THE 27 CRITICAL SECURITY CONTROLS

Informatics

A PRACTICAL GUIDE FOR MANAGERS AND

INFORMATION SECURITY CONSULTANTS

Sergio Castro Reynoso

Catenari Institute
[Link]

1st edition, 2012

 CHAPTER 1: INTRODUCTION

1. The objective of this book is to present a

easy to implement methodology that allows the person in charge
cybersecurity secure as quickly as possible the
data from your company or organization, using 27 controls
critics. It is a 100% practical methodology; it is focused on
obtain immediate results, and not to document processes.

The Fundamental Problem of Security

Computer Science

The fundamental problem of cybersecurity is

without a doubt the existence of multiple attack vectors. We can
to be attacked by our perimeter network, wirelessly,
through phishing, through trojans, worms, viruses; via USBs
infected, visiting infected pages, etc.

Being in charge of cybersecurity is like being

goalkeeper, with ten forwards taking penalties simultaneously;
And if they score even one goal on us, we are in serious trouble.

For all these types of attacks, there are many

tools to defend ourselves. With enough budget,
we can acquire all the defense tools from
cybersecurity, hire the necessary personnel to
operate it, and secure our organization's data at 99%.

2
But here is the problem: we never have enough.
budget. We would love to have dozens of engineers from
safety working with us, and having all the packages
of the most efficient software and appliances, but the reality of the
the thing is that our organization simply does not have the
money, and if he has it, he does not want to allocate much to security

computing. One arrives with whom he approves the budget: "Hey,

I need this amount of money to implement a process.
of vulnerability analysis and remediation, and for
implement a website filter.” The person who approves the
the budget answers us then: "For what, if we already have
firewall and antivirus?
There is no doubt that the finance people and the IT people
we speak two different languages. That's why part of the objective of
this book is to create a common language.

3
 CHAPTER 2: ATTACK VECTORS

First, let's look at some basic principles about the

attacks.

There are four fundamental motivations behind the

actions of a hacker:

1. Psychological reasons: it is when the hacker attacks

to gain fame, revenge, or simply for fun.
2. Political motives: when the hacker is a
government entity or some other type of political organization,
and the main objective is espionage.
3. Hacktivism: when the hacker attacks as
form of social protest in favor of or against a cause.
4. Economic motives: when the hacker attempts
steal valuable information, such as card numbers
credit, corporate espionage.

When attacking, a hacker can perform the following

acciones:

1. Data extraction: this is the most common objective,

the extraction of credit card numbers, databases
of clients, strategic plans, designs, databases of
emails for phishing attacks, etc.

4
 2. Data modification: the modification of data
it is common in attacks on websites, with the aim of putting
political messages, or simply the equivalent of digital graffiti.
3. Denial of service: it consists of flooding a
server with packages, so that legitimate users do not
have access to the resource.
4. Theft of computational resources: it is when
the hacker manages to take control of a computer to
turn her into a zombie and use her in a botnet, or when she uses a
mail server to send spam, or an ftp server to
upload files, etc.

The hacking process has 7 phases:

1. Reconnaissance: the hacker conducts a study

initial of the target organization: review of its website,
available emails, IP registration, phones, etc.

2. Scan: the hacker performs an initial scan of

the public IPs of the organization, to see if there are
immediate vulnerabilities. It also scans the website for
search for vulnerabilities in web applications
easy to guess default passwords, confidential information
that has been published by accident, etc.

3. Access: the hacker manages to penetrate the perimeter of

the target organization. This could have been through a

5
vulnerability in a public IP, or on a website, or perhaps due to
through a phishing attack, an infected USB, or engineering
social.

4. Privilege escalation: once the hacker

take control of a machine within the organization, it has
to penetrate deeper into the local network. For this, you need
steal usernames and passwords from machines with more information
valuable. This can be done by analyzing traffic, reviewing
remotely documents on the controlled machine, or
installing a trojan to steal passwords.

5. Data extraction/modification: the hacker

find valuable or vulnerable information, and proceed to
extract it or modify it according to its mission

6. Maintain access: the hacker is going to want to return to

connect to the network in the future, so it will probably install

some type of "backdoor", or "back door", a program that allows you
will allow remote connection to the hacked machines,
at any time.

7. Elimination of evidence: depending on the

mission and sophistication of the hacker, perhaps they try to delete evidence
of its presence on the network. This will prevent your intrusion from being

detected at the time of performing a log analysis, which

It would cause a search for backdoors that have been left on the network.

6
 There are thirteen attack vectors that you can use a
hacker. We will analyze each of them in detail.

7
 Vector 1: Exploits

An 'exploit' is a program that takes advantage of a

vulnerability in another program, to take control of a
computational resource. On the other hand, a vulnerability is a
programming error within a program. Every program
it works based on receiving data (input), processing data, and
present data (output). To receive this input from the user or from
other systems, the program uses variables. When a value is
assigned to a variable, this value is stored in a
memory space of the CPU. The CPU, while running the
program, reads these memory spaces, and processes the
values entered by the user. The values of these variables
they are generally alphanumeric, and the program can perform
all kinds of arithmetic or logical operations with the data
provided. So far so good. The problem occurs
when the programmer accidentally does not validate the data type
what a variable can receive, and/or does not delimit the space
assignable to this variable. When this happens, a hacker can
introduce not an alphanumeric value, but your own program
(exploit). So, when the CPU reads that memory space,
instead of just taking an alphanumeric value and
process it, read the hacker's program (the exploit), and execute it.
And generally what the exploit does is allow the hacker
take remote control of the machine.

8
 This programming error of not validating inputs or not
delimiting the memory space of the variable is certainly a
avoidable error. The problem is that billions are written.
lines of code each year, and even if only one is made
very low percentage of errors, these, multiplied by so many
lines of code translate to thousands of vulnerabilities per year
in commercial software.

The way vulnerabilities are discovered in

software is through a technique called 'fuzzing'. Fuzzing
it consists of taking a software package and entering data
random alphanumeric in the program variables, until achieving
unexpected results from the software. If entering by
example a value with an extremely long alphanumeric character cause
that a software package crashes means that very
it probably has a boundary vulnerability
memory space. Then the researcher can proceed to
reverse engineer the software package, in order to
determine exactly how to program an exploit that
take advantage of this detected vulnerability.

So that an application can be attacked

remotely, it must present open ports over the Internet. If the
The application has no ports exposed to the Internet, it is not

vulnerable to remote attacks, but yes to local attacks. If by

for example a hacker takes control of a machine using a

9
trojan or some similar method, from that machine I could
take control of other machines with vulnerabilities.

Three types of people do research on

vulnerabilities: those that work for the software company
in fact, security researchers (working in companies
dedicated to this, or on their own), and malicious hackers.

When a security researcher from a company

the software detects a vulnerability in a program of the
company generally the company the announce
immediately, and publish a 'patch', that is a program or
update that fixes the detected vulnerability. So
companies that produce vulnerability scanners
they incorporate this information into their database, so that the
scanners can detect this vulnerability in form
automatic (later we will talk about scanners of
vulnerabilities)

Independent security researchers, when

discover a new vulnerability, they usually try
sell this information to the software company, or to
companies that are dedicated to buying and selling information of
vulnerabilities. Similarly, this information is
communicated to the public.

10
 On the other hand, if a hacker finds a vulnerability
new, certainly it is not made known to the company of
software, but rather takes advantage of it to hack companies that
have the vulnerable software installed.

The government of the United States has a base of

vulnerability data, [Link].

Regarding the attack process with exploits

(also known as "sploits"), there are two ways to
to carry them out. The old method ("old school", as it is said in
in English) is to program your own exploit and attack the application
vulnerable. También puedes descargar el código del exploit de la
Internet, generally programmed in C, Perl or Python, and launch
the attack in a semi-manual form. These two methods require
of a high level of expertise. The other method is to use some
penetration testing platform. These platforms allow you to
they allow automating the process; the platform identifies the
vulnerability, it indicates which is the most suitable exploit, and launches

the attack. A good level of skill is also required

technique, but not so much.

The attack procedure is as follows. The hacker

First check the target company's URL, and see what IPs
are associated with that URL. Then check the DNS records.
(whois) to investigate the IP ranges belonging to the
company. So with a tool like Nmap, create a

11
complete map of the open ports on each of the IPs.
Looking at the report, it is immediately obvious if an IP is
potentially vulnerable or not. Then select the IPs
vulnerable that will be attacked. If the attack is going to be 'old school',

Start the script, and attack the specific vulnerable port. If the
the attack is successful, the script introduces a program (the “payload”)
on the vulnerable computer. This payload activates a process
inside the computer, which opens a channel of
communication for the hacker. Then the hacker connects
remotely to the computer, and has total control over it.
On the other hand, if the attack is more modern, it can use
Metasploit, Canvas or Core Impact to introduce the payload.
These software packages make the process faster and
efficient.

Aside from the vulnerabilities found in software

Commercial, another category of vulnerabilities is the
found in web applications.

The vast majority of web applications are not

commercial packages, but are applications developed
by the company itself. These web applications, like the
traditional applications also receive input, process
data, access databases, and present results. But
are at a much greater risk, as their architecture is
completely exposed to the Internet.

12
 There are several ways to attack web applications, but the
the two most common are SQL injection and cross-site scripting
(xss).

SQL injection involves inserting commands into

SQL in the input fields of the web application, to see if the
the application is programmed to filter commands or not. If the
the programmer made the mistake of not filtering SQL commands from
the variable fields, it is possible for the hacker to introduce
SQL commands directly to the databases of the
web application. This could allow you to both extract and
modify confidential data.

Cross-site scripting involves injecting commands

of programming (such as Javascript or HTML) in the fields
of variables in a web application. By doing this, the hacker
for example, can make a person believe that they are
visiting a safe site, when in reality they are visiting a
hacker site, where someone steals your username and password. In another
the most dangerous type of cross-site scripting, the server in fact
accidentally stores the malicious code, and presents it to
any person who browses the site. In this way, a hacker
you can modify the content of a website at will, and steal
user data that visit the site.

