Vista and later systems • Used for long-lived service processes
• Assists with ensuring users with such as file, print, and DNS services
administrative rights only use them
when required, otherwise accesses the
system as a normal user
Windows Security

Application and service configuration

• Much of the configuration information is

centralized in the Registry
• Forms a database of keys and values that may be queried
and interpreted by applications
• Registry keys can be directly modified
using the “Registry Editor”
• More useful for making bulk changes
Windows Security

Other security controls

• Essential that anti-virus, anti-spyware, personal firewall, and other malware and
attack detection and handling software packages are installed and configured
• Current generation Windows systems include basic firewall and malware
countermeasure capabilities
• Important to ensure the set of products in use are compatible

Windows systems also support a range of cryptographic

functions:
• Encrypting files and directories using the Encrypting File System (EFS)
• Full-disk encryption with AES using BitLocker

“Microsoft Baseline Security Analyzer”

• Free, easy to use tool that checks for compliance with Microsoft’s security
recommendations
Virtualization

 A technology that provides an abstraction of the resources used by some

software which runs in a simulated environment called a virtual machine
(VM)
 Benefits include better efficiency in the use of the physical system
resources
 Provides support for multiple distinct operating systems and associated
applications on one physical system
 Raises additional security concerns
Virtualization Alternatives

Application virtualization

Full virtualization

Allows
applications
written for one
environment to
Multiple full
Virtual machine monitor
execute on
some other operating
system
(VMM)
operating
system instances
execute in Coordinates access between
parallel each of the guests and the
Hypervisor
actual physical hardware
resources
Virtualization Security Issues

 Security concerns include:

 Guest OS isolation
 Ensuring that programs executing within a guest OS may only
access and use the resources allocated to it
 Guest OS monitoring by the hypervisor
 Which has privileged access to the programs and data in each guest
OS
 Virtualized environment security
 Particularlyimage and snapshot management which attackers may
attempt to view or modify
Securing Virtualization Systems
Organizati
ons
using
virtualizati
on
• Carefully plan the security of the
should: virtualized system
• Secure all elements of a full
virtualization solution and
maintain their security
• Ensure that the hypervisor is
properly secured
• Restrict and protect
administrator access to the
virtualization solution
 Hypervisor Security

 Should be
 Secured using a process similar to securing an operating system
 Installed in an isolated environment
 Configured so that it is updated automatically
 Monitored for any signs of compromise
 Accessed only by authorized administration

 May support both local and remote administration so must be configured

appropriately

 Remote administration access should be considered and secured in the design

of any network firewall and IDS capability in use

 Ideally administration traffic should use a separate network with very limited
access provided from outside the organization
Virtualization
Infrastructure
Security

Access must be
limited to just
the
appropriate
guest

Systems manage
access to
hardware
resources