You will become familiar with network hardening practices that strengthen network systems. You’ll learn how security hardening helps defend against malicious actors and intrusion methods. You’ll also learn how to use security hardening to address the unique security challenges posed by cloud infrastructures.
Learning Objectives
- Describe OS hardening techniques
- Describe network and cloud hardening techniques that target network vulnerabilities
- Describe network hardening techniques
- Explain cloud security practices
Introduction to security hardening
Video: Welcome to module 4
In the next section of the course, you will learn about security hardening, which is the process of making systems more secure by reducing their vulnerabilities. You will learn about OS hardening, network hardening, and cloud hardening practices. You will also learn about the tasks that security analysts perform as part of security hardening, such as patch updates and backups.
Security hardening is important for security analysts because it is a major part of their day-to-day tasks. It is important for security analysts to understand how security hardening works so that they can effectively protect the systems they are responsible for.
I want to take a moment to congratulate
you on your progress so far. First, you learned about
network operations. Then, you learned about the tools and protocols that help
network systems function. Next, you learned how vulnerabilities in networks expose them to
various security intrusions. Now, we’ll discuss security hardening. Then, we’ll learn about OS hardening,
explore network hardening practices, and discuss cloud hardening practices. Security hardening can be
implemented in devices, networks, applications, and cloud infrastructure. Security analysts may perform
tasks, such as patch updates and backups, as part of security hardening. We’ll discuss these tasks as you
progress through the course. As a security analyst, hardening will play
a major role in your day-to-day tasks, which is why it’s important for
you to understand how it works. I’m excited to accompany
you on this journey. Meet you in the next video.
Video: Security hardening
Security hardening is the process of strengthening a system to reduce its vulnerability and attack surface. The attack surface is all the potential vulnerabilities that a threat actor could exploit.
Security hardening can be conducted on any device or system that can be compromised, such as hardware, operating systems, applications, computer networks, and databases. Physical security is also a part of security hardening.
Some common types of hardening procedures include:
- Software updates (patches)
- Device application configuration changes
- Removing or disabling unused applications and services
- Disabling unused ports
- Reducing access permissions across devices and networks
- Conducting regular penetration testing
Security hardening is an essential aspect of securing networks. It is a foundational part of network security that strengthens the network in order to reduce the number of successful attacks.
Here are some of the benefits of security hardening:
- Reduces the risk of cyberattacks
- Protects sensitive data
- Improves compliance with security regulations
- Increases the overall security posture of an organization
Security hardening is an ongoing process, as new threats and vulnerabilities are discovered all the time. It is important for organizations to regularly review and update their security hardening procedures to ensure that their systems are protected.
Security hardening is the process of strengthening a system to reduce its vulnerability and attack surface. The attack surface is all the potential vulnerabilities that a threat actor could exploit.
Security hardening can be conducted on any device or system that can be compromised, such as hardware, operating systems, applications, computer networks, and databases. Physical security is also a part of security hardening.
Here is a tutorial on security hardening in cybersecurity:
- Identify your assets. What devices, systems, and data do you need to protect? Once you know what you need to protect, you can start to develop a plan to harden them.
- Assess your risks. What are the biggest threats to your assets? Once you know the risks, you can prioritize your hardening efforts.
- Implement security hardening measures. There are many different security hardening measures that you can implement, depending on your specific needs. Some common measures include:
- Installing software updates and patches
- Configuring devices and applications securely
- Removing or disabling unused applications and services
- Disabling unused ports
- Reducing access permissions across devices and networks
- Implementing physical security measures
- Monitor and maintain your security hardening measures. Security hardening is not a one-time event. It is important to monitor your security hardening measures on an ongoing basis and make adjustments as needed.
Here are some additional tips for security hardening:
- Use strong passwords and enable multi-factor authentication (MFA). Strong passwords and MFA make it much more difficult for attackers to gain unauthorized access to your systems.
- Segment your network. Segmenting your network into different zones can help to contain the spread of malware and other attacks.
- Use a firewall and intrusion detection/prevention system (IDS/IPS). A firewall can help to block unauthorized traffic from entering your network, and an IDS/IPS can help to detect and block malicious activity.
- Educate your employees about security best practices. Employees are often the weakest link in the security chain. Educating them about security best practices can help to reduce the risk of human error leading to a security breach.
