System and OS Hardening

System and OS hardening refers to the set of practices designed to secure a computer's operating system by reducing its vulnerability surface. The goal is to minimize the number of potential entry points an attacker can exploit. This is achieved by disabling unnecessary services, closing unused ports, removing default accounts and software, applying the principle of least privilege, and keeping the system patched. Hardening is not a one-time task but an ongoing process that must adapt to new threats.

Unhardened systems are low-hanging fruit for attackers. Common attacks include: - Exploitation of unnecessary services: For example, if a web server is running FTP (port 21) unnecessarily, an attacker could exploit an FTP vulnerability (e.g., CVE-2021-22986 for F5 BIG-IP) to gain access. - Default credentials: Many systems come with default usernames and passwords (e.g., admin/admin). Attackers scan for these using tools like Nmap and Hydra. - Unpatched vulnerabilities: Exploits for known vulnerabilities (e.g., EternalBlue for SMBv1, CVE-2017-0144) are often available within days of a patch release. - Misconfigured permissions: Overly permissive file permissions allow privilege escalation.

#### 1. Patch Management

Patch management is the process of acquiring, testing, and applying updates to software. The SY0-701 exam emphasizes the importance of a patch management policy that includes: - Vulnerability scanning: Identify missing patches. - Testing: Apply patches to a test environment before production. - Deployment: Use tools like WSUS (Windows Server Update Services) or SCCM (System Center Configuration Manager) for Windows, or apt and yum for Linux. - Rollback plan: In case a patch causes issues.

Common Patch Types: - Security patches: Fix vulnerabilities. - Feature updates: Add new features (not always critical). - Service packs: Cumulative updates.

Exam Tip: The exam may ask about the order of patching: critical systems first, then high, medium, low. Also, know that patch Tuesday is the second Tuesday of each month for Microsoft.

#### 2. Disabling Unnecessary Services

Every running service is a potential attack vector. Hardening involves identifying and disabling services that are not required for the system's role. For example: - Windows: Services like Print Spooler, Remote Registry, or Telnet should be disabled if not needed. - Linux: Services like telnet, rsh, and ftp should be replaced with secure alternatives (SSH, SFTP).

Command Example (Linux):

# Check listening ports
netstat -tulpn
# Disable a service (e.g., telnet)
systemctl disable telnet.socket
systemctl stop telnet.socket

Windows PowerShell:

# List services
Get-Service | Where-Object {$_.Status -eq "Running"}
# Disable Print Spooler
Set-Service -Name Spooler -StartupType Disabled
Stop-Service -Name Spooler

#### 3. Port Filtering

Using host-based firewalls (e.g., Windows Defender Firewall, iptables) to allow only necessary inbound and outbound traffic. For a web server, only ports 80 (HTTP) and 443 (HTTPS) should be open. All other ports should be blocked by default.

iptables example:

# Allow incoming HTTP and HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# Drop all other incoming traffic
iptables -A INPUT -j DROP

#### 4. Least Privilege and Account Management

Group Policy Settings (Windows):

#### 5. File System Security

#### 6. Application Hardening

#### 7. Registry and Configuration Hardening

Example (sysctl):

# Disable IPv4 forwarding
net.ipv4.ip_forward = 0
# Restrict core dumps
fs.suid_dumpable = 0

Security baselines are sets of standardized configurations that meet security requirements. Common sources: - CIS Benchmarks: Detailed hardening guides for various OS and applications. - NIST SP 800-53: Security controls for federal systems. - Microsoft Security Compliance Toolkit: Provides Group Policy templates.

Exam Tip: The exam might ask where to find hardening guidelines. Answer: CIS Benchmarks or vendor documentation.

Group Policy (Windows) is a powerful tool to enforce settings across an organization. For example, you can create a GPO that:

Example GPO settings:

Network devices (routers, switches, firewalls) also need hardening: - Disable unused ports: Use shutdown on unused interfaces. - Use SSH instead of Telnet: Telnet sends passwords in clear text. - Set strong passwords: Enable secret on Cisco devices. - Implement ACLs: Restrict management access to specific IPs.

Cisco example:

! Enable SSH
crypto key generate rsa
ip ssh version 2
line vty 0 4
transport input ssh
login local
! Restrict access
access-list 10 permit 192.168.1.0 0.0.0.255
line vty 0 4
access-class 10 in

Attackers scan for open ports, default credentials, and unpatched vulnerabilities. Defenders harden by closing ports, changing defaults, and patching. The defender's goal is to make the cost of attack higher than the value of the target.

A SOC analyst at a large financial institution notices an alert from the SIEM: multiple failed logon attempts from a single IP address targeting a domain controller. The analyst checks the event logs (Event ID 4625) and sees that the attacker is trying common usernames like 'admin' and 'administrator'. The analyst immediately checks the domain's password policy: it allows passwords as short as 8 characters and no account lockout. The correct response is to escalate to the system administrator to enforce a stronger password policy and account lockout (e.g., 5 attempts, 15-minute lockout). The analyst also recommends disabling the default 'Administrator' account (renamed or disabled) and implementing RDP restriction via GPO (allow only from specific IPs). A common mistake is to simply block the IP address without addressing the root cause—the weak password policy. The attacker could come from another IP. The analyst uses tools like Active Directory Users and Computers to review user accounts and PowerShell to enforce password policy via Set-ADDefaultDomainPasswordPolicy.

A security engineer receives an alert from the intrusion detection system (IDS) that a Linux web server is communicating with a known C2 server. The engineer isolates the server and performs forensic analysis. They find that the server was running an outdated version of Apache (2.4.46) with a known vulnerability (CVE-2021-41773) that allows path traversal. The server also had port 21 (FTP) open, which was not needed. The engineer's response: wipe the server and rebuild from a hardened image. They apply the following hardening steps: install the latest Apache version, disable FTP, configure iptables to allow only ports 80 and 443, set proper file permissions (e.g., 644 for web files, 755 for directories), and enable SELinux in enforcing mode. They also configure auditd to monitor changes to /etc/httpd/conf and /var/www/html. A common mistake is to only patch the vulnerability without removing the unnecessary service (FTP), which could be exploited again. The engineer documents the new baseline and uses configuration management (Ansible) to enforce it across all similar servers.

A network administrator is tasked with hardening a Cisco router that connects a branch office to the corporate network. The administrator discovers that the router has Telnet enabled on VTY lines, uses default credentials (admin/cisco), and has SNMPv2 with a community string 'public'. The attacker could easily gain access and reconfigure the router. The administrator's actions: disable Telnet and enable SSHv2, change the enable secret, set a strong password, restrict VTY access to a management subnet using an ACL, and configure SNMPv3 with authentication and encryption. The administrator also disables unused interfaces (e.g., FastEthernet0/1) and applies port security on switch ports. A common mistake is to enable SSH but leave Telnet enabled as a fallback, which still exposes the device. The administrator uses show running-config to verify changes and saves the config with copy running-config startup-config.