9.1.

2 Operating System Security

What does an organization need to do to harden an operating system and

keep it secure?

A good administrator

A good administrator will configure the operating system to protect against

outside threats. That means removing any unnecessary programs and
services, and making sure that security patches and updates are installed in
a timely manner to correct faults and mitigate risks.

A systematic approach

It’s important to have a systematic approach in place for addressing system

updates. An organization should:

 establish procedures for monitoring security-related information

 evaluate updates for applicability

 plan the installation of application updates and patches

 install updates using a documented plan.

A baseline

 Another critical way to secure an operating system is to identify potential vulnerabilities.

To do this, establish a baseline to compare how a system is performing against baseline
expectations.

Antivirus protection monitors for viruses. When it detects a virus, the program warns the
user and quarantines or deletes the virus.

Adware protection looks for programs that display unwanted advertising in popup boxes
and blocks suspicious adware.

Phishing protection blocks the IP addresses of known phishing websites and warns the user
about suspicious sites.

Spyware protection scans for keyloggers (a program that records keystrokes to access
passwords and other confidential information) and other spyware.

Trusted/untrusted sources verification warns the user about unsafe programs or websites.
 9.1.4 Points to Remember

You’ve identified types of antimalware that @Apollo can use to protect devices but there’s
more to learn. Let’s go through some important points to remember about antimalware.

Watch out for rogue antivirus products

Be cautious of malicious rogue antivirus products that appear while browsing the Internet.
Most of these display an ad or popup that looks like an actual Windows warning. They warn
that malware is infecting the computer and prompt the user to clean it. But they do not come
from legitimate sources, and clicking anywhere inside the window may download and install
malware instead.

Fileless attacks are difficult to detect and remove

Fileless malware uses legitimate programs to infect a computer. Going straight into memory,
this type of malware doesn’t rely on files, so it leaves no footprint. A fileless attack ends when
the system is rebooted. Fileless viruses use scripting languages such as Windows PowerShell and
are hard to detect.

Scripts can also be malware

Scripting languages such as Python, Bash (the command-line language for Apple’s macOS and
most Linux distributions) or Visual Basic for Applications (or VBA, used in Microsoft macros)
can be used to create scripts that are malware.

Always remove unapproved software

Unapproved or non-compliant software may be unintentionally installed on a computer. Users

may also intentionally install unauthorized programs. Although unapproved software may not be
malicious, it can still violate the security policy and interfere with the organization’s software or
network services. Non-compliant software should be removed immediately.

9.1.5 Patch Management

Cybercriminals work relentlessly to exploit weakness in computer systems. To stay one step
ahead, keep systems secure and up to date by regularly installing patches.

What are patches?

Patches are code updates that prevent a new virus, worm, or other malware from making a
successful attack. Patches and upgrades are often combined into a service pack. Many malware
attacks could have been avoided if users had installed the latest service pack.

Operating systems such as Windows routinely check for updates that can protect a computer
from the latest security threats. These include security updates, critical updates and service
packs. Windows can be configured to automatically download and install any high-priority
updates or to notify the user as these become available

What do you need to do?

As a cybersecurity professional, it’s good practice to test a patch before deploying it throughout
the organization. A patch management tool can be used to manage patches locally instead of
using the vendor’s online update service.

An automated patch service provides administrators with a more controlled setting. Let’s look at
the benefits:

 Administrators can approve or decline updates.

 Administrators can force the update of systems on a specific date.
 Administrators can obtain reports on the update(s) needed by each system.
 There is no need for each computer to connect to the vendor’s service to download
patches; instead, it gets the verified update from a local server.
 Users cannot disable or circumvent updates.

A proactive approach

As well as securing the operating system, it’s important to update third-party applications such as
Adobe Acrobat, Java and Chrome to address vulnerabilities that could be exploited. A proactive
approach to patch management provides network security while helping to prevent ransomware
and other threats.

9.1.6 Endpoint Security

A host-based solution is a software application that runs on a local device (or endpoint) to protect
it. The software works with the operating system to help prevent attacks.

1> A host-based firewall runs on a device to restrict incoming and outgoing network activity
for that device. It can allow or deny traffic between the device and the network. The
software firewall inspects and filters data packets to protect the device from becoming
infected. Windows Firewall, installed by default during Windows installation, is an
example of a software firewall..