13
 To defend ourselves against this attack vector, we have
to implement vulnerability scanners that help us
to detect and remediate them.

14
 Vector 2: Default Passwords

Default passwords are those that come pre

configured with the software packages or devices that
we acquired. This is one of the first attacks that attempts a
hacker, because although it seems incredible, a percentage
significant network administrators simply do not
they are a nuisance in changing the factory username and password. In

There are lists of usernames and passwords for packages on the internet.

of software and devices such as switches, routers,

firewalls, switches, IP phones, etc.

This is an operationally easy problem to fix;

simply change the default password and that's it. The problem
it's when the network administrator is not familiar with the
team, and doesn't even know that a software package, or more
commonly, a hardware team actually has a
default password. We can use IP phones as an example;
They all have a small web server to manage them.
remotely, and many of them come with default passwords.
On more than one occasion during penetration testing that I have

Indeed, I have found IP phones with default passwords. It

the same applies to network printers, routers, etc.

15
 Vector 3: Brute force of passwords

Since passwords are clearly the key to access

It makes sense to attack almost all systems. There are
two ways: to carry out a brute force attack, or a
dictionary, which is more refined. The brute force attack, that is to say
brute force, consists of testing all combinations
possible passwords, something like trying 'aaaa', 'aaab',
"aaac", "aaad", etc. It goes without saying that this method is very slow already.

that the combinations are countless. The other option, which

It generally works better, it's a dictionary attack, that is
using lists of common words. This attack process is
can be automated.

And the users do not help at all. In an incident of

recent hacking1the hackers revealed the most passwords
common ones used by millions of users. These are the 10
most commonly used passwords by that group of users:

1. 123456
2. password
3. 12345678
4. lifehack
5. qwerty

1
[Link]
passwords/

16
 6. abc123
7. 111111
8. monkey
9. consumer
10. 12345

Seeing this, it's obvious why the attacks of

dictionaries work.

There are network administrators who believe they are immune.

to dictionary attacks, because they have configured their

sistemas para que se bloqueen si hay más de cierta cantidad de
failed attempts when entering the password. And indeed, if you
try to use a dictionary of thousands of words against
a single password field, it gets locked. But the attack does not.
It is done like this. What the hacker does is try a few
words from the dictionary on thousands of websites simultaneously.
By doing this, the websites are not blocked, and simply by
the large number of sites attacked simultaneously, just because
statistical probability, some of those sites use one of
the few passwords tested by the attack. After several
minutes, as the password lock timer resets, the
hacker tries again (all in an automated way) and that's how it goes
obtaining passwords from different sites and network elements
exposed to the Internet. One solution is to force users to
use really strong passwords, with words that are not in
the dictionary, including letters, numbers, and characters

17
special. Another possible method of defense is to use
two-factor authentication, that is, using a password and a token.
This is done with banking sites. Another solution is the use of
biometric access.

18
 Vector 4: Password theft

There are two ways to steal passwords: through

social engineering, or by technical means. The method of the
social engineering consists of contacting the person and making oneself
pass for someone else, and convince them to reveal their username and
password. A common trick is to call the person on the phone, and
Tell him something like 'Hello Juan, this is Pedro from systems. You'

I comment that we are reconfiguring system X, and I need

Please give me your username and password to delete them from the system.

and assign you a new one.” This call is very good

opportunity for success, and the only defense is to train the
users to detect these scams. But again, the
users do not help. A few years ago, a study was conducted; it was conducted on

offered to people on the street in Liverpool, England. 70% of

they were willing to reveal their username and password in exchange
of a chocolate. Worse yet, 34% of them revealed their username and
password without even having been offered anything in return.2

The other technique to steal passwords is to convince the

user to visit a website that looks like the original, but that in
Reality is a fake website created by the hacker. The user
enter the site, which looks identical to your bank, your account of

Paypal, or the login page of your company's intranet. To

[Link]
chocolate

19
enter your username and password, the one who receives them is the password.

The user receives a false error message, and without suspecting

Nothing, assume that the page is temporarily down.

There is another type of password theft: when a

employee leaves the company but takes the passwords with him
they have remote access to the systems. It also happens that the
employee, knowing that he is going to leave the company, creates his own

passwords to use later, connecting remotely to

stealing or modifying information. This is known as a
back door

Finally, another very simple method to intercept

passwords is the exploitation of WiFi access
insecure. The hacker connects to the WiFi access point of
some coffee. Other users are also connected, checking
your email without password encryption, or browsing in http, in
place of https. There are specialized software packages in the
packet interception (sniffers) that are constantly
monitoring the data flowing through the WiFi, and automatically
they capture users and passwords.

20
 Vector 5: Session Interception
In this type of attack (man-in-the-middle attack), the
hacker places himself in the middle of the communication between two

computers. Receives the packets from computer A, the

read to learn about the message, and then forwards it to the
computer B, who does not realize that the message was
intercepted.

This type of attack requires access to the channel

communication between the two computers; therefore, the
the hacker first has to penetrate the network perimeter, enter to
the local network, and then intercept the transmission. It's hard to
to do, but it is a very powerful attack because you can
intercept data flows, emails, and even voice transmissions
that travel in VoIP.

In a penetration test we conducted in a

occasion, we managed to crack the client's WEP password from
the reception room; then we used a software package that
allows interception of VoIP, and we were able to record the

company telephone conversations.

Encryption is the best defense against

session interception. It is also important to establish rules
of robust firewalls; for example, a rule that allows traffic
among all the VoIP devices, but don't let it
access to this traffic to IPs assigned to PCs or servers.

21
this way if a PC is hacked, it will not have the ability to
intercept the traffic between an IP phone and a switch.

22
 Vector 6: phishing

Phishing consists of sending emails with links to sites

counterfeit web, with the intention of making the user believe that they are
by entering your username and password on the legitimate site of your
bank, from your Paypal account, Hotmail, Facebook, etc.

All browsers now have a site filter for

phishing, which protects the user to a certain extent, since the
browsers take time to detect a phishing site and
add them to the list. Hackers are constantly creating
new fake sites and sending emails, so the first ones
In receiving emails, they can easily fall.

These phishing emails not only have links to sites

false; they can also direct the user to infected sites of
malware, which can download Trojans and take control of the
User's PC. Another method is to attach an infected file.
(for example a PDF).

When the email is specifically personalized

for the user, using their name, references to their acquaintances,
his work, etc., is called 'spear phishing.'

There is software and appliances that can filter some of

the most obvious phishing messages, but the only defense

23
it is truly effective to educate users so that they know
recognize phishing emails.

24
 Vector 7: sites infected with malware

There are two types of sites infected with malware: sites

hacked ones to which malicious scripts are added, or sites
made by the hackers themselves.

The user, upon entering one of these sites, activates without

want a malicious script that downloads malware onto your
computer. The script can be written in Javascript, or
It can be an ActiveX, or a Java applet. If the browser
used by the user is a vulnerable version, the script can
take remote control of the user's PC.

Another common trick is to ask the user to download

a certain plugin to be able to see the photos or videos of the site, or to

download music. This plugin, of course, is malware.

PDFs can also contain malicious scripts, and if the

the user is using a vulnerable version of Adobe, it remains
infected.

This attack vector usually comes combined

with a phishing action, but not always. It is also
it is possible to deceive users into visiting the site
infected using online advertising.

25
 Vector 8: Attack on web applications

Poorly designed web applications are one of the

main sources of insecurity in a company. The
the web application is exposed to the Internet, and hackers can
to take all the time in the world to look for him/her

vulnerabilities. Behind each form is a database,

and this is exactly what the hacker is looking for. For the
A poorly implemented web application can give access.
The hacker stole the company's data.

The Open Web Application Security Organization

(OWASP) publishes the list of the 10 vulnerabilities every year
most important web application vulnerabilities ([Link]). From

The 10 vulnerabilities, there are two that are always present.

because they are the most dangerous: SQL injection, and cross-site

scripting. In both cases, as well as in the case of vector 1,

exploits, the error originates from the programmer, who forgets
validate the input in a field of the web application.

In the case of SQL injection, the malicious application

programmed allows the hacker to modify the SQL query

within the URL, and the application obeys the command. This is a
example.

The following line from a website would show the list of

clientes:

26
 [Link]
sp?clientid=123

But a hacker could add a semicolon, and a

SQL command after:

[Link]
sp?clientid=123; DROP
CLIENTS Table

By doing this, if the web application does not validate the presence

of unauthorized SQL commands, then the database

will delete the table 'clients'. With this method, you can introduce
all types of SQL commands to show, modify, and delete
data from the tables.

Cross-site scripting works in a similar way; the

hacker introduces for example JavaScript in a field of the
web application. If the web application saves the data (for example
on a forum), whoever accesses that page will execute the script
unintentionally malicious.

The solution for these two types of attacks can be found

mainly on prevention. The programmer must
implement safe programming practices, and ensure

27
that your program checks when SQL instructions or
Javascript has been introduced in fields that should not run them.

Vector 9: Virus, trojans and worms

Viruses, Trojans, and worms are malware that infect

computers with the purpose of taking control of them,
destroy data, or simply cause problems.

Viruses are programs with the ability to attach themselves

to other programs and self-replicate. The user, when sharing
files or USBs, can infect other computers. If not
It can replicate itself, it is not considered a virus. Its function
The main thing is sabotage, although many viruses are made.
simply for a hobby.

Trojans are programs that seem harmless or

that are virtually invisible, but allow the hacker
take actions on the infected computer. These actions
they can be things like following up on navigation of the
user to place relevant advertising (spyware and adware),
capture users and passwords from visited sites, especially
online banking sites (key loggers), or convert to the
infected computer in a zombie part of a botnet. The
users can download games or other useful tools,
without knowing that they are trojans.

