Defining and implementing a comprehensive server security policy is a crucial step in securing both Windows and Linux servers. In this article, we examine what server hardening is, the steps involved, and the tools that enable it.
What You Will Learn
- What is Server Hardening
- The three stages of server hardening
- What tools are available
- How automation helps
- The advantages of CalCom’s automated solution
What is Server Hardening
The system hardening process reduces a system’s attack surface by securing the configurations of the system’s components (servers, applications, etc.). By default, system components are not secure. Hardening removes unnecessary functionality. Organizations should establish different hardening policies for each system component, aiming to be as granular as possible (differentiating components by type, role, version, environment, etc.).
System hardening has become a mandatory requirement in every regulation. By implementing a good hardening policy based on best practices from organizations such as CIS Benchmarks and DISA STIG, the risk of vulnerabilities and breaches can be significantly reduced.
Server Hardening Stages
Pushing your policy as is onto your system will cause extensive damage. While hardening best practices instruct disabling and blocking any potential attack vector, some rules cannot be implemented since these settings are already in use. To understand which rules can and can not be enforced, you must complete these stages:
1. Testing
The testing stage involves building a test environment that simulates your network as accurately as possible, allowing you to test the impact of each rule enforcement on it. This is, by all means, the hardest, longest, and most resource-demanding stage of the hardening project. Additionally, it is the most crucial one, as failure to do it properly can result in production outages. After testing the impact of each configuration change, the policy must be reviewed again to determine the course of action for each affected rule.
2. Enforcing
Next, you’ll need to enforce all policies on all system components. This stage is also highly prone to human error. Ensure that all components have been implemented in accordance with the correct policy and that all policy rules have been properly enforced, as this involves high management complexity.
3. Monitoring
To avoid starting your compliance posture from scratch, monitoring is essential. Organizational networks constantly change. New applications are installed, old machines die, and you must have the ability to react to these changes so that you won’t lose your compliance posture. Configuration changes occur intentionally or unintentionally, and you must have the ability to monitor and rectify them.
Server Hardening Compliance Tools
There are four groups of tools to check before a hardening project begins:
- Compliance scanners
- Configuration management tools
- Free open-source tools
- Hardening automation tools
Each type of tool offers a solution for a different stage in the hardening project:
Compliance Scanners (Monitoring)
Compliance scanners generate reports indicating how well a system aligns with a compliance framework, such as the CIS Benchmark or DISA STIG. Tools include:
- Tripwire Configuration Manager – gives you the ability to view all your assets’ configuration and compliance status of all your assets in a single reporting environment.
- Qualys – provides configuration scanning and simplifies workflows to address configuration issues.
- NNT SecureOps – provides intelligence change control and automation. Audits and automates continuous compliance. Provides real-time detection for suspicious changes.
- CIS-CAT Pro – The CIS-CAT Pro Assessor evaluates a system’s cybersecurity posture against recommended policy settings. The tool helps organizations save time and resources by supporting automated content with policy-setting recommendations based on the globally recognized CIS Benchmarks.
Configuration Management (Montiring, Enforcing)
NIST defines security configuration management (SCM) as
“The management and control of configurations for an information system with the goal of enabling security and managing risk.”
SCM tools:
- Enforce your desired policy, enabling you to configure your infrastructure to your desired state
- Delivery changes throughout the infrastructure from a single point of control
- Choose the version you’re working with
- Easily make changes in code
- Track of what changes were made and who changed them
- Approve or reject the change request
- Reporting and recording the configuration status
Tools include:
- Ansible – Allows the user to control and develop automation in the IT network
- Chef – Automates application delivery, infrastructure configuration, and compliance auditing.
- Puppet – Open source infrastructure automation platform
- Microsoft System Center Configuration Management – Provides remote control, patch management, software distribution, operating system deployment, network access protection, and hardware and software inventory control.
- SolarWinds Network Configuration Manager Manages network compliance, network automation, configuration backup, and vulnerability assessment.
Hardening Automation Tools: (Testing, Enforcing, Monitoring)
Following the testing phase, hardening automation tools implement your policy on your entire production environment. This dramatically eases enforcement and minimizes human error. The whole procedure is controlled from a single point.
Automations offers a complete hardening solution. It transforms this tangled process into a ‘click-of-a-button’ task. So, you won’t need to write a single script or have any specific expertise. By learning your infrastructure’s dependencies and reporting the potential impact of each configuration change, they save time and resources invested, making hardening automation tools preferable in terms of ROI.
Hardening automation tools monitor your network and remediate undesired changes. It reacts to structural network changes, sends alerts, and corrects configuration drifts to maintain a robust compliance posture. They have all the capabilities of Security Configuration tools and Compliance Scanners, with the ability to perform impact analysis.
Tools: CalCom Hardening Suite (CHS)
Open-source Hardening tools
- Salt Project – Automated infrastructure management with data-driven orchestration, remote execution, and configuration management.
- Microsoft Security Compliance Toolkit 1.0 – Enterprise security tools that enable administrators to download, analyze, test, edit, and store Microsoft-recommended security configuration baselines for Windows and other Microsoft products.
- Hardening auditor– Scripts for comparing Microsoft Windows compliance with the ASD 1709 & Office 2016 Hardening Guides.
- Windows Exploit Suggester Next Generation – Provides a list of vulnerabilities for which the OS is vulnerable, including any known exploits for these vulnerabilities.
- Privesc – Windows PowerShell script for locating misconfiguration issues that can lead to privilege escalation.
- Windows-privesc-check – Standalone Windows executable that searches for misconfigurations allowing privilege escalation for unauthorized users.
Key Takeaways
- Manual server hardening is an inefficient and error-prone process.
- Compliance scanners and/or configuration managers are not enough.
- Automated server hardening tools provide consistency, reduce human error, and ensure compliance with frameworks such as CIS, PCI DSS, HIPAA, and NIST.
- Production stability is a key concern.
- CalCom Hardening Suite (CHS) stands out by automating policy creation, testing, and enforcement, bridging the gap between security requirements and operational needs
CalCom Hardening Automation Solution
CalCom Hardening Suite (CHS) is a hardening automation platform designed to reduce operational costs and enhance the security and compliance posture of the infrastructure. CHS eliminates outages and reduces hardening costs by automating every stage in the hardening process:
- Impact analysis: indicating the impact of a security hardening change on the production services.
- Policy implementation: After setting a policy based on the impact analysis report, CHS will implement each policy on the correct machine from a single point of control.
- Compliance: CHS will monitor your compliance posture, alert you to configuration drifts, and remediate them as needed. CHS will ensure your compliance level remains high in the dynamic, ever-changing infrastructure, so you won’t need to perform hardening from scratch a few months post your initial hardening project.