You can control the type of data sent to and from the device by opening or blocking
ports. Firewalls block incoming and outgoing network connections, unless exceptions are
defined to open and close the ports. You can select 'inbound rules' to configure the types
of traffic that are allowed to pass through to the system this will protect the system from
unwanted traffic
2> HIDS software is installed on a device or server to monitor suspicious activity. It
monitors system calls and file system access to detect malicious requests. It can also
monitor configuration information about the device held in the system registry.

HIDS stores all log data locally. It is resource-intensive so it can affect system
performance. A host intrusion detection system cannot monitor network traffic that does
not reach the host system, but it does monitor operating system and critical system
processes specific to that host.

3> HIPS is software that monitors a device for known attacks and anomalies (deviations in
bandwidth, protocols and ports), or finds red flags by assessing the actual protocols in
packets. If it detects malicious activity, the HIPS tool can send you an alarm, log the
malicious activity, reset the connection and/or drop the packets.

4> EDR is an integrated security solution that continuously monitors and collects data from
an endpoint device. It then analyzes the data and responds to any threats it detects. An
antivirus can only block against threats, while EDR can do that and find threats on the
device.

5> DLP tools provide a centralized way to ensure that sensitive data is not lost, misused or
accessed by unauthorized users

6> NGFW is a network security device that combines a traditional firewall with other
network-device-filtering functions. For example, an application firewall using in-line
deep packet inspection (DPI) on an intrusion protection system (IPS).

9.1.8 Host Encryption

The Windows Encrypting File System (EFS) feature allows users to encrypt files, folders
or an entire hard drive. Full disk encryption (FDE) encrypts the entire contents of a drive
(including temporary files and memory). Microsoft Windows uses BitLocker for FDE.
To use BitLocker, the user needs to enable Trusted Platform Module (TPM) in the BIOS.
The TPM is a specialized chip on the motherboard that stores information about the host
system, such as encryption keys, digital certificates and passwords. When enabled,
BitLocker can use the TPM chip.
Similarly, BitLocker To Go is a tool that encrypts removable drives. It does not use a
TPM chip, but still encrypts the data, requiring a password to decrypt it. Meanwhile, a
self-encrypting drive automatically encrypts all data in the drive to prevent attackers from
accessing the data through their operating system.
 9.1.9 Boot Integrity

Attackers can strike at any moment, even in the short space of time it takes for a system
to start up. It is critical to ensure that systems and devices remain secure when booting
up.
><What is boot integrity?
Boot integrity ensures that the system can be trusted and has not been altered while the
operating system loads.
Firmware — software instructions about basic computer functions — is stored on a small
memory chip on the motherboard. The basic input/output system (BIOS) is the first
program that runs when you turn on the computer.
Unified Extensible Firmware Interface (UEFI), a newer version of BIOS, defines a
standard interface between the operating system, firmware and external devices. A
system that uses UEFI is preferred over one that uses BIOS because a UEFI system can
run in 64-bit mode.
>< How does Secure Boot work?
Secure Boot is a security standard to ensure that a device boots using trusted
software. When a computer system boots, the firmware checks the signature of each
piece of boot software, including UEFI firmware drivers, UEFI applications and the
operating system. If the signatures are valid, the system boots, and the firmware
gives control to the operating system.

>< What is Measured Boot?

Measured Boot provides stronger validation than Secure Boot. Measured Boot measures
each component starting with the firmware through to the boot start drivers, and stores
the measurements in the TMP chip to create a log. The log can be tested remotely to
verify the boot state of the client. Measured Boot can identify untrusted applications
trying to load, and it also allows antimalware to load earlier.

9.1.10 Apple System Security Features

As we know, Windows and Linux distributions include security features that are designed
to protect endpoints. Apple provides system hardware and macOS security features that
offer robust endpoint protection as well.

< Security-focused hardware

The hardware platform has enhanced security features such as a special CPU, boot, and a
dedicated AES encryption engine. These features are included in a special system on a
chip called the Secure Enclave.

< Encrypted storage

Apple Data Protection and FileVault data storage encryption are supported by the
hardware-based AES encryption engine. This enables encryption and decryption of files
as they are written or read without exposing encryption keys to the main CPU, operating
system, or running applications.

< Secure boot

The Boot ROM protects low-level hardware and only allows genuine and unaltered
Apple OS software to run.