28
 Worms are programs that have the ability to
propagate from computer to computer across the network,
exploiting vulnerabilities.

The programs antivirus y antimalware son

generally effective in preventing these infections. But there are
a type of trojan that cannot be easily detected: the
virtual trojans. A virtual trojan is installed within the
operating system of a virtual machine. If a company uses
virtualization technology (such as VMware) and download a
virtual machine of the Internet, it is possible that this comes with a
Trojan installed. That's why it's important to use virtual machines.
only from known sources.

29
 Vector 10: Social Engineering

Social engineering is the art of deceiving people.

to extract information from them. The most common objective is
make them reveal their users and passwords, but also
they can be deceived into downloading trojans, using CDs or
Infected USBs, or simply allowing physical access.

A common trick of hackers is to investigate the name and

phone number of someone in the company to attack. So
he marks it and says something like 'Hello Juan, it's Pedro speaking from'

systems. Hey, we are reassigning users and passwords

for the X system; could you provide yours so I can give you
some new ones? Surprisingly, this simple method works.
muy seguido.

Another very effective method is to send it to some employee.

by courier a USB that activates a trojan at the time of

connect. A letter can be sent to the victim with
any type of story: what free software is, what it includes
sales reports, or the budget of something, etc.

Another extremely effective trick is to have it done

tens (or hundreds) of USBs with the company's logo, and that
contain an installed Trojan. So these USBs are
can you send by messaging to the company for distribution to
the employees, as if they were coming from marketing. Or simply

30
they can be left scattered in public areas outside of the
company, and undoubtedly a high percentage of employees seeing
the logo of your company on the USB, they will take one, they will connect it to

your computer, and your computer will be infected.

Social engineering can also provide access.

physically to the company's network. The hacker can arrive disguised
from the supplier, and manage to enter a meeting room or hall
wait. If there is an available network node, it will be possible to connect to the

local network.

The only defense against social engineering is the

continuous training of users. Since this is very
difficult, this low-tech vector is one of the favorites of
the hackers.

31
 Vector 11: Wireless Attack

The great advantage of using a wireless network is that

wherever you are in your office, you are connected. You don't have to
walking to find a network node. The big disadvantage is that your
Data is flying through the air, and it can be intercepted.

Until recently, the use of wireless networks was

extremely risky, because the encryption protocol
used, called WEP, could be hacked relatively easily.
Fortunately, a more secure protocol called has emerged.
WPA. It's not 100% secure, but it's sufficiently more difficult.
about hacking that ceases to be a profitable vector for the hacker,
because it takes too much time.

The big problem is that despite the fact that there is already WPA and

WPA2, many companies continue using WEP out of ignorance,

and are at significant risk.

In fact, one of the biggest hacks of recent times

years was the one made against TJ Maxx, in which
45 million credit card numbers were stolen.3This
an attack was made against the wireless network of one of the stores
from the chain; the hackers were in a car in the

3
[Link]
security/t/tj-maxx-theft-believed-largest-hack-ever/

32
parking, using a special antenna to amplify the
wireless network signal, to which packets were injected
until they managed to break the password. It is important
remember that when using a wireless network, our data is
flowing not only within our offices but also outside
also. That is why it is important to use WPA2 and a password
strong.

33
 Vector 12: Physical Team Robot

This is a fairly common method, especially in

industrial espionage cases. A hacker who is only looking to steal
credit cards are not going to try to steal a laptop. But
someone hired to steal trade secrets, certainly
yes.

Once the hacker has physical access to a laptop,

It's just a matter of time before the password is broken. There is
available software that does exactly that; whatever this
software does is to create an alternate boot disk, generally
in Linux, to boot the machine. So, from that
instance, the hard drive is accessed, and the hash of the
password. Other, more sophisticated versions can read
directly the data written on the hard drive, without the need
of the password.

The only measure against data loss due to

equipment theft is the full encryption of the hard drive. Still
it's not 100% safe against a real attacker
determined. That is why it is important to implement policies of
data protection in which users are not allowed
copy highly confidential data to their laptops, and that only
have access to this data on the company's intranet. From
in this way, we prevent the data from physically leaving the
company.

34
 Vector 13: Physical access to the network

Having physical access to the network is the greatest achievement of

hacker. With physical access and enough time, it can be achieved.

that it is in the matter of data extraction and modification.
Fortunately, it is difficult for a hacker to achieve this, but
There are certainly methods. One that we already mentioned is to make oneself

to go through the provider. This gives access to the hacker, but not

necessarily a lot of time. Another method, more difficult, is that

the hacker becomes a provider of truths, or worse yet, in
company employee. One more method is to bribe someone
employee; in this way the hacker can ask him to install
software, password management, etc.

An advanced technique that can be implemented a

once physical access is achieved, it is to leave connected to the network a

small computer hidden somewhere. This

computer can be camouflaged, for example to
it looks like a UPS. It is placed under a desk, connected to the
electricity and a network node, and the hacker will have access to the
same remote way, and therefore unrestricted access to the network.

The best way to mitigate this vector is through

physical access control, thoroughly checking who enters the
company. Another important method is the correct configuration
from the network nodes. Any network node that is not connected to
a team must be disabled from the switch. Many

35
companies have all the active nodes, and also with DHCP.
This makes things much easier for the hacker.

36
 CHAPTER 3: DEFENSE

The goal of defending a network is to protect the

confidentiality, integrity, and availability of data
contents in it. This is difficult because the actions that
let's take measures to protect the confidentiality and integrity of the
data automatically reduce availability, and vice versa. If
we would like a maximum level of confidentiality, easy,
we simply encrypt the data, we disconnect them from the
red, and we locked them in a reinforced safe in a basement
concrete. This way we have 100% confidentiality. But
we also have 0% availability. We could go to the other one
extreme; to achieve 100% data availability,
easy, we publish everything without a password on a public website;
but obviously the confidentiality would be 0%.

Then the defender has the difficult task of achieving a

reasonable balance between the three variables of confidentiality,
integrity and availability (which is different for each
dataset), and under a generally budget
limited.

Because that is the other important variable: the

budget. If we had unlimited resources, we would buy everything
the software and hardware that exist and will exist, and a team of a thousand

engineers monitoring each login and each packet flowing through

the network. But we can't do that in real life.

37
 Therefore, we must take into consideration two
fundamental strategic principles of cyber defense: the
principle of 'Defense in Depth', and the principle of the 'Bear'.

The concept of 'Defense in depth' consists of

put several redundant barriers around the data that
we want to protect. This has two major advantages. First, if
If one line of defense fails, the next line will block it.
attack. Second, even if the hacker is very skilled, each line
defense takes time. If a target represents a
too great an investment of time and effort, it is more
likely that the hacker will desist in his attack. Which leads us to the
next strategic principle.

The principle of the 'Bear' is based on the saying that if

A bear is chasing you, you don't have to run faster.
than the bear, but faster than your companions. In other
words, we must strengthen our network not to 100%, but
harden it more than other companies, thus the investment in
the hacker's time and effort are not very productive, in
comparison with other companies. If other companies or
organizations present easier targets for the hacker,
less chance of us getting hacked. It's all a matter of
of investment analysis vs. risk.

38
 To strengthen our network and make it less attractive
for hackers, there are five procedures that we must
to fulfill

1. Intrusion prevention: preventing the hacker

join our network.

2. Intrusion detection: if the hacker gets in,

we must detect what is inside.

3. Prevention of extraction: once it

we detected, we must prevent it from extracting or

modified information.

4. Intrusion elimination: finally, we must

eliminate the presence of the hacker in our network.

5. Denial prevention: if the attack is from

denial of service, we must take
measures to ensure that our users
continue having access to the information
required.

So, we see that we have 13 attack vectors, and

5 defense procedures. Based on this, we will build the
controls that we logically have to implement for

39
stop each of the attack vectors, using the
defense procedures. Let's now look at the controls.

40
 Control 1: Firewalls, Routers, and Switches
Attack vectors that it prevents: 1-Exploits; 13-Access
physical to the network.

Defense procedure: 1-Intrusion prevention.

Type of software used: administration software
firewalls ("firewall management")

The ultimate intrusion prevention weapon is the

firewall. As we all know, the firewall separates the interior of
exterior of our perimeter; it is the gate that lets in and
exit to data and users according to established rules. Without
without firewalls we would be completely exposed to immediate hacking.

Now, by simply putting up a firewall and some rules.

basic is not enough. For our personal modem that
We have at home the rules are simple: allow the exit of
http and https, and do not allow the entry of anything. But in our
organization the rules are much more complex, and we have
more than one firewall. The greatest risk in these cases is that the
rules become so complex, and have so many exceptions,
that we do not know for sure what type of traffic and which IPs they have

what permissions. This is what we must observe.

In addition to firewalls, we have our routers and

Switches. Properly configured, they represent a line
of important defense. For example, the configuration of the
VLANs in the local network make the difference between unrestricted access.

41
for a hacker, or making the job very difficult. When I did
penetration testing, once the perimeter has been breached
(relatively easy to do, we'll talk about that later), if the network of
my client had VLANs, I found things very difficult. But
If not, from the compromised machine I could see all the traffic.
flowing through the network with sniffers, and take all kinds of actions,

how to find other vulnerable machines, or even intercept

passwords and phone calls about VoIP.

There is a belief among some network administrators

that if they already have their firewall, they are safe; their network will not be

hacked by hackers. And nothing is further from the truth.

If we visualize our firewall as a wall around
Our data fortress, in fact, the wall protects us from the
"ground attack" from the hacker. But it does not protect us from the attack.

air: phishing and sites infected with malware.

If the hacker sends the user an email with a PDF

infected, and if the user's computer has a version
Adobe vulnerable, then the hacker will be able to take control of
the computer, and the firewall will not be able to do anything about it.

The hacker's program will connect from the computer.

the hacker's computer compromised outside the network via http, and
the firewall will allow it without problems.

