The emerging cyber security threat and a large number of successful cyber attacks occurred in the past years are encouraging CISO’s and IT teams to review their security posture and get back to basic security tasks such as hardening and patching (CIS 5 CSC’s). Although one would expect this projects to be a “piece of cake”, they aren’t.
Over the course of the last 14 years our team at CalCom have helped managing hundreds of server hardening projects. Either it is a small but critical server environment or large fortune 500 enterprise environments we’ve seen the same planning mistakes made by management and technical teams over and over again. The following post offers basic tips that can use as a basis for your server hardening project plan.
1.Team collaboration:
Collaboration between the IT operations team and the security team is essential for the success of a server hardening project. In most cases the security team will be the one guiding the operations team about which policies to apply to different server roles and environments. The responsibility for the overall project and the actual hardening must be in the hands of the team who is managing the servers. Both teams should be actively involved in the project and communication between the teams is essential for a successful project.
2.planning
- Review the security policies and make adoptions and customization that are relevant for your organization. once reviewed, the security policies should be approved by senior management. Policy changes should go through a formal procedure. It is highly recommended to discuss all the different aspects of the policy and get the input of the IT team before starting to harden the servers.
- Decide which server environment should get priority in the project- resources are always limited. You should plan to harden all your servers for optimal security , start with the most critical production servers and than move to test and dev environments.
- Project documentation is essential- make sure that you have the right policies for your servers and that you have the complete server inventory and installed applications in an excel spreadsheet.
3. Testing
Testing is an integral part of making changes in an IT environment. When it comes to hardening, testing is as critical as it can get. Failing to perform suitable testing will cause damage to production servers and applications. In many cases failing to perform proper testing caused IT teams to stop the hardening project or to enforce a poor baseline/policy that won't satisfy the compliance and audit requirements.
There are three testing scenarios to cover in a hardening project:
- Most important testing- test policies before deploying them to production, this kind of testing is also the most challenging one. Hardening means making changes to production at the OS level, this kind of changes can create damage to the applications and create server malfunctions. To avoid damage, the IT operations team should create a test environment that will try to simulate the production environment Only when the changes are tested in the suitable environment (taking in mind server roles, applications, etc.) the changes can be enforced to production servers. This testing phase might take a very long time and requires large efforts and resources, this testing procedure is an ongoing one because the environment is dynamic, new applications, OS’s and policies are installed and updated frequently.
- Test servers functionality after hardening- We want to make sure that after the hardening applied everything works fine and there are no operational problems
- Post hardening we should test servers locally to make sure that they got the security policies and are now hardened according to the organizational policy.
4. Audit
Setting an audit team in your IT organization (if you don't have one) is highly recommended, this can be a system administrator or a security analyst that will audit the policy of the servers every month/quarter . Make sure that if there are deviations from the policy, this deviations are reported and re mediated as soon as possible.
CalCom CHS for MSFT OMS is a server hardening automation platform designed to help IT operation teams harden servers in a cost effective fashion. CHS learning capabilities perform a “what if” analysis of the baseline impact directly on the production environment, therefore IT teams doesn’t need to go through a policy testing procedure before hardening the servers. learn more
https://technet.microsoft.com/en-us/library/cc526440.aspx?f=255&MSPPError=-2147217396
https://docs.microsoft.com/en-us/azure/security-center/security-center-customize-os-security-config