< Secure biometric data

Biometric authentication data is processed in the security hardware
system. This keeps it segregated from the OS and running application
software, including malware.

< Find My Mac

Find My Mac helps find lost or stolen macOS devices through its
location tracking function. It also enables remote device locking and
storage erasing if critical data is at risk.

< XProtect
XProtect antimalware technology prevents the execution of malware
through signature-based malware detection. It also alerts users to the
existence of malware and provides the option to remove detected
malware files.

< Malware Removal Tool (MRT)

The Malware Removal Tool (MRT) detects and removes existing
malware infections when detection rules are automatically updated by
Apple. It also monitors for malware infections at system restart and
user login.

< Gatekeeper
Gatekeeper ensures that only authentic, digitally-signed software that
has been created by an Apple-notarized software developer is
permitted to be installed.
 ## Unpatched software
Update and patch all operating systems and software applications
##User downloads
Establish access control policies, standards, procedures and guidelines
##Malware
Implement automated antimalware solutions that scan the system and
update the ##antimalware software to provide proper protection
##Unattended devices
Establish policies for passwords and threshold lockouts
##Acceptable use policy violation
Use content filtering
##Unauthorized media
Disable internal CD drives and USB por

9.1.12 Physical Protection of Devices

Well done. You’ve protected @Apollo against software and hardware
threats. But what about the potential physical threats to @Apollo’s
offices and devices?

Computer equipment

To physically protect computer equipment:

 Use cable locks to secure devices

 Keep telecommunication rooms locked
 Use security cages (Faraday cages) around equipment to block
electromagnetic fields.

Door locks

A standard keyed entry lock is the most common type of door lock.
They are often easy to force open. A deadbolt lock can be added for
extra security. Any lock that requires a key is vulnerable if the keys are
lost, stolen or duplicated.

A cipher lock uses buttons that are pressed in a given sequence to

open the door. It can be programmed so that a user’s code may only
work during certain days or times. It can also keep a record of when
the door opened, and the code used to open it.
 Radio frequency identification (RFID) systems

RFID uses radio waves to identify and track objects. RFID tags can be
attached to any item that an organization wants to track. The tags
contain an integrated circuit that connects to an antenna. RFID tags
are small and require very little power, so they do not need a battery
to exchange information with a reader. RFID can help automate asset
tracking, or wirelessly lock, unlock or configure electronic devices.

9.2.1 Endpoint Threats

The term “endpoint” is defined in various ways. For the purpose of this
course, we can define endpoints as hosts on the network that can
access or be accessed by other hosts on the network. This obviously
includes computers and servers, however many other devices can also
access the network. With the rapid growth of the Internet of Things
(IoT), other types of devices are now endpoints on the network. This
includes networked security cameras, controllers, and even light bulbs
and appliances. Each endpoint is potentially a way for malicious
software to gain access to a network. In addition, new technologies,
such as cloud, expand the boundaries of enterprise networks to include
locations on the internet for which enterprises are not responsible.

Devices that remotely access networks through VPNs are also

endpoints that need to be considered. These endpoints could inject
malware into the VPN network from the public network.

The following points summarize some of the reasons why malware

remains a major challenge:

 According to research from Cybersecurity Ventures, by 2021 a new

organization will fall victim to a ransomware attack every 11 seconds.
 Ransomware attacks will cost the global economy $6 trillion annually
by 2021.
 In 2018, 8 million attempts to steal system resources using
cryptojacking malware were observed.
 From 2016 to early 2017, global spam volume increased dramatically. 8
to 10 percent of this spam can be considered to be malicious, as shown
in the figure.
 In 2020, it is projected that the average number of cyber attacks per
macOS device will rise from 4.8 in 2018 to 14.2 in 2020.
 Several common types of malware have been found to significantly
change features in less than 24 hours in order to evade detection.

Malicious Spam Percentage

9.2.2 Endpoint Security

News media commonly cover external network attacks on enterprise

networks. These are some examples of such attacks:

 DoS attacks on an organization’s network to degrade or even halt

public access to it
 Breach of an organization’s web server to deface their web presence
 Breach of an organization’s data servers and hosts to steal confidential
information

Various network security devices are required to protect the network

perimeter from outside access. As shown in the figure, these devices
 could include a hardened router that is providing VPN services, a next
generation firewall (ASA, in the figure), an IPS appliance, and an
authentication, authorization, and accounting (AAA) services server
(AAA Server, in the figure).

