System & Endpoint Protection

Hardening an operating system means removing unneeded programs and services and installing security patches and updates promptly. Patches correct faults and mitigate risks, and a good administrator configures the OS to protect against outside threats.

Updates should follow a systematic approach:

1. 1.Monitor: establish procedures for security-related information.
2. 2.Evaluate: decide whether the update is applicable.
3. 3.Plan: the installation of application updates and patches.
4. 4.Install: using a documented plan.

A baseline lets you compare how a system performs against expectations, so you can identify potential vulnerabilities.

Antimalware protection comes in five kinds. Run only one antimalware program at a time.

Malware includes viruses, worms, Trojans, keyloggers, spyware and adware. A rogue antivirus is a fake Windows-style warning, shown as an ad or popup while browsing, that installs malware when you click to "clean" the computer. It does not come from a legitimate source, and clicking anywhere in the window may download malware.

Fileless malware uses legitimate programs and runs straight in memory, leaving no footprint on disk. It uses scripting tools such as Windows PowerShell, is hard to detect and remove, and the attack ends when the system is rebooted. Python, Bash (the command language of macOS and most Linux distributions) and VBA (Visual Basic for Applications, used in Microsoft macros) can all carry malicious scripts.

Unapproved software may not be malicious but breaks security policy. It is installed unintentionally or deliberately by users and can interfere with the organisation's software or network services. Remove non-compliant software immediately.

A patch is a code update that stops a new virus, worm or other malware from making a successful attack. Patches and upgrades are often combined into a service pack. Windows checks for security updates, critical updates and service packs, and can auto-install high-priority updates or just notify the user.

An automated patch service gives the administrator central control:

• —Approve or decline updates, or force an update on a specific date.
• —Get reports on the updates each system needs.
• —Patches come from a local server, so each computer need not contact the vendor.
• —Users cannot disable or circumvent updates.
• —A patch can be tested before it is deployed organisation-wide.

Third-party applications such as Adobe Acrobat, Java and Chrome need patching too. Proactive patching helps prevent ransomware.

An endpoint is a host on the network that can access, or be accessed by, other hosts: computers and servers, IoT devices such as cameras and controllers, and devices reaching the network remotely over VPN. Each endpoint is a potential opening for malware.

A host-based solution is software running on the endpoint itself, working with the operating system to prevent attacks. The internal LAN has two elements to secure: the endpoints (laptops, desktops, printers, servers, IP phones; prone to malware) and the infrastructure that interconnects them (switches, wireless and IP telephony devices). Infrastructure faces MAC table overflow, spoofing, DHCP, LAN storm, STP and VLAN attacks.

Host-based firewall

Filters traffic entering or leaving one device

HIDS

Host-based intrusion detection; alerts on attacks

HIPS

Host-based intrusion prevention; blocks known attacks and anomalies

EDR

Endpoint detection and response; collects endpoint data, analyzes it and responds

DLP

Data loss prevention; stops sensitive data leaving or being misused

NGFW

Next-generation firewall; a firewall plus extra filtering such as application awareness and IPS

Physical protection includes cable locks, locked telecom rooms and Faraday cages, which block electromagnetic fields and signals. A keyed entry lock is the most common but easily forced; add a deadbolt, and remember any keyed lock is vulnerable if keys are lost, stolen or duplicated. A cipher lock uses a button sequence, can be time-limited and logs the code and time of each opening.

RFID uses radio waves to identify and track tagged items, and can wirelessly lock, unlock or configure devices. Tags hold an integrated circuit connected to an antenna, are small and need no battery to talk to a reader. This helps automate asset tracking.

EFS (Windows Encrypting File System) encrypts files, folders or a drive. Full disk encryption encrypts everything on the drive, including temp files and memory; Windows uses BitLocker. The TPM is a chip on the motherboard that stores encryption keys, digital certificates and passwords, and information about the host system. It must be enabled in the BIOS for BitLocker to use it.

BitLocker To Go encrypts removable drives, needs no TPM, and requires a password to decrypt. A self-encrypting drive automatically encrypts all its data, which blocks attackers reading the drive through their own OS.

BIOS is the first program that runs at power-on; UEFI is the newer standard interface between OS, firmware and external devices, preferred because it can run in 64-bit mode. Firmware sits on a small memory chip on the motherboard.

Boot integrity is assurance that the system is trusted and was not altered while the operating system loaded.

Measured Boot is the stronger of the two: it records what loaded rather than only blocking what is untrusted.

Antimalware software detects threats in three ways:

Agent-based antivirus runs on every machine. Agentless antivirus scans hosts from a central system, which suits virtualised hosts, because an agent in each virtual machine drains system resources.

Telemetry is the robust logging built into host-based security software, which some programs send to a central location for analysis. Security suites bundle antivirus, anti-phishing, safe browsing, HIPS and firewall. AV-TEST is an independent lab that reviews host-based protection.

Network-based devices add a second layer:

A host-based firewall is standalone software controlling traffic entering or leaving a computer, using profiles or custom rules that can match addresses, protocols and ports. It can alert the user to suspicious behaviour, and its logs record time, allow/deny, IPs and ports. Distributed firewalls are host firewalls with centralised rule management.

A HIDS is agent-based software combining antimalware with firewall functions to protect hosts from known and unknown malware. It monitors system calls and file access and provides log analysis, event correlation, integrity checking, policy enforcement, rootkit detection and alerting. It often has a management server endpoint, and it detects malware and can stop it executing.

HIDS products include Cisco AMP, AlienVault USM, Tripwire and OSSEC, the open-source one, which uses a manager server plus agents on Mac, Windows, Linux and Solaris. OSSEC monitors logs, checks file integrity, detects rootkits and can receive syslog alerts from network devices.

The attack surface is the total sum of vulnerabilities in a system that is accessible to an attacker: open ports on servers or hosts, software on internet-facing servers, wireless network protocols, and even users. It grows with IoT, BYOD, cloud and mobility. SANS splits it into three components:

A blocklist names applications that may not run; an allow list names the only ones that may. Both reduce the attack surface. Allow lists follow the organisation's security baseline, and non-allowlisted software raises risk beyond it. Websites can be listed too, for example by Spamhaus or Cisco Talos via Firepower.

Sandboxing runs suspicious files in a safe, isolated environment to analyse their behaviour; the observed behaviour is used to build defences. Cuckoo Sandbox is a popular free option run locally. Online options are VirusTotal, Joe Sandbox and CrowdStrike Falcon Sandbox, and ANY.RUN gives interactive reports with screenshots. Cisco AMP can track a file through the network and "roll back" events to obtain a copy for the sandbox.