42
 Within this control, we can implement 9 processes.
specifics:

a) Firewall effectiveness test

There is firewall auditing software that allows
automatically verify the rules of the firewalls. The
software can perform dynamic tests to see how it
traffic patterns behave when crossing firewalls.

b) Vulnerability analysis of elements of

red
Apart from the configuration of rules in the firewalls,
we must scan all network elements to detect
vulnerabilities in their operating systems. These scans are
they can be done with vulnerability scanners. We will talk
about the details of the vulnerability scanning more
forward.

c) VLAN Implementation
The implementation of VLANs in switches limits the
free passage of a hacker if he penetrates the network. When one has
too general subnets, the hacker, when compromising a
computer, can see the traffic of the entire subnet since there is
a broadcast of packets to all IPs; analyzing the traffic
you can see what other machines are present on the network, and of
to attack them there. By dividing our network into virtual networks, or VLANs,

we significantly reduce the domain of the broadcast of

43
packages, so the hacker can only see the
packets that flow within the VLAN where it is located,
thus reducing the risk of detecting other vulnerable IPs.
Similarly, the IPs of users who require access to
servers with confidential data can be placed in the
same VLAN, in that way the IPs of the servers with these
valuable data can only be accessed by those IPs (to the
less than if you allow other IPs in the firewall.) The
The security advantages are clear, however many
companies dismiss the use of VLANs. In my experiences
as a pen tester, as soon as I saw there were VLANs, I knew that
things were going to be much more complicated. Yes, there are techniques

to jump from one VLAN to another; this hacking technique is

is known as "VLAN hopping". The technique consists of using a
software package emulates being a switch; then the hacker
can inject packets into the physical network, emulating being from
VLAN1 even if it is in VLAN2. Let us not forget that the
VLANs are by definition virtual, so they are indeed
manipulables a nivel paquete. Entonces no es una línea de
perfect defense; but let's remember that the goal is defense
in depth: putting many stones in the hacker's way,
to make the attack extremely difficult and unproductive.

d) Deactivation of unused network nodes

In a penetration test I did for a client,
the first day I simply arrived at their building, entered the area of
reception, dressed in a suit with my laptop, and I sat in the living room

44
waiting. The receptionist didn't even look at me. So I checked
the wall, and indeed, there was a network node. Calmly
I took out my laptop and a network cable, and I connected to the node. No

there was only the active node, but it had DHCP, so I

an IP was assigned immediately. And indeed, I could see the subnet
enter that office of the company. After that, I proceeded to
do what a pen tester has to do.

It is essential to have a catalog of all the nodes of

the network, and have them all disabled by default, and only activate them

activating as certain teams require it.

It also does not use DHCP in a generalized way; use static IPs.
it is more laborious, but also safer. If you need to use
DHCP for a group of employees who come and go, put
this range of IPs in their own VLAN. If you have clients,
suppliers or guests who enter your organization and require
Internet, I suggest that you acquire a broadband service.
apart, and give them wireless access; this way their traffic does not
touch your network.

e) Implementation of DMZ
All mail, web, ftp, proxy, VoIP, or
any other server that has a public IP must be in
the perimeter network, also known as the DMZ. With that we
we ensure that these servers, which are under attack
constant, they are in their own network, and if this is breached, the
hacker cannot penetrate the LAN.

45
 There are two basic ways to implement the DMZ: with a
firewall, or with two firewalls. These are the architectures:

1) Implementation of DMZ with a firewall

Servers
Red www
Internal ftp
smtp

Firewall

Router
connected
the Internet

46
 2) Implementation of DMZ with two firewalls

Servers
Red www
Internal ftp
smtp

Firewall Firewall
A B

Router
connected
the Internet

The second implementation topology is the most

secure, because if the firewall B is compromised, the hacker still
I would have to go through firewall A. The recommendation is that the
firewall A and B are from different companies; in this way if
there is a specific vulnerability in firewall B, it does not
will be present in firewall A.

47
 f) Entry rules documentation and
expense
The firewall auditing software allows you to visualize in
hierarchical form all the rules of the firewalls in the network, and
how these rules work together. In this way
we are sure that the rules fulfill their purpose, and that
There are no redundant rules that affect the performance of the network.

A very important process consists of reviewing periodically

the firewall rules, and deactivate those rules that are no longer
they are in use.
The way it is recommended to organize the rules is in
4
5 groups :

1. Global blocking rules ('deny'): In these

you have all the protocols that will never be allowed, and the
prohibited connections between IPs (such as "any to any").

2. Global access rules ('allow'): In these

rules are all the protocols allowed for everyone, such
like HTTP outbound and DNS, as examples.

3. Rules for specific computers: Here

we have specific interactions between IPs with internal IPs and
external. For example, here you can set the rules that

4
[Link]

48
access to important servers is restricted to only certain
IPs that require access.

4. Rules for specific IPs, specific URLs,

special protocols.

5. Rules for everything else.

We must pay special attention to the rules in the

groups 3, 4, and 5, which are the ones that could change over time.

g) Automation of change control

The network administrator or information security is
always under pressure from users to open ports, and
permitir accesos a ciertas IPs y URLs. A veces estos cambios
they are justified, and sometimes not. But the important thing is that

you have a formal process to make these changes. The software

Firewall auditing allows you to keep track of changes.
about the rules and settings to prevent creation
accidental violation of unsafe rules, or rules that violate the
standards established by the company.

h) VPN implementation for access

remotes
The goal of implementing a VPN is to give access.
remote to our LAN to the user, generally employees or
business partners. Here the risk we face is that if the

49
the user's computer is breached, the hacker may have
access to our LAN. So the first consideration is
that the range of IPs you are using for the VPN must be
have minimum access permissions within the LAN.
Obviously, this applies to all computers, even those that
they are physically connected within the company, but it is
It is important to stress that the computers that are connected
through VPN they are not within your security perimeter, in other words

that you are not protecting them with your firewalls, so we need to
consider them a greater risk. In fact, you must
consider the IPs coming through the VPN as if they were one
DMZ. So configure the firewall to give access to the
VPN users only to the IPs they really need to access
(like the intranet, for example), and only to the protocols that
require use. For example, if the VPN users only
they need access to the company's intranet, so allow it
http and https, but do not allow any other protocol. Like
as an extra security measure, you can implement a firewall
separated for the VPN network, exactly like a type 2 DMZ.

On the other hand, the hardware for VPNs can present

vulnerabilities. We will cover that point in control 8,
vulnerability scanning and remediation.

50
 i) Analysis of firewall logs
The firewall is useful not only for blocking access, but also
to detect intrusions and perform forensic analysis after a
attack.

The main tool for detecting intrusions

dynamically it is our IPS/IDS system. But there are things
that the IPS cannot detect. For example, if a computer
it gets infected with a trojan, and that trojan tries to go out through http to

your control server, the IPS may not detect it, because the http
outbound is allowed. But when analyzing the logs of your
firewall you see there were several computers trying to
connect to an IP in China at 2am, then you will know that
something is wrong. That's why it's important to do a manual analysis and

meticulous, daily, of the logs. And as you continue to see

unusual behavior that you hadn't anticipated, you can go
including in your firewall and IPS rules. For example, in the
case of the Trojan, knowing that none of your users have
nothing to do visiting IPs in China, then in the firewall
you block all the IP ranges from that country.

Another thing you will see in your firewall logs are the
continuous access attempts by hackers. If you have seen your
logbooks at some point, you will know that every public IP is under a
constant rain of port scanning; there are hundreds of thousands of
hackers out there, with automatic programs, scanning
the ports of all IP ranges, looking for openings. In

51
generally, you don't have to worry about that 'noise'. But if you see
in your logs constant SSH connection attempts to an IP
yours that has a login via that protocol, then you will know that
They are trying to break the password of that IP, so that means already

it is a specific attack, which requires preventive action from you

part.

An advanced technique used by sophisticated hackers is

"desensitize" the defenses of your network. They will perform scans and

constant low-level attacks on your IPs and URLs. At first

this will trigger alarms, but the low-level attack will continue
several days, and you will get used to it and conclude that 'nothing happens'.

So within that noise, the hacker will initiate an attack.

There is software that helps you analyze the logs, but
so far nothing replaces the deduction of a mind
human.

52
 Control 2: Secure Implementation of DNS
Attack vectors prevented: 1-Exploits
Defense procedure: 1- Intrusion prevention
Software used: vulnerability scanner

If your organization has few users and little traffic

http and email, it is best that you use one of the
Available public DNS, such as Google DNS
([Link] u OpenDNS
([Link] In theory, these two services are
safer than using your Internet provider's DNS,
simply because they are large and well-known companies, with
millions of users. If there is a hacking incident involving them
DNS servers, everyone will find out immediately.
This is not necessarily the case with your DNS.
Internet provider. If you use public DNS, its security does not
It's your problem, beyond keeping you informed of its status.

53
 On the other hand, if your organization has enough traffic
towards the Internet, you surely have your own DNS servers
installed, since the address resolutions are saved
in the cache, and they work faster. If this is your case, the risk
you face the so-called 'DNS hijacking', that is when the
hacker takes control of your DNS server, and acquires the
ability to redirect your traffic to the sites the hacker wants.
Your user could then enter the URL of their
online bank, and the traffic would be redirected to an identical site,
except that under the hacker's control, who will steal the user and
password, or worse, carry out a 'man in the middle' attack, the
which could even intercept the banking token data.

54
 Let's now look at the specific processes of this control:

a) Vulnerability scanning on servers

DNS

The attack on a DNS server is done exactly as

to any other server; therefore the first control that
we must implement is the scanning and remediation of
vulnerabilities, to prevent it from being attacked through a
exploit. Both the server's operating system and the software
The DNS itself can have vulnerabilities. The software
vulnerability scanning will allow you to detect and
remedy them.

b) Hardening of DNS servers

The hardening of a server generally consists of

change the default settings to make them more secure.
This is a general process that we will see in control 9, but
there are specific hardening processes for servers
DNS. The most well-known process is checking the cache to verify
that has not been modified illegally ("cache poisoning"). The
vulnerability and compliance analysis software
Policies ("policy compliance") help you fully automate
all processes related to the hardening of DNS.