Conclusion
Security hardening is an essential part of any cybersecurity strategy. By hardening your systems, you can make it much more difficult for attackers to succeed.
Fill in the blank: ____ refers to all the potential vulnerabilities a threat actor could potentially exploit in a system.
Attack surface
An attack surface is all the potential vulnerabilities a threat actor could potentially exploit in a system.
Security analysts and the organizations
they work with have to be proactive about protecting
systems from attack. This is where security hardening comes in. Security hardening is the process of
strengthening a system to reduce its vulnerability and attack surface. All the potential vulnerabilities
that a threat actor could exploit are referred to as
a system’s attack surface. Let’s use an example that
compares a network to a house. The attack surface would
be all the doors and windows that a robber could use
to gain access to that house. Just like putting locks on all
the doors and windows in the house, security hardening involves
minimizing the attack surface or potential vulnerabilities and
keeping a network as secure as possible. As part of security hardening, security
analysts perform regular maintenance procedures to keep network devices and
systems functioning securely and optimally. Security hardening can be
conducted on any device or system that can be compromised,
such as hardware, operating systems, applications, computer networks, and
databases. Physical security is also
a part of security hardening. This may include securing a physical space
with security cameras and security guards. Some common types of hardening
procedures include software updates, also called patches, and
device application configuration changes. These updates and
changes are done to increase security and fix security vulnerabilities on a network. An example of a security configuration
change would be requiring longer passwords or
more frequent password changes. This makes it harder for a malicious
actor to gain login credentials. An example of a configuration check is
updating the encryption standards for data that is stored in a database. Keeping encryption up to
date makes it harder for malicious actors to access the database. Other examples of security
hardening include removing or disabling unused applications and
services, disabling unused ports, and reducing access permissions
across devices and network. Minimizing the number of applications,
devices, ports, and access permissions makes network and device monitoring more
efficient and reduces the overall attack surface, which is one of the best
ways to secure an organization. Another important strategy for security hardening is to conduct
regular penetration testing. A penetration test, also called a pen test,
is a simulated attack that helps identify vulnerabilities in a system, network,
website, application, and process. Penetration testers document
their findings in a report. Depending on where the test fails,
security teams can determine the type of security vulnerabilities
that require fixing. Organizations can then review
these vulnerabilities and come up with a plan to fix them. Coming up, you’ll learn more about how
security hardening is an essential aspect of securing networks. It’s a foundational part of
network security that strengthens the network in order to reduce
the number of successful attacks.
OS hardening
Video: OS hardening practices
This video is about operating system (OS) hardening and why it’s important to keep the entire network secure.
OS hardening is a set of procedures that maintains OS security and improves it. Security measures like access privileges and password policies frequently undergo regular security checks as part of OS hardening.
Some OS hardening tasks are performed at regular intervals, like updates, backups, and keeping an up-to-date list of devices and authorized users. Other tasks are performed only once as part of preliminary safety measures. One example would be configuring a device setting to fit a secure encryption standard.
Here are some of the OS hardening tasks that are performed at a regular interval:
- Patch installation: A patch update is a software and operating system, or OS, update that addresses security vulnerabilities within a program or product.
- Hardware and software disposal: This ensures that all old hardware is properly wiped and disposed of. It’s also a good idea to delete any unused software applications since some popular programming languages have known vulnerabilities.
- Implementing a strong password policy: Strong password policies require that passwords follow specific rules. For example, an organization may set a password policy that requires a minimum of eight characters, a capital letter, a number, and a symbol.
Coming up, we’ll discuss network hardening practices.
OS hardening practices in Cybersecurity
Operating system (OS) hardening is the process of securing an operating system to reduce its vulnerability to attack. This can be done by implementing a variety of security measures, such as:
- Keeping the OS up to date: Software vendors regularly release security patches to address known vulnerabilities in their products. It is important to install these patches as soon as they are available.
- Configuring the OS securely: Many OSs come with default settings that are not secure. It is important to review and configure these settings to improve the security of the system. For example, you may want to disable unused services and ports, and configure strong password policies.
- Using firewalls and intrusion detection systems: Firewalls can be used to block unauthorized access to the system, while intrusion detection systems can be used to monitor for suspicious activity.