However, many attacks originate from inside the network. Therefore,

securing an internal LAN is nearly as important as securing the outside
network perimeter. Without a secure LAN, users within an organization
are still susceptible to network threats and outages that can directly
affect an organization’s productivity and profit margin. After an internal
host is infiltrated, it can become a starting point for an attacker to gain
access to critical system devices, such as servers and sensitive
information.

Specifically, there are two internal LAN elements to secure:

 Endpoints - Hosts commonly consist of laptops, desktops, printers,

servers, and IP phones, all of which are susceptible to malware-related
attacks.
 Network infrastructure - LAN infrastructure devices interconnect
endpoints and typically include switches, wireless devices, and IP
telephony devices. Most of these devices are susceptible to LAN-
related attacks including MAC address table overflow attacks, spoofing
attacks, DHCP related attacks, LAN storm attacks, STP manipulation
attacks, and VLAN attacks.

This module focuses on securing endpoints.

9.2.3 Host-Based Malware Protection

The network perimeter is always expanding. People access corporate

network resources with mobile devices that use remote access
technologies such as VPN. These same devices are also used on
unsecured, or minimally secured, public and home networks. Host-
based antimalware/antivirus software and host-based firewalls are
used to protect these devices.

Antivirus/Antimalware Software

This is software that is installed on a host to detect and mitigate

viruses and malware. Examples are Windows Defender Virus & Threat
Protection, Cisco AMP for Endpoints, Norton Security, McAfee, Trend
Micro, and others. Antimalware programs may detect viruses using
three different approaches:

 Signature-based - This approach recognizes various characteristics

of known malware files.
 Heuristics-based - This approach recognizes general features shared
by various types of malware.
 Behavior-based - This approach employs analysis of suspicious
behavior.

Many antivirus programs are able to provide real-time protection by

analyzing data as it is used by the endpoint. These programs also scan
for existing malware that may have entered the system prior to it
being recognizable in real time.

Host-based antivirus protection is also known as agent-based. Agent-

based antivirus runs on every protected machine. Agentless antivirus
protection performs scans on hosts from a centralized system.
Agentless systems have become popular for virtualized environments
in which multiple OS instances are running on a host simultaneously.
Agent-based antivirus running in each virtualized system can be a
serious drain on system resources. Agentless antivirus for virtual hosts
involves the use of a special security virtual appliance that performs
optimized scanning tasks on the virtual hosts. An example of this is
VMware’s vShield

Host-based Firewall

This software is installed on a host. It restricts incoming and outgoing

connections to connections initiated by that host only. Some firewall
software can also prevent a host from becoming infected and stop
infected hosts from spreading malware to other hosts. This function is
included in some operating systems. For example, Windows includes
Windows Defender Firewall with Advanced Security as shown in the
figure.

Other solutions are produced by other companies or organizations. The

Linux iptables and TCP Wrappers tools are examples. Host-based
firewalls are discussed in more detail later in the module.

Host-based Security Suites

It is recommended to install a host-based suite of security products on

home networks as well as business networks. These host-based
security suites include antivirus, anti-phishing, safe browsing, Host-
based intrusion prevention system, and firewall capabilities. These
various security measures provide a layered defense that will protect
against most common threats.

In addition to the protection functionality provided by host-based

security products is the telemetry function. Most host-based security
software includes robust logging functionality that is essential to
cybersecurity operations. Some host-based security programs will
submit logs to a central location for analysis.

There are many host-based security programs and suites available to

users and enterprises. The independent testing laboratory AV-TEST
provides high-quality reviews of host-based protections, as well as
information about many other security products.

Search the internet for the AVTest organization to learn more about AV-
TEST.

9.2.4 Network-Based Malware Protection

 New security architectures for the borderless network address security
challenges by having endpoints use network scanning elements. These
devices provide many more layers of scanning than a single endpoint
possibly could. Network-based malware prevention devices are also
capable of sharing information among themselves to make better
informed decisions.

Protecting endpoints in a borderless network can be accomplished

using network-based, as well as host-based techniques, as shown in
the figure above. The following are examples of devices and
techniques that implement host protections at the network level.