55
 Control 3: Password Management
Attack vectors that it prevents: 2-Default password;
3-Ataque bruteforce a passwords; 4-Robo de passwords

Defense procedure: 1-Intrusion prevention

Software used: vulnerability scanner,

two-factor authentication.

Being one of the most used attack vectors,

there is much to be done to mitigate his risk.

Their processes are as follows:

a) Vulnerability scanning of passwords

This process involves scanning your servers to

detect the presence of default or easily guessable passwords.
The vulnerability scanner does this automatically, but
Generally, you need to configure the password dictionary.
correct, since this can change from country to country. Every time
the scanner detects a shape that accepts passwords, try
all relevant default passwords, and the dictionary of
attack, to see if it manages to access.

b) Password policy scanning

56
 This is a process that is performed with the scanner of
compliance with policies. The scanner will detect things like
user lists with blank passwords, the permissions of
user access, the minimum length policy of
password, the password expiration frequency policy,
password blocking policy, etc.

c) Removal of default passwords

Apart from eliminating default passwords upon finding them

during a scan, this process consists of eliminating them as soon as
the hardware or software is acquired.

d) Uso de autenticación two factor en

servers

For every server that contains real information

valuable, implements login through two-factor authentication, or
it is using a password and a token, or biometric access.

e) Use of two-factor authentication on PCs

There are already many laptop models that come with a

fingerprint reader; start replacing your current models with
these models with biometric authentication.

57
 Control 4: Hardware Inventory
Attack vectors that it prevents: 1-Exploits
Defense procedure: 1-Intrusion prevention
Software used: vulnerability scanner, software
network administration

Sometimes it happens that a user installs their own server.

on the company's network; or bring a wireless modem and it
install if authorized. Or even more complicated, install Vmware or
some other virtual platform on your computer, and it starts to
download virtual applications from the Internet. These
applications will be virtual, but from the point of view of
security, represent exactly the same level of risk
than the physical hardware. A virtual machine has a system
operational and real applications, which can come
vulnerable; also the virtual machine has an IP, so
in theory it can be hacked. Therefore, the machines
virtuals must be part of the hardware inventory.

Let's now look at their processes:

a) Hardware inventory lift in

the network

A vulnerability scanner can create a map for you.

complete and inventory of your hardware; you can also use
network management software. Mark the hardware

58
authorized, and generates reports for all hardware that is not
on your allowed list. For servers and network equipment, do not use
DHCP, but static IPs. In your hardware inventory, keep a
correlation between the hardware and its assigned IP. This way you can

correlate the hardware with the firewall permissions of the device

physical.

b) Deactivation of unauthorized hardware

Deactivate all hardware that is not authorized.

I recommend that you establish firm policies regarding the
hardware installation without authorization. A way to
Controlling it means not using DHCP, and managing it carefully.
IP assignment. Additionally, it is recommended that you do not allow the

use of virtual machines without authorization, as it brings

vulnerabilities to the network, and they can also come infected with
trojans virtually undetectable. The scanner of
vulnerabilities can detect the presence of Vmware and others
virtualization software packages, and can detect
virtual machines running.

59
 Control 5: Software Inventory
Attack vectors that it prevents: 1-Exploits

Defense procedure: 1-Intrusion prevention

Software used: vulnerability scanner, software

network administration

Keeping an updated software inventory is

much more difficult than maintaining hardware inventory, because of the
simple reason that users can download and install
software on their PCs.

Now let's review your processes:

a) Inventory assessment of software in

the net
This survey is conducted using the scanner of
vulnerabilities. The scanner has the ability to connect to
the computer, and see the list of installed software on the
computer. Then a report can be generated from
unauthorized software.

b) Uninstallation of unauthorized software

This process has a proactive component and one
reactive. Proactively, when you install new hardware,
do a scan to see what software comes pre-installed, and uninstall

60
all the packages that are not going to be used; the fewer
software, lower the attack surface. Reactively, in
Based on the software inventory report,
uninstall the software that has been added to the network without
authorization.

61
 Control 6: Inventory of ports and services
Attack vectors that it prevents: 1-Exploits
Defense procedure: 1-Intrusion prevention
Software used: vulnerability scanner

Regarding ports and services (protocols) used

in a network, there is a clear distinction between the protocols that are
they must be allowed, and those that should never be active. By
for example, telnet is an insecure protocol, replaced long ago
much through ssh, so it should not be allowed on your network. From
the allowed protocols, some are more vulnerable to attack
what others, so philosophy must be: a protocol that is not
if it has a specific use, it must be prohibited.

Let's now look at the processes related to this control:

a) Inventory survey of ports and

services
This survey is done with the scanner of
vulnerabilities. Generate a report of all ports and
services detected on your network. There is a protocol that obviously

you must allow (http, dns, smtp, etc.) and others that obviously
You must eliminate (telnet, irc, etc.), but there will be others that you are not.

sure what they are being used for. Check the computers that
they are using these unknown services, and see what application
he is using them. Then compare with your software inventory to
check if that package is authorized or not.

62
 (b) Deactivation of ports and services
unnecessary
There are two procedures: first remove the software.
unauthorized to be activating those ports and services.
Then, make sure to block all in your firewalls
protocols that are strictly prohibited on your network. From this
the next time a user installs software do not
authorized with unauthorized services, the firewall will block them.
In case of doubt, block the service. Surely the user will
will talk to see what happens, and you will find out immediately about the

unauthorized installation of software.

63
 Control 7: Inventory of GUIs
Attack vectors prevented: 2 – Passwords
default; 3-Brute force password attack

Defense procedure: 1-Intrusion prevention

Software used: vulnerability scanner; sniffer

of traffic.

Web interfaces (GUI, 'graphical user interface') that

Accepting users and passwords is a clear vulnerability. Without
Doubt you have well identified the GUIs of your web applications.
The problem is that many times certain software packages
and hardware come with small web servers for their
administration, and they come activated by default. For example, the
most VoIP phones have a web server integrated
administration; when you connect the phone and assign it a
IP, when accessing this IP on port 80, you can see the GUI of
phone, which usually comes with a default password, and by
so easily hackable. In a vulnerability analysis
that I carried out for a government entity, the element that
more vulnerabilities were detected during the scan were the
web servers of multifunctional printers that
they had just acquired; they had no idea that they came with a GUI
for its administration.

64
 The only process is the following:

a) Inventory of web interfaces on the network

The first step is to run scans to detect which IPs
they have ports 80 and 443 open. Any web login interface
Usually uses https, and sometimes http. Generally these
protocols run on ports 443 and 80 respectively, but
not always; sometimes the web administration servers
they activate unusual ports. So, you should also do
analysis of periodic traffic with a traffic sniffer, or
analyzing the logs of your firewall, to see which IPs are
transmitting http and https.

Proactively, whenever you install hardware and

new software, check the documentation to see if it comes with one
GUI.

65
 Control 8: Scan y remediation of
vulnerabilities

Attack vectors that it prevents: 1-Exploits; 8-Attack on

web applications

Defense procedure: 1-Intrusion prevention

Software used: vulnerability scanner; software

of virtual patching

Recalling what we mentioned in the section of

attack vectors, a vulnerability is an error of
programming that allows a hacker to introduce their own
program in a variable of the vulnerable program, thus
control of the machine in question. The scanning of
detect vulnerabilities in these programs with a high degree of
precision, and it indicates how to remedy them.

These are the processes related to this control:

a) Vulnerability scanning
There are two categories of vulnerability scanning:
scan to normal software, and scan to web applications.
These scans are radically different, so
I will proceed to explain each one.

66
 The way a scanner makes the detection of
vulnerabilities in normal software is conceptually very
simple. There are two types of scans that we can perform:
authenticated, and unauthenticated. When the scan is done without
authenticate, what the scanner does is detect which ports it has
Activate the scanned machine. Based on the open ports,
deduce what software related to those ports is installed.
Then, compare a database of vulnerabilities, and if the
installed software corresponds with some reported software
as vulnerable, it indicates in the results report. Without
embargo, una scan without authentication is less accurate than the

authenticated scan, since when trying to detect the software

installed using only open ports as a base, it can
to have more errors, that is, false positives. That's why the method
more precise and recommended is the authenticated scan. In this
type of scan, the scanner has its own username and password
on the machine to be scanned. Then it logs in in the form of
automatically, and check the list of installed software. So
proceed to compare this list of installed software with the database of
vulnerable software data, and based on this generate a
report. By knowing exactly which software is installed on the
machine, logically the scan is much more precise. But still
there can be false positives, as software that was
uninstalled or updated sometimes leaves false trails, such as
records in the registry, or installed folders, that can
confuse the scanner. But the leading scanners in the market
they can achieve a precision at a 6 sigma level, that is only

67
3.4 errors per million scans, one error being a false one
positive or a false negative.

The other type of scans is for web applications. This type

the scan is active, in the sense that the scanner injects
SQL or JavaScript codes; if the web application responds
with errors, then it means that it is vulnerable to SQL
injection or cross-site scripting, respectively. Logically
there cannot be false positives here, since the scanner is not
making an inference about the presence of a certain version of
a software package, inference that may be incorrect; it
what is being done is an active test, on the web application
live, and see how this one responds. Based on its response in
It is determined whether it is vulnerable or not.

b) Remediation of high vulnerabilities

risk
Once we run the scan and have the results,
the important thing is to focus on the highest vulnerabilities
risk. Generally, to remediate a vulnerability, one must
install a patch, but on many other occasions
certain services need to be disabled, certain software needs to be uninstalled,

or simply there is nothing to do because the software

vulnerable is a 0 day and there is no solution yet.