- Using strong passwords and multi-factor authentication: Strong passwords and multi-factor authentication can help to protect the system from unauthorized access.
Here is a more detailed tutorial on some common OS hardening practices:
1. Keep the OS up to date
Software vendors regularly release security patches to address known vulnerabilities in their products. It is important to install these patches as soon as they are available. You can usually enable automatic updates in your OS settings.
2. Configure the OS securely
Many OSs come with default settings that are not secure. It is important to review and configure these settings to improve the security of the system. For example, you may want to:
- Disable unused services and ports.
- Configure strong password policies.
- Disable remote login for non-essential users.
- Enable encryption for sensitive data.
- Configure auditing to track system activity.
3. Use firewalls and intrusion detection systems
Firewalls can be used to block unauthorized access to the system, while intrusion detection systems can be used to monitor for suspicious activity.
- Firewalls: Firewalls are network security devices that monitor and control incoming and outgoing network traffic. They can be used to block traffic from unauthorized sources and to prevent certain types of traffic from flowing through the network.
- Intrusion detection systems (IDS): IDSs monitor network traffic for suspicious activity. They can be used to detect attacks such as port scans, denial-of-service attacks, and malware infections.
4. Use strong passwords and multi-factor authentication
Strong passwords and multi-factor authentication can help to protect the system from unauthorized access.
- Strong passwords: Strong passwords are at least 12 characters long and include a mix of upper and lowercase letters, numbers, and symbols. Avoid using common words or phrases in your passwords.
- Multi-factor authentication (MFA): MFA adds an extra layer of security to your accounts by requiring you to enter a code from your phone or another device in addition to your password.
By following these OS hardening practices, you can help to protect your system from attack and improve its overall security.
Here are some additional tips for OS hardening:
- Use a secure boot process. This will help to prevent malicious software from loading before the OS has a chance to start.
- Implement least privilege. This means only giving users and applications the permissions they need to perform their tasks.
- Monitor system logs for suspicious activity. This will help you to identify and respond to attacks early.
- Have a disaster recovery plan in place. This will help you to recover your system quickly in the event of an attack or other disaster.
OS hardening is an important part of any cybersecurity strategy. By following the tips above, you can help to protect your system from attack and improve its overall security.
In network security, why is it important to secure operating systems (OS) on each device?
To prevent the whole network being compromised by one insecure OS
It’s important to secure the OS on each device because one insecure OS could lead to the whole network being compromised.
Hi there. In this video, we’ll discuss
operating system, or OS, hardening and why it’s essential to keep the
entire network secure. The operating system is the interface between computer
hardware and the user. The OS is the first program loaded when a computer turns on. The OS acts as an intermediary between software applications
and the computer hardware. It’s important to secure
the OS in each system because one insecure OS can lead to a whole network
being compromised. There are many types of
operating systems, and they all share similar security
hardening practices. Let’s talk about some of those security hardening
practices that are recommended to secure an OS. Some OS hardening tasks are performed at
regular intervals, like updates,
backups, and keeping an up-to-date list of devices
and authorized users. Other tasks are performed only once as part of preliminary
safety measures. One example would be configuring a device setting to fit a
secure encryption standard. Let’s begin with
OS hardening tasks that are performed at
a regular interval, such as patch installation, also known as patch updates. A patch update is a software
and operating system, or OS, update that addresses security vulnerabilities
within a program or product. Now we’ll discuss
patch updates provided to the company by the
OS software vendor. With patch updates,
the OS should be upgraded to its
latest software version. Sometimes patches are released to fix a security
vulnerability in the software. As soon as OS vendors publish a patch and the
vulnerability fix, malicious actors
know exactly where the vulnerability
is in systems running the out-of-date OS. This is why it’s important
for organizations to run patch updates as soon
as they are released. For example, my team had to perform an
emergency patch to address a recent vulnerability found in a commonly used
programming library. The library is used
almost everywhere, so we had to quickly patch
most of our servers and applications to fix
the vulnerability. The newly updated OS should be added to the baseline
configuration, also called the baseline image. A baseline configuration
is a documented set of specifications within a system that is used as a basis
for future builds, releases, and updates. For example, a
baseline may contain a firewall rule with a list of allowed and disallowed
network ports. If a security team suspects unusual activity
affecting the OS, they can compare the
current configuration to the baseline and make sure
that nothing has been changed. Another hardening task
performed regularly is hardware and software disposal. This ensures that
all old hardware is properly wiped
and disposed of. It’s also a good idea to delete any unused software
applications since some popular
programming languages have known vulnerabilities. Removing unused software
makes sure that there aren’t any unnecessary
vulnerabilities connected with the programs that
the software uses. The final OS hardening
technique that we’ll discuss is implementing a
strong password policy. Strong password policies require that passwords follow
specific rules. For example, an
organization may set a password policy that requires a minimum of eight characters, a capital letter, a
number, and a symbol. To discourage malicious actors, a password policy usually states that a user
will lose access to the network after entering the wrong password a certain
number of times in a row. Some systems also require multi-factor
authentication, or MFA. MFA is a security measure which requires a user to
verify their identity in two or more ways to access
a system or network. Ways of identifying
yourself include something you know,
like a password, something you have
like an ID card, or something unique about
you, like your fingerprint. To review, OS hardening is
a set of procedures that maintains OS security
and improves it. Security measures like access privileges and
password policies frequently undergo
regular security checks as part of OS hardening. Coming up, we’ll discuss
network hardening practices.