 Advanced Malware Protection (AMP) - This provides endpoint

protection from viruses and malware.
 Email Security Appliance (ESA) - This provides filtering of SPAM and
potentially malicious emails before they reach the endpoint. An
example is the Cisco ESA.
 Web Security Appliance (WSA) - This provides filtering of websites
and blocklisting to prevent hosts from reaching dangerous locations on
the web. The Cisco WSA provides control over how users access the
internet and can enforce acceptable use policies, control access to
specific sites and services, and scan for malware.
 Network Admission Control (NAC) - This permits only authorized
and compliant systems to connect to the network.

These technologies work in concert with each other to give more

protection than host-based suites can provide, as shown in the figure.
 9.3.1 Host-Based Firewalls

Host-based personal firewalls are standalone software programs that

control traffic entering or leaving a computer. Firewall apps are also
available for Android phones and tablets.

Host-based firewalls may use a set of predefined policies, or profiles, to

control packets entering and leaving a computer. They also may have
rules that can be directly modified or created to control access based
on addresses, protocols, and ports. Host-based firewall applications can
also be configured to issue alerts to users if suspicious behavior is
detected. They can then offer the user the ability to allow an offending
application to run or to be prevented from running in the future.

Logging varies depending on the firewall application. It typically

includes the date and time of the event, whether the connection was
allowed or denied, information about the source or destination IP
addresses of packets, and the source and destination ports of the
encapsulated segments. In addition, common activities such as DNS
lookups and other routine events can show up in host-based firewall
logs, so filtering and other parsing techniques are useful for inspecting
large amounts of log data.
One approach to intrusion prevention is the use of distributed firewalls.
Distributed firewalls combine features of host-based firewalls with
centralized management. The management function pushes rules to
the hosts and may also accept log files from the hosts.

Whether installed completely on the host or distributed, host-based

firewalls are an important layer of network security along with network-
based firewalls. Here are some examples of host-based firewalls:

Windows Defender Firewall

First included with Windows XP, Windows Firewall (now Windows

Defender Firewall) uses a profile-based approach to firewall
functionality. Access to public networks is assigned the restrictive
Public firewall profile. The Private profile is for computers that are
isolated from the internet by other security devices, such as a home
router with firewall functionality. The Domain profile is the third
available profile. It is chosen for connections to a trusted network, such
as a business network that is assumed to have an adequate security
infrastructure. Windows Firewall has logging functionality and can be
centrally managed with customized group security policies from a
management server such as System Center 2012 Configuration
Manager.

iptables

This is an application that allows Linux system administrators to

configure network access rules that are part of the Linux kernel
Netfilter modules.

nftables

The successor to iptables, nftables is a Linux firewall application that

uses a simple virtual machine in the Linux kernel. Code is executed
within the virtual machine that inspects network packets and
implements decision rules regarding packet acceptance and
forwarding.

TCP Wrappers

This is a rule-based access control and logging system for Linux. Packet
filtering is based on IP addresses and network services.

9.3.2 Host-Based Intrusion Detection

The distinction between host-based intrusion detection and intrusion
prevention is blurred. In fact, some sources refer to host-based
intrusion detection and prevention systems (HIPDS). Because the
industry seems to favor the use of the acronym HIDS, we will use it in
our discussion here.

A host-based intrusion detection system (HIDS) is designed to protect

hosts against known and unknown malware. A HIDS can perform
detailed monitoring and reporting on the system configuration and
application activity. It can provide log analysis, event correlation,
integrity checking, policy enforcement, rootkit detection, and alerting.
A HIDS will frequently include a management server endpoint, as
shown in the figure.

A HIDS is a comprehensive security application that combines the

functionalities of antimalware applications with firewall functionality. A
HIDS not only detects malware but also can prevent it from executing if
it should reach a host. Because the HIDS software must run directly on
the host, it is considered an agent-based system.