68
 c) Remediation of risk vulnerabilities
medium and low

After addressing the high-level vulnerabilities,

we need to remedy the medium level ones. The low level ones
they are generally not that important; if you have time to
remedy them later, but logically always attend to the ones from
higher level first. This may sound obvious, but sometimes the
solving low-level ones is much easier, and we can
wasting our valuable time focusing on the easiest things.

d) Implementation of virtual patching

What virtual patching software does is receive the
vulnerability report from the scanner, and proceed to block the
access to the applications that were reported vulnerable. From
this way, while we proceed to fix the vulnerabilities,
which can take hours, days, or weeks (let's hope not
months), the vulnerable application is protected from attack. The
Virtual patching fundamentally works like a firewall or
IPS specialized installed on servers and PCs. This firewall-
IPS filters any type of malicious traffic that
go directed to the vulnerable application. This is an excellent
method to mitigate the risk of attack on that application, while
the permanent patching is implemented.

69
 Control 9: Hardening of servers and PCs

Attack vectors that it prevents: 1-Exploits; 2-

Passwords default

Defense procedure: 1-Intrusion prevention

Software used: vulnerability scanner

When we acquire new hardware and software, many

the configuration variables can be parameterized
in an insecure manner. For example, usage policies of
passwords can be weak, or it may allow the use of USBs.
Other controls are absolutely esoteric, but not for that reason.
less important. For example, the use of the file
/etc/[Link] in Linux defines the characteristics of the C shell; the
access to this file would allow a hacker to alter
variables throughout the system that would allow privilege escalation
or the launch of rootkits; for the same reason access to this
archivo debe ser limitado.

Hardening servers and PCs is a process

difficult, as there are literally thousands of specific controls that
configure, depending on the operating system and software
installed. Fortunately, this process is automatable with
a vulnerability scanner that has the function of
compliance with standards ("policy compliance")

70
 Let's now look at the processes:

a) Hardening policy scan on

servers
This process consists of using the scanner to detect
all the server configurations. The report you
will indicate which configurations are insecure; proceed to
change the settings according to the instructions of the
report.

b) Hardening policy scan in

PCs

This procedure is identical to the previous one, except that

for PCs.

71
 Control 10: Web application firewall

Attack vectors it prevents: 8-Application attack

web

Defense Procedure: 1-Intrusion Prevention

Software used: Web Application Firewall (WAF)

Web applications are currently one of the

most common attack vectors, for the simple reason that a
web application is open to the public. Hackers have everything
world time to keep putting in data until finding
a vulnerability. There is an organization, the 'Open Web
Application Security Project, known as OWASP
([Link]), which publishes the list of the 10 every year
most common vulnerabilities in web applications. The two
the most common vulnerabilities is SQL injection, where the
hacker introduces SQL commands in search of access to
the database tables, and cross-site scripting, where the
hacker introduces JavaScript commands, with the aim of
take control of the browser session. Let's see how the web
Application firewall prevents this.

a) Implementation of Web Application Firewall

What a web application firewall (WAF) does is read the data
that are introduced into a web application. If you see that the data

72
introduced SQL or Javascript commands, it blocks them.
In theory, the web application programmer should do
this validation at a programmatic level, but how is it written
millions of lines of code a year, from time to time
Mistakes are going to be made. That's why we installed the WAF. One point.

what is important is that even if we have a WAF, anyway

we must scan web applications directly, and
remedy the source vulnerabilities. It is always possible that
the WAF fails or its defenses are bypassed by attacks
novel threats that the WAF still cannot block. Likewise,
the WAF software itself can be compromised. Remember the
principle of Defense in Depth.

73
 Control 11: Database Protection

Attack vectors that it prevents: indistinct

Defense procedure: 1 - Intrusion prevention; 3 -

{"1":"Prevention of extraction","2":"Prevention of modification"}

Software used: Loss prevention software

data loss prevention (DLP), database firewall
data.

There are two sources of data loss: first, the

unsafe practices of users. A user without malice
You can access classified documents, and then send them to
someone via unencrypted email. And second, the hackers that
they try to extract information from the company.

The protection of databases is carried out in various ways.

ways. First, we must ensure that the software itself
do not have vulnerabilities (Oracle, SQL Server, mySQL, etc.)
Secondly, we must avoid unauthorized access to the databases.
of data itself. And third, we must monitor the flow of the
same data through the network.

These are the processes related to this control:

74
 a) Vulnerability scanning on the platform
of databases
This procedure actually falls within control 8,
scanning and analysis of vulnerabilities. The database software of
data, like any other software, can present
buffer overflow type vulnerabilities. Since the databases
they contain the most valuable thing in the company, it should always be given

priority to the remediation of vulnerabilities in them.

b) Hardening policy scan of

databases
In the same way as the previous process, this process to
it also falls under control 9, server hardening and
PCs. There is a set of specific policies for the database.
data that must be configured when using the scanner
compliance with standards (“policy compliance”), and equally
form, its remediation must have the highest priority. These
policies are focused on the configuration of the software
database referencing access permissions to the
tables, permissions for configuration changes, timeouts
connection, and literally hundreds of other policies that
Fortunately, the scanner checks automatically.

c) Database firewall implementation

and data loss prevention system
prevention, DLP

75
 The database firewall and the prevention system
data loss fulfill complementary functions, but
operatively different. The database firewall is located
topologically opposite to the database, filtering any
SQL command not allowed, and monitoring and reporting the
database activity: tables accessed by user,
modified data, etc. You would think that with the Web Application
A firewall would be enough, but no: if a hacker breaches the network
local without going through a web application, then the WAF does not

prevents nothing, since the hacker has access to the database

via the LAN. It is in this case that the database firewall
blocks any attempt to extract or modify data.
The database firewall can be configured with very rules
specific, for example indicating what type of SQL commands
which IPs are allowed.

Now, while the database firewall

it primarily operates at the SQL level, the Data Loss system
Data Loss Prevention (DLP) detects the flow and storage of data
specific (data at rest). To detect flow data, the
architecture consists of sending a copy of the traffic flow in
the network to the appliance or server where the DLP is, so that this
examine the data. The DLP comes with regular expressions
pre-programmed "regular expressions" to detect patterns
known about sensitive data, such as credit card numbers
credit. And you can program any other regular expression
para detectar datos específicos de tu empresa. Por ejemplo, los

76
confidential documents of your company can be marked
with the phrase "confidential-for internal use", and the DLP will detect the

presence of this text. It can detect data patterns in

any type of file: Word, Excel, PDF, database tables
data, emails, etc. If the DLP detects the flow of classified data
as confidential, activate an alert.

To detect stored data, also known

as data at rest, the DLP system scans
servers that can contain information. When scanning,
search for determined data patterns, and generate reports to
regarding. In addition to running scans, for the case of laptops and

On PCs, an agent can be installed that is monitoring and

reporting the presence of data patterns, and if this data
are extracted via some protocol such as http, or via USBs, CDs,
etc.

A subcategory of DLP is known as 'data

masking, or data concealment. Data masking software
pull data from a database, and only present information
selective, based on the user. For example, if a table contains
the names and credit cards of customers, the data system
masking can be configured so that when an employee
access the table via an application, can only see the name of the
customer and the last four digits of the credit card, but
not the complete number.

77
 Control 12: Antimalware
Attack vectors that it prevents: 9-Viruses, trojans and
worms

Defense procedure: 1-Intrusion prevention

Software used: antimalware software; scanner of

vulnerabilities

Viruses are the most well-known malware among users.

and in general most people take the precaution of
install an antivirus on your computer. When implementing this
control, we must ensure that both an antivirus and
a personal firewall should be installed.

Let's see the processes:

a) Installation of AV on all machines

The antivirus system should include antispyware. It is recommended
that has a centralized management module.

b) Installation of personal firewall on all

machines
It is becoming increasingly common for antivirus packages to come with

a personal firewall included.

78
 c) AV and firewall audit scan
personal
One must use the vulnerability scanner or of
compliance with policies to check that all machines
have antivirus and personal firewall installed.

79
 Control 13: Protection of mobile platforms

Attack vectors that it prevents: indiscriminate

Defense procedure: 1-intrusion prevention

Software used: mobile antimalware software

Ensuring the mobile platform is a great challenge.

Cell phones and tablets have become
platforms at least as important as laptops and
PCs to access corporate data, especially email
electronic. However, in most cases the
users don't even bother to put passwords on their
mobile phones. In addition to the risk you run if they are lost.
the team, the risk of malware is increasing more and more in
mobile platforms. There are already all kinds of viruses and trojans
specific to each mobile operating system, and now that the
Java is being used more and more for mobile applications, it will appear

more malware related to this language.

When implementing a platform protection system

mobile, it is imperative that it has centralized control from the
which we can configure and monitor the security status of
the mobile phones of the users. The platforms of
more advanced mobile security not only allows you to control
basic security policies such as passwords and the

80
protection against malware, but they allow you to control
the policies based on the geographical position of the phone
mobile. Other solutions also include firewall and IPS for the
cell phone

Let's look at the processes required to mitigate this

risk

a) Implementation of passwords on the platform

mobile
Make sure all cell phones have a password
configured.

b) Protection against malware in

mobile platform
Malware on mobile platforms is becoming more common every day.
There are viruses, including viruses with the ability to spread through
Bluetooth; but the main risk is trojans. There are many
mobile app downloads available, and this is
easily used to introduce trojans. As the
mobile platforms are being used more and more for
perform financial transactions, cases of mobile malware
will be increasing. Make sure that the platform of
mobile security that you acquire has protection against
malware, as well as firewall and IPS.

81
 c) Remote locking capability
With this process implemented, at the moment that a
User reports that their cell phone was stolen, will you be able to
block immediately. Some solutions will also help you
they allow to locate the cell phone geographically, if it has GPS.

d) Remote data wipe capability

By implementing this control, you will have the ability to delete the
cell phone data remotely, if it could not be recovered.

