Explain how we ensure that our systems are
secure? All computer systems (operating systems, network devices,
servers, IoT) come with inherent vulnerabilities which can be exploited
by attackers. This we know. The risks associated with these
vulnerabilities are greatly amplified with exposure to the Internet, and
it is our job to reduce the risk to a manageable level. It may be your
job to make sure that your end points are secure. As we know, these are
very complex systems. Where do we start?
One answer lies in security
benchmarks. Benchmarks provide us with a list of controls we can apply
to reduce risk. If you ask a security professional which benchmarks they
use, they will often answer that they use those provided by the Center
for Internet Security (CIS): https://www.cisecurity.org/
In this project, you will choose a system which you will secure according to CIS Benchmarks, and report on it.
Objectives:
Access the CIS Security Benchmarks:
Create an account.
Choose a system you would like to harden.
When you make your selection, CIS will send you an email with a
link to download their benchmarks in the form of pdf files. Download the
benchmarks for the system you are hardening.
Look at the file you have downloaded. You will notice that these
are large documents, reflecting the complexity of modern operating
systems. The benchmarks for a Windows desktop is over 1200 pages! This
is too much for this exercise. Even in the real world, it is often not
possible to apply and test every control. You may not have enough
resources (time, personnel, money, expertise). Some controls might break
custom functionality within your system. You will need to look over the
document, and prioritize which benchmarks you will implement depending
on the context you have decided to use, as described below.
Brainstorm a context in which your device will exist. Small business? Medical
office? College office? Kiosk in a Mall? E-commerce web server? Medical
device? Bank? Game server?
Use this document as a guide to think of how context affects security:
What Is Security Engineering? -by Ross Anderson:
https://www.cl.cam.ac.uk/~rja14/Papers/SEv2-c01.pdf
Ross Anderson’s awesome book: Security Engineering – https://www.cl.cam.ac.uk/~rja14/book.html
Consider the threats your device will face within that context. What are the
risks that go with those threats? Brainstorm to come up with potential threats to
your target system. Think of the risks these threats present. Prioritize the controls you will use.
Use what you learned so far in this course AND the following document as a guideline:
Know Your Enemy – An Introduction to Threat Modeling:
https://www.netmeister.org/blog/threat-model-101.html
Black Hills Information security has made a game of threat modelling: https://www.blackhillsinfosec.com/projects/backdoorsandbreaches/
Adam Shostack, who wrote an excellent book about threat modeling, has also done so (he was first):
the game: https://shostack.org/games/elevation-of-privilege.html
the book: https://shostack.org/books/threat-modeling-book
OWASP (the Open Web Application Security Project) also has a threat modeling game for web applications: https://owasp.org/www-project-cornucopia/
How will you handle the risks?
Use this SANS document as a guideline:
An Introduction to Information System Risk Management:
https://www.sans.org/reading-room/whitepapers/auditing/introduction-information-system-risk-management-1204
Once you have decided which risks you think are most important to
mitigate, decide which controls you will implement on your device.
Describe the risk that each control is meant to mitigate
Here is a description of security controls:
The CIS Critical Security Controls for Effective Cyber Defense:
You should be familiar, at least at a high level, with the 18 Critical Security Controls.
note: past versions had 20 controls
description: https://en.wikipedia.org/wiki/The-CIS-Critical-Security-Controls-for-Effective-Cyber-Defense
the controls: https://www.cisecurity.org/controls/
Set up a working version of the device, and implement the
controls, recording your progress in a report you will submit at the end
of the semester.
Provide proof that all your security changes are working via a security scan audit
While each student must
implelment the controls on their own VM, and write a report in their own
words.
Each student must submit a final report in their own words. Your final report should include the following:
a description of your threat modeling and risk based decisions
a description of the controls you put in place, according to your benchmark
proof that you implemented the control on a VM (screenshot of final result of each control)
justification for each decision you made
a high level description of how you would test the efficacy of each control
you put into place
Last Completed Projects
| topic title | academic level | Writer | delivered |
|---|