Host-based Intrusion Detection Architecture

9.3.3 HIDS Operation

It can be said that host-based security systems function as both

detection and prevention systems because they prevent known attacks
and detect unknown potential attacks. A HIDS uses both proactive and
reactive strategies. A HIDS can prevent intrusion because it uses
signatures to detect known malware and prevent it from infecting a
system. However, this strategy is only good against known threats.
Signatures are not effective against new, or zero day, threats. In
addition, some malware families exhibit polymorphism. This means
that variations of a type, or family, of malware may be created by
attackers that will evade signature-based detections by changing
aspects of the malware signature just enough so that it will not be
detected. An additional set of strategies are used to detect the
possibility of successful intrusions by malware that evades signature
detection:

Anomaly-based

Host system behavior is compared to a learned baseline model of

normal behavior. Significant deviations from the baseline are
interpreted as the result of some sort of intrusion. If an intrusion is
detected, the HIDS can log details of the intrusion, send alerts to
security management systems, and take action to prevent the attack.
The measured baseline is derived from both user and system behavior.
Because many things other than malware can cause system behavior
to change, anomaly detection can create many erroneous results which
can increase the workload for security personnel and also lower the
credibility of the system.

Policy-based

Normal system behavior is described by rules, or the violation of rules,

that are predefined. Violation of these policies will result in action by
the HIDS. The HIDS may attempt to shut down software processes that
have violated the rules and can log these events and alert personnel to
violations. Most HIDS software comes with a set of predefined rules.
With some systems, administrators can create custom policies that can
be distributed to hosts from a central policy management system.

9.3.4 HIDS Products

There are a number of HIDS products on the market today. Most of
them utilize software on the host and some sort of centralized security
management functionality that allows integration with network security
monitoring services and threat intelligence. Examples are Cisco AMP,
AlienVault USM, Tripwire, and Open Source HIDS SECurity (OSSEC).

OSSEC uses a central manager server and agents that are installed on
individual hosts. Currently, agents are available for Mac, Windows,
Linux, and Solaris platforms. The OSSEC server, or Manager, can also
receive and analyze alerts from a variety of network devices and
firewalls over syslog. OSSEC monitors system logs on hosts and also
conducts file integrity checking. OSSEC can detect rootkits and other
malware, and can also be configured to run scripts or applications on
hosts in response to event triggers.

## Search the internet for OSSEC to learn more. ##

9.4.1 Attack Surface

Recall that a vulnerability is a weakness in a system or its design that

could be exploited by a threat. An attack surface is the total sum of the
vulnerabilities in a given system that is accessible to an attacker. The
attack surface can consist of open ports on servers or hosts, software
that runs on internet-facing servers, wireless network protocols, and
even users.

The attack surface is continuing to expand, as shown in the figure.

More devices are connecting to networks through the Internet of
Things (IoT) and Bring Your Own Device (BYOD). Much of network traffic
now flows between devices and some location in the cloud. Mobile
device use continues to increase. All of these trends contribute to a
prediction that global IP traffic will increase threefold in the next five
years.

The SANS Institute describes three components of the attack surface:

>>Network Attack Surface

The attack exploits vulnerabilities in networks. This can include

conventional wired and wireless network protocols, as well as other
wireless protocols used by smartphones or IoT devices. Network
attacks also exploit vulnerabilities at the network and transport layers.

>> Software Attack Surface

The attack is delivered through exploitation of vulnerabilities in web,

cloud, or host-based software applications.

>> Human Attack Surface

The attack exploits weaknesses in user behavior. Such attacks include

social engineering, malicious behavior by trusted insiders, and user
error.

IoT – Connected devices projected to double to 30 billion by 2020.<<

BYOD – Gartner predicts that 70% of professionals will conduct work on

their own smart devices by 2018.<<

Global Operations – Global IP traffic will increase nearly threefold over

the next 5 years.<<

Mobility – 20% of total IP traffic will be from mobile devices by

2021.<<
Cloud – By 2020, 92% of data center workloads will be processed by
cloud data centers.<<

9.4.2 Application Block list and Allow list

One way of decreasing the attack surface is to limit access to potential

threats by creating lists of prohibited applications. This is known as
blocklisting.

Application blocklists can dictate which user applications are not

permitted to run on a computer. Similarly, allow lists can specify which
programs are allowed to run, as shown in the figure. In this way, known
vulnerable applications can be prevented from creating vulnerabilities
on network hosts.

Allow lists are created in accordance with a security baseline that has
been established by an organization. The baseline establishes an
accepted amount of risk, and the environmental components that
contribute to that level of risk. Non-allowlisted software can violate the
established security baseline by increasing risk.