82
 Control 14: Protección de redes inalámbricas
Attack vectors it prevents: 11-Attack
wireless

Defense procedure: 1-Intrusion prevention

Software used: detection and prevention software

of wireless intrusion

The main problem of wireless networks is that

the data is flying through the air. This gives the hacker everything
time needed to analyze the data and try to break the
encryption, sitting outside your building. As we saw in the
vector section, the WEP protocol is easy to break, therefore
It goes without saying that it must not be present anywhere in
your wireless network; use only WPA or WPA2, and make sure that the

password is really long, and with alphanumeric characters.

WPA is certainly more secure, but it can still be
hacked if the password is short. A very long password and with
uncommon characters greatly minimize the risk. From
from a security architecture perspective, it is recommended
that the IPs assigned to the wireless access points are
segregated in their own VLAN, and the access rules to the LAN
are well identified and managed. If the objective of the network
wireless is just giving Internet access to users who
they are moving around the building, and/or to visitors, I recommend you

it's better to hire a broadband service with a modem

83
wireless that is connected to a telephone line; from this
that traffic is completely isolated from your local network. If the
users connected to the wireless network require access to
resources on the local network, you can provide it via VPN,
exactly as if they were connected remotely. From
that way you concentrate security at the access point of
the VPN, and you don't have to worry so much about the network

wireless.

In addition to the risk at the protocol level, there is the possibility

of vulnerabilities in the access point software. To

you have to scan the IPs of the access points with the
vulnerability scanner.

These are the processes:

a) Vulnerability scanning at points of

wireless access
The vulnerability scanner will detect if the software
The access points are vulnerable to exploit-type attacks.
Furthermore, the scanner helps you quickly detect the IPs of
the access points.

b) Implementation of wireless IPS

Wireless intrusion prevention systems
(WIPS) are specifically designed for networks

84
 wireless, and they have capabilities that go beyond the IPS in
your LAN. A WIPS can have the following functionalities:
• Mapping the coverage areas of the wireless network. This will
it is used to see if your wireless network is overflowing outside of
your building.
• List of unauthorized access points. It is possible that a
user bring your own access point to create your own
mini wireless red. With this functionality, you detect points of
unauthorized access.
• Show which IPs and MAC addresses are connected to which
access point. Based on this you can create alerts
• Alert when a user connects to a hotspot
authorized. This prevents a hacker from activating a point of
access outside your building and your users connect believing
what is legitimate. If this happens, the hacker can read the traffic of
user connected.

85
 Control 15: Email and website filtering

Attack vectors that it prevents: 6-Phishing; 7-Sites

infected; Virus, trojans, and worms

Defense procedure: 1-Intrusion prevention

Software used: antimalware software

The attack vectors of phishing and sites

infected ones are widely used by hackers for the simple reason that
that our users are generally the weakest link
in our security chain. If you receive an email from
well-designed phishing to a user, the chances that
open the email and download an infected PDF
extremely high. Similarly, it is not difficult to deceive a
user to visit a website infected with malware. For
On the other hand, there is the attack via 'malvertising', which consists of

put ads on reputable sites, but the ads,

that seem legitimate, lead the user to infected sites with
malware. Even the most sophisticated user can fall for this.
trap.

These are the processes linked to this control:

86
 a) Implementation of email filtering
Email filtering is mainly used to avoid spam, but
the most advanced systems also have the capability of
detect files with viruses, phishing emails, links to websites
insecure.

b) Implementation of website filtering

Web filters are proxies through which the user
it connects to the Internet, and blocks access to any site that
contains malware.

87
 Control 16: Prevention and detection system
intrusion
Attack vectors it prevents: indistinct
Defense procedure: 2-Intrusion detection
Software utilizado: software de detección y prevención
of intrusion

Intrusion detection and prevention systems

they work by detecting suspicious behavior in traffic
from our network. This detection is done in three ways
increasingly complex:

1. Protocol analysis. This process is the most

basic, and it consists of reviewing the sequences of
packets in the protocols that are flowing
on the network. Each protocol (http, ssh, ftp, etc.)
it has normal packet sequences;
any deviation from these may represent
an attack.

2. Signature-based detection: This is the process

more common. It consists of comparing the

packet sequences with sequences of

known attacks, which are known as
"firms" or "rules". These rules can be very
simple, for example, the rule can indicate
that an alarm should be activated or block the

88
 packages, if a certain protocol is being
sent to a certain IP. It is also possible to have
rules that seek lines of text in the
packages, such as "/bin/sh". There are thousands of

pre-established rules, and you can add

new rules relevant to your systems.

3. Statistical analysis: the system leaves a

time in learning mode, for what
learn what behaviors in terms of
The use of protocols and flows between IPs is normal.
Then, when there is a deviation from this
behavior, it triggers an alarm. If the alarm
marks like false positive, the system
learn from the mistake.

In my experience conducting penetration tests

I learned that intrusion prevention systems are a
a formidable barrier against the hacker. There are certainly techniques

to evade intrusion prevention systems, but they are not

easy to execute, and the companies that manufacture the systems
they are constantly updating the rules and algorithms,
making them more sophisticated and intelligent. An IPS system
eliminate amateur and mediocre hackers from the equation, and
Only elite hackers can maneuver with a certain degree of
success in a network with a good IPS system implemented.

89
 This control only has one related process:

a) Implementation of detection system and

intrusion prevention

90
 Control 17: Log Analysis

Attack vectors it prevents: indiscriminate

Defense procedure: 2-Intrusion detection

Software used: log analysis software

Practically all the hardware and software in your network

generate a log, where all kinds of events are recorded. In
The logs record important events for the
good functioning and the security of your network, but since they are
so much data, this has to be automated using software for
analysis of logs. A talented hacker can evade your IPS and
establish a presence in your network, and from there slowly and with

any care start to explore, searching patiently

other vulnerabilities. But even if it evades the IPS, its actions,
however minimal they may be, they will be reported in one way or another

another through applications and hardware, and recorded in logs. The

the challenge is to analyze these logs and discover these patterns little

obvious of stealthy intrusion.

Let's see their processes:

a) Log analysis
The analysis of logs revolves around the concept of
event correlation. Generally speaking, two or more

91
events may be correlated either because they occurred
at the same time, or because they were part of a logical sequence.
El análisis de bitácoras es un proceso fundamentalmente
manual; the software that exists to help us in this process
digest the information and present it in a readable and graphical form
for a human brain to be able to detect patterns
in the data. This is a very important point; there are solutions
that activate alerts upon detecting certain events (see point "b")
but they are still not very intelligent. A combination is required
of one or more people analyzing the data methodically, and
automatic alerts.

b) Alerts for suspicious events

By implementing this control, we ensure that the
most common suspicious security events
automatically activate security alerts. The
the problem with automatic alerts is that they are
too generic, so they can easily
generate too many false positives. That's why I insist that
The important thing is to combine automation with analysis
intelligent and creative of the human mind.

92
 Control 18: Traffic Analysis

Attack vectors that it prevents: indistinct

Defense procedure: 2-Intrusion detection

Software used: traffic analysis software

Traffic analysis consists of taking a sample of the

data traffic on our network, to mainly understand the
following variables of the packages:
Source IP
2. Destination IP
Port of origin
4. Destination port
5. Protocol
Traffic analysis is primarily done as part
from the management of network capacity, through the
improvement of the logical and physical topology. But it can also be
use for security analysis purposes.

These are the processes:

a) Traffic analysis
This process is similar to log analysis. In
theory, our intrusion prevention system
it should detect all suspicious traffic, but it does not

93
it is always the case. Sometimes a hacker can hide their
traffic very well and do not activate the IPS. That's why it is

necessary for someone to check frequently the

traffic analysis reports, and look for source IPs and
unusual destinations, as well as ports and protocols that do not

they should be present.

b) Alerts of suspicious traffic

There are sophisticated traffic analysis applications that
they allow us to set alerts based not only on IPs
and protocols, but also in the flow of data from
specific applications. For example, if certain
applications begin to send data to an external IP
at night, it can indicate activity
suspicious, and activate an alarm.

94
 Control 19: File Integrity Monitoring
Attack vectors it prevents: undetermined
Defense Procedure: 2-Intrusion Detection
Software used: vulnerability scanner

When a hacker takes control of a machine, to

sometimes changes configuration files in the process. If this
the change was made outside of the formal change control process,
it is an immediate sign of intrusion. Likewise, if the hacker
introduce a modified software package that contains
malicious software, the integrity monitoring will detect it.

This is the related process:

a) File Integrity Monitoring

The file integrity monitoring software
it works by taking a hash of the file data or
application, and then periodically comparing the hash
original with the current hash. If it changes, the software
issue an alarm or report.

95
 Control 20: Prevención de pérdida de datos

Attack vectors that it prevents: indistinct

Defense procedure: 3-Prevention of extraction;

4-Prevention of modification

Software used: loss prevention software

data loss prevention and concealment software
data masking

The process of data loss prevention

prevention) consists of monitoring the data in transit and
rest, to detect prohibited data flows, or
unsafe data storage.

Let's see the processes:

a) Implementation of prevention system

data loss
There are three types of prevention systems.
data loss: from network, storage, and PC.

The systems of red himselfthey find

positioned at the perimeter, at the exit points
of data, and they constantly monitor the data
saliendo de la red; el sistema se configura con palabras

96
key; if these words are detected (such as
secret
activate the alarm.
Storage systems scan the
databases and files, determining the security
from storage; for example, if it detects that
files with the keywords are found in a
ftp server, the alarm is activated.

PC systems check if the words

keys flow or are stored in PCs.

b) Implementation of dynamic data masking

The process of 'data masking' consists of hiding
partially some data fields, and
present others in full form. For example,
if your organization processes credit cards,
within a data process, one can do
a partial concealment of the card number from
credit, and fully present the name of the
cardholder. In this way, they can be created
data access rules at field level in
a data table.