Reading: Brute force attacks and OS hardening
Reading
In this reading, you’ll learn about brute force attacks. You’ll consider how vulnerabilities can be assessed using virtual machines and sandboxes, and learn ways to prevent brute force attacks using a combination of authentication measures. Implementing various OS hardening tasks can help prevent brute force attacks. An attacker can use a brute force attack to gain access and compromise a network.
Usernames and passwords are among the most common and important security controls in place today. They are used and enforced on everything that stores or accesses sensitive or private information, like personal phones, computers, and restricted applications within an organization. However, a major issue with relying on login credentials as a critical line of defense is that they’re vulnerable to being stolen and guessed by malicious actors.
Brute force attacks
A brute force attack is a trial-and-error process of discovering private information. There are different types of brute force attacks that malicious actors use to guess passwords, including:
- Simple brute force attacks. When attackers try to guess a user’s login credentials, it’s considered a simple brute force attack. They might do this by entering any combination of usernames and passwords that they can think of until they find the one that works.
- Dictionary attacks use a similar technique. In dictionary attacks, attackers use a list of commonly used passwords and stolen credentials from previous breaches to access a system. These are called “dictionary” attacks because attackers originally used a list of words from the dictionary to guess the passwords, before complex password rules became a common security practice.
Using brute force to access a system can be a tedious and time consuming process, especially when it’s done manually. There are a range of tools attackers use to conduct their attacks.
Assessing vulnerabilities
Before a brute force attack or other cybersecurity incident occurs, companies can run a series of tests on their network or web applications to assess vulnerabilities. Analysts can use virtual machines and sandboxes to test suspicious files, check for vulnerabilities before an event occurs, or to simulate a cybersecurity incident.
Virtual machines (VMs)
Virtual machines (VMs) are software versions of physical computers. VMs provide an additional layer of security for an organization because they can be used to run code in an isolated environment, preventing malicious code from affecting the rest of the computer or system. VMs can also be deleted and replaced by a pristine image after testing malware.
VMs are useful when investigating potentially infected machines or running malware in a constrained environment. Using a VM may prevent damage to your system in the event its tools are used improperly. VMs also give you the ability to revert to a previous state. However, there are still some risks involved with VMs. There’s still a small risk that a malicious program can escape virtualization and access the host machine.
You can test and explore applications easily with VMs, and it’s easy to switch between different VMs from your computer. This can also help in streamlining many security tasks.
Sandbox environments
A sandbox is a type of testing environment that allows you to execute software or programs separate from your network. They are commonly used for testing patches, identifying and addressing bugs, or detecting cybersecurity vulnerabilities. Sandboxes can also be used to evaluate suspicious software, evaluate files containing malicious code, and simulate attack scenarios.
Sandboxes can be stand-alone physical computers that are not connected to a network; however, it is often more time- and cost-effective to use software or cloud-based virtual machines as sandbox environments. Note that some malware authors know how to write code to detect if the malware is executed in a VM or sandbox environment. Attackers can program their malware to behave as harmless software when run inside these types of testing environments.