Application Block list and Allow list

The figure shows the Windows Local Group Policy Editor blacklisting
and whitelisting settings
Websites can also be whitelisted and blacklisted. These blacklists can
be manually created, or they can be obtained from various security
services. Blacklists can be continuously updated by security services
and distributed to firewalls and other security systems that use them.
Cisco’s Firepower security management system is an example of a
system that can access the Cisco Talos security intelligence service to
obtain blacklists. These blacklists can then be distributed to security
devices within an enterprise network.

Search the internet for The Spamhaus Project, which is an example of a

free blacklist service.

9.4.3 System-Based Sandboxing

Sandboxing is a technique that allows suspicious files to be executed

and analyzed in a safe environment. Automated malware analysis
sandboxes offer tools that analyze malware behavior. These tools
observe the effects of running unknown malware so that features of
malware behavior can be determined and then used to create defenses
against it.

As mentioned previously, polymorphic malware changes frequently

and new malware appears regularly. Malware will enter the network
despite the most robust perimeter and host-based security systems.
HIDS and other detection systems can create alerts on suspected
malware that may have entered the network and executed on a host.
Systems such as Cisco AMP can track the trajectory of a file through
the network, and can “roll back” network events to obtain a copy of the
downloaded file. This file can then be executed in a sandbox, such as
Cisco Threat Grid Glovebox, and the activities of the file documented
by the system. This information can then be used to create signatures
to prevent the file from entering the network again. The information
can also be used to create detection rules and automated plays that
will identify other systems that have been infected.

Cuckoo Sandbox is a popular free malware analysis system sandbox. It

can be run locally and have malware samples submitted to it for
analysis. A number of other online public sandboxes exist. These
services allow malware samples to be uploaded for analysis. Some of
these services are VirusTotal, Joe Sandbox, and CrowdStrike Falcon
Sandbox.

An interesting online tool is [Link], which is shown in the figure. It

offers the ability to upload a malware sample for analysis like any
online sandbox. However, it offers a very rich interactive reporting
functionality that is full of details regarding the malware sample.
[Link] runs the malware and captures a series of screen shots of the
malware if it has interactive elements that display on the sandbox
computer screen. You can view public samples that have been
submitted by [Link] users to investigate information about newly
discovered malware or malware that is currently circulating on the
internet. Reports include network and internet activity of the malware,
including HTTP requests and DNS queries. Files that are executed as
part of the malware process are shown and rated for threat. Details are
available for the files including multiple hash values, hexadecimal and
ASCII views of the file contents, and the system changes made by the
files. In addition, identifying indicators of compromise, such as the
malware file hashes, DNS requests, and the IP connections that are
made by the malware are also shown. Finally, the tactics taken by the
malware are mapped to the MITRE ATT&CK Matrix with each tactic
linked to details on the MITRE website.

expand_less

Defending Systems and Devices

To secure an operating system, administrators should remove any

unnecessary programs and services, and ensure that security patches
and updates are installed. An organization should establish procedures
for monitoring security-related information, evaluate updates, and
install updates using a documented plan. Additionally, they should
identify potential vulnerabilities by establishing a baseline to compare
how a system is performing.

Malware includes viruses, worms, Trojan horses, keyloggers, spyware

and adware. They invade privacy, steal information, damage the
system or delete and corrupt data. Use reputable antimalware
software. Fileless viruses use scripting languages such as Windows
PowerShell and are hard to detect. Scripting languages such as Python,
Bash, or VBA can be used to create malware. Remove non-compliant
software immediately.

Patches are code updates that prevent a new virus, worm, or other
malware from making a successful attack. Patches and upgrades are
often combined into a service pack. A patch management tool can be
used to manage patches locally. It is also important to update third-
party applications such as Adobe Acrobat, Java and Chrome to address
vulnerabilities. A host-based firewall runs on a device to restrict
incoming and outgoing network activity for that device. HIDS software
monitor system calls and file system access to detect malicious
requests. HIPS monitors a device for known attacks and anomalies.
EDR continuously monitors and collects data from an endpoint device,
and then analyzes the data and responds to any threats. DLP tools
ensure that sensitive data is not lost or accessed by unauthorized
users. NGFW combines a traditional firewall with other network-device-
filtering functions. Encryption is a tool used to protect data by using an
algorithm to transform data and make it unreadable.

