Hardening IT Infrastructure – From Servers to Applications

Hardening the IT infrastructure is a crucial task for achieving a resilient infrastructure that is resistant to attacks and compliant with regulatory requirements. Hackers continually attack information systems and websites using various cyber-attack techniques.

What You Will Learn

• What is IT Infrastructure Hardening
• Why hackers target IT infrastructure.
• Understanding common risks
• How hardening reduces attack surfaces
• Why compliance frameworks matter

What is IT Infrastructure Hardening

To mitigate the increasing number of dynamically emerging cyberattacks, information systems and servers require enhanced security measures, also known as hardening. Hardening is unique because the security team needs it, but IT Ops executes it. The default configurations of most systems prioritize productivity and convenience over security.

Hardening Infrastructure Layers

• Server hardening
• Application hardening
• Operating System hardening
• Database hardening

Server Hardening Guidelines

Server hardening, in its simplest definition, is the process of boosting a server’s protection using viable, effective means. It is recommended to use the CIS benchmarks as a source for hardening benchmarks. Below is a list of high-level hardening steps that should be taken at the server level.

Note: Never attempt to establish or test hardening procedures on production unless using a proper hardening impact analysis tool

1. Implement a “least functionality” approach. For example, do not install the IIS server on a domain controller.
2. Install post-Service Pack security hotfixes.
3. Avoid installing applications on the server, such as email clients, office productivity tools, or anything not required for the server to perform its job.
4. On the server, use two different network interfaces: one for the network and the other for the administrator.
5. Create a secure remote administration for the server
6. Harden OS and application layers (see below)
7. Use the server’s local firewall: Windows firewall, Linux-IPtables, AppArmor.
8. Avoid insecure protocols for processing requests, especially those that transmit sensitive information (e.g., passwords) in plain text.
9. Keep backups of all your data and files.
10. Secure separate partitions.
11. When hosting multiple applications, ensure that each has its own separate account, distinct from the others.
12. Never provide write access to web content directories.
13. Remove administrative shares if not needed.
14. Closely monitor failed login attempts. Lock accounts after a specified number of failures.
15. Rename the guest account, even if it is currently disabled.
16. Enable account lockout on the local administrator account
17. Rename the local Administrator account to something other than Administrator
18. Enforce strong account and password policies for the server.
19. Do not allow users and administrators to share accounts.
20. Disable FTP, SMTP, NNTP, and Telnet services if they are not required.
21. Install and configure URLScan.
22. For non-public sites, implement authentication to restrict access to internal users only.
23. Review Web server logs routinely for suspicious activity. Unusual URLs indicate an effort to exploit problems in outdated or unpatched web servers.
24. Update DNS software regularly.
25. Implement Domain Name Servers (DNS) authentication to prevent unauthorized zone transfers.
26. Access to the server may be prevented by blocking port 53 or restricted by limiting access to the DNS server to one or more specified external systems.
27. Anonymous FTP accounts should be used with caution and monitored regularly.
28. In the case of authenticated FTP, it is essential to use Secure FTP so that login and password credentials are encrypted, rather than transmitted in plain text. 

Application Hardening

Application hardening secures applications against local and Internet-based attacks. The process removes functions or components that are not required. We restrict access and ensure the application is kept up-to-date with the latest patches.

Maintaining application security is crucial. It enables the application to be accessible to users. Most applications buffer overflows from legitimate user input fields. Patching applications is the only way to prevent attacks. The following are proven application hardening guidelines:

1. Apply vendor-provided patches in a timely manner for all 3rd party applications
2. To secure an IIS, remove all sample files. These sample files are insecure and should never be present on a production web server.
3. Sample files are stored in both virtual and physical directories. To remove the IIS sample application, delete the corresponding virtual and physical directories. For example, IIS samples are present in the Virtual Directory, located at C:\Inetpub\IIS samples.
4. The next step in securing IIS is to set up the appropriate permissions for the web server’s files and directories. This is possible using Access Control Lists (ACLs).
5. Avoid using insecure protocols for processing requests, especially those that transmit sensitive information (e.g., passwords) in plain text.
6. Never install IIS unless the server is to be a dedicated Web Server
7. Install SSL Architecture
8. Install and configure a web application firewall (WAF)
9. Avoid installing and do not run network device firmware versions that are no longer available from the manufacturer.
10. Closely monitor the security bulletins applicable to applications and other software used.
11. Use cryptographic and CHECKSUM controls wherever applicable.
12. Implement an Active Directory that allows only a single login to multiple applications, data sources, and systems. This includes advanced encryption capabilities, Kerberos, and PKI features. 

