|
By Bozidar Spirovski
Most administrators and security officers are well aware of the necessity of system hardening for corporate systems.
Hardening is the process of securing a system by reducing its surface of vulnerability. By the nature of operation, the more functions a system performs, the larger the vulnerability surface. Since most systems are dedicated to one or two functions, reduction of possible vectors of attack is done by the removal of any software, user accounts or services that are not related and required by the planned system functions.
System hardening is a vendor-specific process, since different system vendors install different elements in the default install process. However, all system hardening efforts follow a generic process. So here is a checklist and diagram by which you can perform your hardening activities.
1. Perform initial system install. Stick the DVD in and go through the motions.
2. Remove unnecessary software. All systems come with a predefined set of software packages that are assumed to be useful to most users. Depending on your target use of the system, you should remove all software that is not to be used like graphics and office packages on a Web server.
3. Disable or remove unnecessary usernames and passwords. Most systems come with a lot of predefined user accounts for all kinds of purposes -- from remote support to dedicated user accounts for specific services. Remove all remote and support accounts, and all accounts related to services which are not to be used. For all used accounts, ALWAYS change the default passwords.
4. Disable or remove unnecessary services. Just as the two previous points, remove all services which are not to be used in production. You can always just disable them, but if you have the choice, remove them altogether. This will prevent the possible errors of someone activating the disabled service further down the line.
5. Apply patches. After clearing the "mess" of the default install, apply security and functionality patches for everything that is left in the system -- especially the target services.
6. Run Nessus Scan. Update your Nessus scanner and let her rip. Perform a full scan including dangerous scans. Do the scan without any firewalls on the path of the scan. Read through the results. There will always be some discoveries, so you need to analyze them.
7. If no vulnerabilities are discovered, use system. After the analysis of the results, if there is nothing significant discovered, congratulations! You have a hardened system ready for use.
Here is the described checklist as a process diagram:
This article was published by Infosec Island.
Bozidar Spirovski is an information security expert with Information Security Short Takes.
Only registered users can write comments.
Please login or register. |
