1- The first magic point for starting is Wikipediawhere I got a good definition:
In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle, a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically includes changing default passwords, the removal of unnecessary software, unnecessary usernames or logins, and the disabling or removal of unnecessary services.
2- The second point is to understand the concept of Perimeter security:
It is natural barriers or artificially built fortifications that have the goal of keeping intruders out of the area . The strategies can be listed as:
It is the division of an organization network into smaller and, consequently, a more manageable grouping of interfaces called zones. These zones consist of IP ranges, subnets, or security groups designed typically to boost performance and security.
In the event of a cyberattack, effective network segmentation will confine the attack to a specific network zone and contain its impact by blocking lateral movement across the network via logical isolation through access controls.
Designating zones allows organizations to consistently track the location of sensitive data and assess the relevance of an access request based on the nature of that data. Designating where sensitive data reside permits network and security operations to assign resources for more aggressive patch management and proactive system hardening.
The next good rules involve your backup architecture and in specific the Backup Repositories:
Windows:
a. Use the built-in local administrator account
b. Set permissions on the repository directory
c. Modify the Firewall
d. Disable remote RDP services
Linux:
e. Create a Dedicated Repository Account
f. Set Permissions on the Repository Directory
g. Configure the Linux Repository in VeeamModify the Firewall
h. Use Veeam Encryption
Do you want to know more about security? If so the Veeam Best Practices are for sure the answer.
The next article will cover monitoring and automatic actions using Veeam-ONE.
5- Prevent injection of shady boot code
Code injection, also called Remote Code Execution (RCE), occurs when an attacker exploits an input validation flaw in software to introduce and execute malicious code.
To prevent the attack please follow the following rules:
a. Run with UEFI Native Mode b. Use UEFI with Secure Boot Standard Mode c. Combine Secure Boot with TPM d. Equip critical servers with a TPM 2.0
A lot of new challenges came to people who work in IT-Departments these last months.
The number of ransomware attacks has been growing day by day and their attack strategies are becoming more and more evil and dangerous.
The common questions the Managers ask the IT guys are:
a) Are the company protected against these risks?
A good answer is that a successful approach is when the percentage of certainty is more than the percentage of risk.
b) Which are the best practices to be safer?
The key is defining the right process of protection.
The scope of these articles is showing the correct behavior to keep your architecture as safer as possible or, in case of attack, gain as much time as possible to fend off the assault.
The articles will cover the storage point of view and do not deal with perimetral defenses, antimalware, antiviruses, networking strategies, and so on.
Which are the main strategies to adopt?
Having more copies of your data
Hardening the infrastructure
Monitoring behaviors
Are you ready? Let’s start with the first topic !!!
Having more copies of your data:
Backup software is the right tool to score the goals of this first part.
It has to be able to:
a) Create application consistency backup.
b) Copy backup data to different locations.
Almost all backup software can do that but some additional features can address better the biggest challenges:
Flexible: Backup software should write backup data to different types of repositories and be able to restore it without any required dependency. To be clearer, the backup data have to be self-consistent. The advantage is being able to fit different architecture scenarios (Let’s call it “Data mobility”).
Data-Offline: back up data should be put into a “quarantine” area where they cannot be either re-written or read. The classic deployment is a Tape Devices architecture or any scripts that automatically detach the repository devices.
Immutability: The backup data cannot be changed until the immutability period is over. This has a double advantage in comparison to data-offline strategy: It changes the repository status as written & online just for the new backup file. It is offline (as Tape technologies) for re-writing to already present backup data. The speed restore option has to remain unchanged.
Immutability can be reached in two ways:
By WORM (Write Once, Read Many) devices, where the backup files can be used just to restore once they have been added to repositories. For example, technology can be the optical disk, a technology I have been working on in the past.
At Veeam Software this common customer and partner request has been addressed using the immutability propriety of the Object Storage. The good news is that VBR v. 11 implements this great feature directly in Linux Repositories.
Is this enough? I’m still thinking that the backup solution should at least be able to:
Check the backup file and the backup content. The only way to check if a backup file is really reusable is restoring it in a separate area where communication with the production environment is forbidden. At Veeam it is called Sure-Backup.
Check with your anti-virus/anti-malware that the backup files have not been already attacked somewhere and sometime. At Veeam the technology used is the Data integration API.
Before restoring files or VMs in production, check with your anti-virus/anti-malware if your data has been already attacked. At Veeam it is called Secure Restore
Perform Replica Jobs. It helps to create a Disaster Recovery Site useful in performing a quick restart of the service. At Veeam this feature is included from the beginning and the Sure-Backup can be applied with replica too (it is called Sure-Replica). V.11 has a very powerful feature: CDP.
Restore backup data to the public cloud when the primary and replication site is totally out of order. I call it Cold Disaster Recovery and it needs at least one restore point available.
The next article topic is how to hardening your backup architecture