Database Hardening

Databases often store sensitive data. Incorrect or lost data can have a negative impact on business operations. Databases can be used as bases to attack other systems. The following are some of the successfully proven database hardening guidelines: 

1. Have a TNS Listener Password (encrypted) to prevent unauthorized administration of the Listener.
2. Enable Admin Restrictions to prevent specific commands from being called remotely.
3. Enable TCP Valid Node Checking to allow specific hosts to connect to the database server while preventing others.
4. Disable the XML Database if it is not in use.
5. Turn off external procedures if not required.
6. Encrypt network traffic using the Oracle Net Manager tool.
7. Lock and Expire unused accounts.
8. Define user account naming standards.
9. Define and enforce a password policy.
10. Manage a role-based access privileges control.
11. Generate a periodic review and revoke any unnecessary permissions.
12. Enable data protection to prevent users from accessing sensitive tables.
13. Ensure PL/SQL coding standards are used.
14. Generate periodic database security audits.
15. Disabling all the Null sessions (anonymous logons).
16. Roll out all necessary database patches as soon as the vendors release them. 

Operating Systems

Operating System hardening is the process that helps reduce the cyber-attack surface of information systems by disabling functionalities that are not required, while maintaining the minimum necessary functionality. The following are some of the successfully proven operating system hardening guidelines:

1. Keep operating systems up to date with the latest, most robust versions. Additionally, ensure that security patches and hotfixes are regularly updated.
2. Install the latest Service Pack for the operating systems used
3. Routers and wireless should be protected with strong passwords
4. Remove unnecessary drivers
5. Do not create more than two accounts in the Administrators group
6. Disable or delete unnecessary accounts quarterly
7. Disable Non-essential services
8. Enable Audit Logs to capture successful and failed login efforts, usage of elevated privileges, and all kinds of unauthorized activities.
9. Secure CMOS settings.
10. File and Directory Protection – Through the use of Access Control Lists (ACLs) and file permissions.
11. File and File System Encryption – All disk partitions are formatted with a file system type with encryption features (NTFS in the case of Windows)
12. Configure the operating system to log all activity, errors, and warnings.
13. Secure separate partitions.
14. Tighten NTFS/Registry Permissions
15. Configure appropriate settings for access control on file shares, taking into account that permissions are set through NTFS security features.
16. Disable any unnecessary file sharing.
17. Remove administrative shares if not needed.
18. Ensure services are running with the least-privileged accounts.
19. Implement a strong password management practice.

Conclusion: Server Hardening Matters

Every new attack raises new concerns about security. Continuous system hardening protects businesses. Regularly checking security configurations reduces an organization’s cyber-attack surface and enhances resilience. This means continuously reviewing information system vulnerabilities through Vulnerability Analysis & Penetration Testing. This improves the security posture of their information systems and reduces the risk of expensive system failures.

Key Takeaways

• Infrastructure servers and networks must be prioritized in security strategies.
• Misconfigurations and legacy protocols create vulnerabilities
• Hardening reduces attack surfaces
• Compliance frameworks mandate infrastructure hardening
• CalCom CHS delivers automated infrastructure hardening

How CalCom Automates Infrastructure Hardening

Server hardening can be a painful procedure. Endless hours, labor, and money are invested, resulting in production breakdowns. CalCom Hardening Suite (CHS) automates the entire server hardening process to achieve real results. CHS’s unique ability to ‘learn’ your network eliminates the need for lab testing, ensuring zero outages to your production environment. CHS will allow you to implement your policy directly on your production hassle-free. Want to know more? Click here and get the datasheet.