The Windows Encrypting File System (EFS) feature allows users to

encrypt files, folders, or an entire hard drive. Boot integrity ensures
that the system can be trusted and has not been altered while the
operating system loads. Secure Boot is a security standard to ensure
that a device boots using trusted software. Measured Boot can identify
untrusted applications trying to load, and it also allows antimalware to
load earlier.

Administrators should have policies and countermeasures in place for

unpatched software, unauthorized user downloads, malware,
unattended devices, acceptable use policy violations, and unauthorized
media. Protect physical equipment with cable locks, ciphered door
locks, Faraday cages to block electromagnetic fields, and RFID tags to
identify and track items. Antimalware Protection

Endpoints are hosts on the network that can access (or be accessed
by) other hosts on the network. With the IoT, other types of devices are
now endpoints. Each endpoint is a potential opening for malware to
access the network. Not all endpoints are within the network. Many
endpoints connect to networks remotely over VPN. The network
perimeter is always expanding. Various network security devices are
required to protect the network perimeter from outside access. Many
attacks originate from inside the network; therefore, securing an
internal LAN is also important. After an internal host is infiltrated, it can
become a starting point for an attacker to gain access to critical
system devices. There are two internal LAN elements to secure:
endpoints and network infrastructure.

Antivirus/Antimalware software is installed on a host to detect and

mitigate viruses and malware. It does this using signature-based (using
various characteristics of known malware files), heuristics-based (using
general features shared by various types of malware), and behavior-
based (using an analysis of suspicious behavior). Many antivirus
programs are able to provide real-time protection by analyzing data as
it is used by the endpoint. A host-based firewall restricts incoming and
outgoing connections to connections initiated by that host only. Some
firewall software can also prevent a host from becoming infected and
stop infected hosts from spreading malware to other hosts. Most host-
based security software includes logging functionality that is essential
to cybersecurity operations. To protect endpoints in a borderless
network use network-based, as well as host-based techniques.

Host-based Intrusion Prevention

Host-based firewalls may use a set of predefined policies, or profiles, to

control packets entering and leaving a computer. They may also have
rules that can be directly modified or created to control access based
on addresses, protocols, and ports. They can also be configured to
issue alerts if suspicious behavior is detected. Logging varies
depending on the firewall application. It typically includes date and
time of the event, whether the connection was allowed or denied,
information about the source or destination IP addresses of packets,
and the source and destination ports of the encapsulated segments.
(Distributed firewalls combine features of host-based firewalls with
centralized management.)

Some examples of host-based firewalls include Windows Defender

Firewall, iptables, nftables, and TCP Wrappers. A HIDS protects hosts
against known and unknown malware. It can perform detailed
monitoring and reporting on the system configuration and application
activity, log analysis, event correlation, integrity checking, policy
enforcement, rootkit detection, and alerting. A HIDS will frequently
include a management server endpoint. Because the HIDS software
must run directly on the host, it is considered an agent-based system.
A HIDS uses both proactive and reactive strategies. A HIDS can prevent
intrusion because it uses signatures to detect known malware and
prevent it from infecting a system.

Signatures are not effective against new, or zero day, threats. In

addition, some malware families exhibit polymorphism. Additional
strategies to detect the possibility of successful attacks include
anomaly-based detection and policy-based detection.

Application Security
An attack surface is the total sum of the vulnerabilities in a given
system that is accessible to an attacker. It may consist of open ports
on servers or hosts, software that is running on internet-facing servers,
wireless network protocols, remote devices, and even users. The attack
surface is continuing to expand. More devices are connecting to
networks through the IoT and BYOD.

The SANS Institute describes three components of the attack surface:

Network Attack Surface, Software Attack Surface, and Human Attack
Surface. One way of decreasing the attack surface is to limit access to
potential threats by creating lists of prohibited applications. Similarly,
an organization can create lists of allowed programs in accordance
with a security baseline that has been established by an organization.
Sandboxing is a technique that allows suspicious files to be executed
and analyzed in a safe environment. Automated malware analysis
sandboxes offer tools that analyze malware behavior. These tools
observe the effects of running unknown malware so that features of
malware behavior can be determined and then used to create defenses
against it. Polymorphic malware changes frequently and new malware
appears regularly. Malware will enter the network despite the most
robust perimeter and host-based security systems. HIDS and other
detection systems can create alerts on suspected malware that may
have entered the network and executed on a host.