97
 Control 21: Data encryption in transit

Attack vectors that it prevents: indiscriminate

Defense procedure: 3-Prevention of extraction;

4-Prevention of modification

Software used: data encryption software

The architecture of current local networks works at

through switches or routers, where each machine is
connects individually to the switch; therefore, the data
flow from machine to machine, almost without risk of interception. It is
for this reason it is not really necessary to encrypt data that
they flow through the local network, unless they are extremely
secrets. What is required is data encryption.
when they travel through external networks, specifically the
Internet.

These are your related processes:

a) Encrypt transmitted data

If you organization requires to transmit data
constantly between offices or other organizations,
the best method is to establish a VPN (virtual private
network). Through the VPN, you can grant access to
parts of your local network to remote users. Now, if the

98
 the objective is only to provide access to some
files, it is more beneficial for you to establish an extranet,

using https and authentication; it is easier to

implement and limit the risk.

b) Encrypt email
We all know that the emails we send through the
Unencrypted internet can be read along the way. From the
from a practical point of view, it is very difficult to encrypt all our
emails, because for this we would need to have the public key
of the recipient, and few people take the
work to generate a public key. For this reason, although we
let's have the intention to encrypt our emails, if others
they do not cooperate, it does not work. This explains why it is hardly used.

email encryption. Instead of trying to encrypt the email,

we must ensure that when we have to communicate
classified data, let's do it through a memo,
encrypt it, and send it as an attachment in the email, or through
a secure file transmission service.

On the other hand, what we do need to encrypt is the

communication between the computer and the mail server, in
cases where wireless networks are used. If a user is
connected to the local network via Ethernet, it is unlikely that the
communication is intercepted. However, if the user is
find a public WiFi hotspot and connect
with your email client to the mail server without encryption, the

99
the username and password of your account are very easy to intercept.

A common tactic during penetration testing is to sit

in a café near the target company, connect to
free wireless Internet service, activate a sniffer, and
wait for the employees to enter and connect. This is why
it is important that if a web email client is used, we
let's ensure that we use HTTPS, and if it is a Microsoft client
Outlook is set up to encrypt communication between
the client and server. Similarly, a VPN can be used.

100
 Control 22: Encryption of data in
storage

Attack vectors that it prevents: indistinct

Defense procedure: 3-Prevention of extraction;

4-Prevention of Modification

Software used: data encryption software

Databases contain the most information

important to your organization, and the encryption of data
stored is fundamental for your safety, as it not only
is protected from external threats, but from theft of
internal information as well.
Let's look at the processes:

a) Encrypt stored data

There are two levels of encryption that we can
implement. First, all database platforms
they bring their own process of encryption of the tables. This
it may be sufficient if the information is not confidential.
Secondly, if the information is really confidential, it can be
use some database encryption platform, which
adds an extra layer of encryption to them, and a
better management of passwords and privileges.

101
 b) Encrypt hard drives of PCs and laptops
This process consists of encrypting all the content of
the PCs and laptops, to prevent data extraction in case of
team theft. Likewise, the access method
the biometric method is recommended, through a fingerprint reader
digital.

102
 Control 23: Defense against denial of service
service

Attack vectors that it prevents: indiscriminate

Defense procedure: 6-Denial prevention

Software used: packet filtering solutions;

traffic redirection services

A denial of service ("denial of service, DOS"),

it is a type of attack in which a large amount of
HTTP (or some other protocol) requirements against a site
web, with the aim of saturating it and not allowing it to respond to
legitimate users. These attacks are carried out either by
revenge, hacktivism, or to carry out economic blackmail; a
an e-commerce website can lose a lot of money
for every minute that it is offline.

Attacks are not always against http or some

network protocol; they can also be done against others
server resources, such as memory space.

These are the processes related to this control:

103
 a) Monitoring resource usage on websites
We need to implement processes that monitor the
bandwidth consumption, the CPU, and space in
disk of the servers, to detect in time the
saturation in resource consumption. It must also be
hire a availability monitoring service of
sites; these online services periodically send
HTTP requests to the server, and if it does not respond,
it takes a long time to respond, they issue an alert for
email and/or sms.

b) Implementation against denial of

service
There are two options to defend against
denial of service. The first thing that can be done
it is to acquire a device that is installed on the local network, for

which passes all incoming traffic; what it does is

that analyzes Internet traffic to determine if the
the packages that are arriving are of attack, and it filters them.

These devices have a high CPU capacity, so

that it is very difficult for them to become saturated. The second option is

hire a traffic filtering service. In this case

the domain to be protected is redirected not to the IP of the
web server, but to an IP of the company that provides
the filtering service. The traffic arrives at the data center
de esa compañía, quien lo analiza, y filtra los paquetes
of the attack, and then proceeds to send the packets

104
legitimate to the IP of the web server, so that it
respond to the requirement.

105
 Control 24: User Training

Attack vectors that it prevents: 4-Theft of

passwords; 6-Phishing; 7-Sitios infectados; 10-Ingeniería
social

Defense procedure: 1- Intrusion prevention; 3-

Prevención de extracción; 4-Prevención de modificación

Software used: NA

Unfortunately, we cannot install a firewall on

the minds of the users of our network (yet). The only thing that
what remains is to train them continuously so that they do not fall

victims of phishing and social engineering.

A part of the problem is the lack of knowledge, but

the other part of the problem is that many users
they simply don't care about security; they don't see it as a
problem for them. As we mentioned earlier, in
England conducted the experiment of offering chocolate to the
people passing by on the street, in exchange for the password of
access to their corporate networks. Incredibly, more than 70%
he accepted the chocolate in exchange for the password. Obviously, they didn't

It matters. That is why the implementation of some type is recommended.

of human resources policy, in which if it is proven that

106
there was a security incident due to not following procedures, the
the responsible person is to be dismissed.

This is the only process of this control:

a) Basic computer security course for

users

107
 Control 25: Physical access control

Attack vectors it prevents: 12-Physical theft of

equipo; 13-Acceso físico a la red

Defense procedure: indifferent

Software used: NA

I remember reading somewhere a test of

penetration that a company did. The pen tester impersonated
as an employee of the company, and without any problem, he entered the office.

He sat down in an empty cubicle, connected his laptop, and

he asked support to assign him an IP, email account, and line
telephone company. In less than a week, the pen tester was
participating in the company parties, and had extracted everything
data type. Everyone simply assumed that
belonged to the company. This is an extreme case, but it illustrates
the importance of physical security. Every flow of people
It must be controlled and audited through access cards.
From an architectural point of view, the best design is to have
the meeting rooms in the reception area, so that the
visitors do not even have access to the office area when
visit.

108
 These are the processes:

b) Access control with two authentication

factor the work area

c) Access control with two-factor authentication

server area

109
 Control 26: Pruebas de penetración

Attack vectors that it prevents: indistinct

Defense procedure: indifferent

Software used: penetration testing software

pen testing

Generally, if we have a security architecture

solid, we can stop 90% of the attacks. The tests of
penetration is to detect those cracks in the wall
what does the other 10% represent.

There are two ways to conduct penetration testing:

hire an external pen tester, or have an internal team. The
having an internal team really is only financially
viable for large companies, but this investment has the
potential to greatly reduce the risk, given that there is a
team of ethical hackers constantly trying to hack the
red, in real time, and reporting the detected problems. If
There is no budget for this, hiring an ethical hacker.
external is the next best option. It is recommended that the
penetration tests are conducted on a quarterly basis,
and that they are not only technical, but also social engineering,
what is where companies fail the most.

110
These are the processes related to this control:

a) Technical penetration test

b) Social engineering test

111
 Control 27: Plan de respuesta a incidentes

Attack vectors that it prevents: indistinct

Defense procedure: indistinct

Software used: NA

The last control consists of implementing a plan of

incident response. This plan does not have to be very complex
(guides can be found on the Internet); it can have some
how many pages. The goal is to have it written down the
procedures to follow in case different occur
scenarios of security loss, for the response to be
automatic and orderly, and no time is wasted trying to decide
what to do in the moment of crisis.

This is the process of this control:

a) Implementation of response plan and

incident recovery

112
 TABLE OF CONTENTS

CHAPTER 1: INTRODUCTION....2
The Fundamental Problem of Security
Computer Science...2
CHAPTER 2: ATTACK VECTORS…4
Vector 1: Exploits…8
Vector 2: Passwords default…15
Vector 3: Brute force of passwords...16
Vector 4: Password theft…19
Vector 5: Session Interception…21
Vector 6: phishing…23
Vector 7: sites infected with malware…25
Vector 8: Attack on web applications...26
Vector 9: Virus, trojans, and worms...28
Vector 10: Social Engineering…30
Vector 11: Wireless Attack...32
Vector 12: Physical Robot of the Team...34
Vector 13: Physical access to the network…35

CHAPTER 3: DEFENSE…37
Control 1: Firewalls, Routers, and Switches…41
Control 2: Secure implementation of DNS…53
Control 3: Password management…56
Control 4: Hardware Inventory…58
Control 5: Software Inventory...60
Control 6: Inventory of ports and services…62
Control 7: Inventory of GUIs…64

113
Control 8: Scan y remediation of
vulnerabilities…66
Control 9: Hardening of servers and PCs...70
Control 10: Web application firewall…72
Control 11: Database protection…74
Control 12: Antimalware…78
Control 13: Protection of mobile platforms...80
Control 14: Protección de redes inalámbricas…83
Control 15: Email and website filtering…86
Control 16: Prevention and Detection System
intrusion…88
Control 17: Log analysis...91
Control 18: Traffic analysis...93
Control 19: File integrity monitoring…95
Control 20: Data Loss Prevention...96
Control 21: Data encryption in transmission…98
Control 22: Encryption of data in
storage...101
Control 23: Defense against denial of service
service…103
Control 24: User training…106
Control 25: Physical access control…108
Control 26: Penetration tests...110
Control 27: Incident response plan...112

114