{"id":8218,"date":"2012-12-07T18:11:55","date_gmt":"2012-12-07T18:11:55","guid":{"rendered":"http:\/\/tajdini.net\/blog\/2012\/12\/07\/server-hardening\/"},"modified":"2012-12-07T18:11:55","modified_gmt":"2012-12-07T18:11:55","slug":"server-hardening","status":"publish","type":"post","link":"https:\/\/tajdini.net\/blog\/application-and-software-security\/server-hardening\/","title":{"rendered":"Server Hardening"},"content":{"rendered":"
\n

\t\tInformation has been one of the most crucial assets of all the corporations. As more and more information starts getting stored in digital format, the onus has come to servers to deliver data in a secure, reliable fashion. There must be assurance that data integrity, confidentiality and availability are maintained. One of the required steps to attain this assurance is to ensure that the servers are installed and maintained in a manner that prevents unauthorized access, unauthorized use, and disruptions in service. This makes it mandatory for organizations to exercise proper server security and utility assessment to make sure that it is used only for the right service and right purpose.
\t\tServer Hardening from a trusted provider offers an excellent means by which an organization can baseline its current security posture, identify threats and weaknesses. It provides not only the basis for a security action plan, but also compelling events, due diligence and partner interface protocols necessary to establish security as a key corporate initiative.
\t\tObjectives of the entire exercise<\/strong><\/span>
\t\t Implementing the Information Security, Centre of Excellence (IS-COE) standard server hardening templates enables the following objectives to be achieved:<\/span>
\t\t1.    Enhancing the hosts to achieve the three basic objectives of security (CIA): Confidentiality, Integrity and Availability.
\t\t2.    Application of fully defined, repeatable and highly secure build process for various operating systems and applications to achieve the above objectives and provide increased levels of security.
\t\t3.    Managing the security controls by \u2013 fixing vulnerabilities, applying least privilege needed to complete the task, separating privileges, applying least common mechanism and making the system highly defensive and fail safely.
\t\t <\/span>Approach & Methodology<\/span> <\/span>
\t\tThe implementation of each standard server hardening template requires following tasks to be completed:
\t\t1.    Customization of the server hardening activity template to meet the client\u2019s operating system and also to reflect the client\u2019s current security policies and procedures.
\t\t2.    Implementation and testing of the template.
\t\t3.    Handover of templates and comprehensive setting guide.
\t\t <\/span> <\/span>  <\/span> <\/span>Basic server security steps include:
\t\t1.    Planning the installation
\t\t2.    Install, configure, and secure the OS
\t\t3.    Install, configure, and secure the server software
\t\t4.    Test the security <\/span> <\/span>
\t\t <\/span> <\/span>Installation and Deployment Planning
\t\t <\/span> <\/span>  <\/span> <\/span>In the installation and deployment planning we will<\/span>
\t\tIdentify:
\t\t1.    The purpose of the server
\t\t2.    The services provided by the server
\t\t3.    Network service software client and server <\/span> <\/span>
\t\t4.    Types of different roles of the server
\t\t <\/span> <\/span>Determine:
\t\t1.    Privileges and categories for user
\t\t2.    Server Management Strategy
\t\t3.    Users and their authentication methodology
\t\t <\/span> <\/span> 4.    Access enforcement strategy
\t\t <\/span> <\/span>Securing the Operating System
\t\tSteps to follow after planning installation and deployment of the OS are as follows:<\/span>
\t\t1.    Patch and update the OS
\t\t\u2022    Identify vulnerabilities
\t\t\u2022    Mitigate if necessary
\t\t\u2022    Patch servers in isolation
\t\t\u2022    Test patches before applying (depends upon availability of test environment)
\t\t2.    Harden and configure the OS
\t\t\u2022    Disable and remove unnecessary services or applications
\t\t\u2022    Configure user authentication
\t\t\u2022    Configure resource controls
\t\t3.    Install and configure additional security controls
\t\t\u2022    Anti-malware
\t\t\u2022    Host based firewalls to block unwanted open ports
\t\t\u2022    Host based intrusion detection (HIDS) system
\t\t\u2022    Patch management software
\t\t\u2022    File Integrity Check <\/span> <\/span>
\t\t4.    Test the security of OS
\t\t <\/span> <\/span>Securing the Server Software
\t\tBasic steps to follow after planning installation and deployment of the Server Software are as follows:<\/span>
\t\t1.    Secure Installation
\t\ta.    Install and patch the server software in a secure location b.    Clean the installation(remove anything you don\u2019t need) c.    Harden and Configure d.    Apply templates e.    Change ports or locations
\t\t2.    Configuring Access Controls
\t\ta.    Control access to:
\t\t\u2022    Application software and configuration files
\t\t\u2022    Security files
\t\t\u2022    Server logs
\t\t\u2022    System software and configuration files
\t\t\u2022    Application content and uploads
\t\tb.    Run the server with limited privileges
\t\t\u2022    Not root or administrator
\t\t\u2022    Limit write permission
\t\t\u2022    No access to server temp files
\t\t3.    Server Resource Constraints
\t\ta.    Prevent DOS attacks. Limit resources
\t\t\u2022    Install content on a different drive
\t\t\u2022    Limit upload space and file size
\t\t\u2022    Store log files separately
\t\t\u2022    Limit processes
\t\t\u2022    Limit memory
\t\t\u2022    Limit connection time
\t\t <\/span> <\/span> b.    User Access Restrictions
\t\t\u2022    Grant individual accounts and access
\t\t <\/span> <\/span> \u2022    Encrypt authentication
\t\t\u2022    IP restrict
\t\tTest the Security
\t\tAfter the successful installation and deployment, security of the servers is tested by performing a further analysis of the servers.<\/span>
\t\tBenefits
\t\t1.    Identify the threats facing your organization\u2019s information assets so that you can quantify your information risk and provide adequate information security expenditure.
\t\t <\/span> <\/span> 2.    Reduce your organization\u2019s IT security costs and provide a better return on IT security investment (ROSI) by identifying and resolving vulnerabilities and weak configurations. These may be known vulnerabilities in the underlying technologies or weakness in the design or implementation.
\t\t3.    Server Hardening is a complex process that involves many actions to mitigate the risk of being hacked.
\t\t <\/span> <\/span><\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Information has been one of the most crucial assets of all the corporations. As more and more information starts getting stored in digital format, the onus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[220,226],"tags":[125,271],"class_list":["post-8218","post","type-post","status-publish","format-standard","hentry","category-application-and-software-security","category-identity-and-active-directory","tag-active-directory","tag-server-hardening"],"_links":{"self":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8218","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/comments?post=8218"}],"version-history":[{"count":0,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/posts\/8218\/revisions"}],"wp:attachment":[{"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/media?parent=8218"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/categories?post=8218"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tajdini.net\/blog\/wp-json\/wp\/v2\/tags?post=8218"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}