Prevention measures
Some common measures organizations use to prevent brute force attacks and similar attacks from occurring include:
- Salting and hashing: Hashing converts information into a unique value that can then be used to determine its integrity. It is a one-way function, meaning it is impossible to decrypt and obtain the original text. Salting adds random characters to hashed passwords. This increases the length and complexity of hash values, making them more secure.
- Multi-factor authentication (MFA) and two-factor authentication (2FA): MFA is a security measure which requires a user to verify their identity in two or more ways to access a system or network. This verification happens using a combination of authentication factors: a username and password, fingerprints, facial recognition, or a one-time password (OTP) sent to a phone number or email. 2FA is similar to MFA, except it uses only two forms of verification.
- CAPTCHA and reCAPTCHA: CAPTCHA stands for Completely Automated Public Turing test to tell Computers and Humans Apart. It asks users to complete a simple test that proves they are human. This helps prevent software from trying to brute force a password. reCAPTCHA is a free CAPTCHA service from Google that helps protect websites from bots and malicious software.
- Password policies: Organizations use password policies to standardize good password practices throughout the business. Policies can include guidelines on how complex a password should be, how often users need to update passwords, and if there are limits to how many times a user can attempt to log in before their account is suspended.
Key takeaways
Brute force attacks are a trial-and-error process of guessing passwords. Attacks can be launched manually or through software tools. Methods include simple brute force attacks and dictionary attacks. To protect against brute force attacks, cybersecurity analysts can use sandboxes to test suspicious files, check for vulnerabilities, or to simulate real attacks and virtual machines to conduct vulnerability tests. Some common measures to prevent brute force attacks include: hashing and salting, MFA and/or 2FA, CAPTCHA and reCAPTCHA, and password policies.
Practice Quiz: Activity: Apply OS hardening techniques
Reading
Activity Overview
In this activity, you will take on the role of a cybersecurity analyst working for a company that hosts the cooking website, yummyrecipesforme.com. Visitors to the website experience a security issue when loading the main webpage. Your job is to investigate, identify, document, and recommend a solution to the security problem.
When investigating the security event, you will review a tcpdump log. You will need to identify the network protocols used to establish the connection between the user and the website. Network protocols are the communication rules and standards networked devices use to transmit data. Unfortunately, malicious actors can also use network protocols to invade and attack private networks. Knowing how to identify the protocols commonly used in attacks will help you protect your organization’s network against these types of security events.
To complete the assignment, you will also need to document what occurred during the security incident. Then, you will recommend one security measure to implement to prevent similar security problems in the future.
Be sure to complete this activity before moving on. The next course item will provide you with a completed exemplar to compare to your own work.
Scenario
Review the scenario below. Then complete the step-by-step instructions.
You are a cybersecurity analyst for yummyrecipesforme.com, a website that sells recipes and cookbooks. A disgruntled baker has decided to publish the website’s best-selling recipes for the public to access for free.
The baker executed a brute force attack to gain access to the web host. They repeatedly entered several known default passwords for the administrative account until they correctly guessed the right one. After they obtained the login credentials, they were able to access the admin panel and change the website’s source code. They embedded a javascript function in the source code that prompted visitors to download and run a file upon visiting the website. After running the downloaded file, the customers are redirected to a fake version of the website where the seller’s recipes are now available for free.
Several hours after the attack, multiple customers emailed yummyrecipesforme’s helpdesk. They complained that the company’s website had prompted them to download a file to update their browsers. The customers claimed that, after running the file, the address of the website changed and their personal computers began running more slowly.
In response to this incident, the website owner tries to log in to the admin panel but is unable to, so they reach out to the website hosting provider. You and other cybersecurity analysts are tasked with investigating this security event.
To address the incident, you create a sandbox environment to observe the suspicious website behavior. You run the network protocol analyzer tcpdump, then type in the URL for the website, yummyrecipesforme.com. As soon as the website loads, you are prompted to download an executable file to update your browser. You accept the download and allow the file to run. You then observe that your browser redirects you to a different URL, greatrecipesforme.com, which is designed to look like the original site. However, the recipes your company sells are now posted for free on the new website.
The logs show the following process:
- The browser requests a DNS resolution of the yummyrecipesforme.com URL.
- The DNS replies with the correct IP address.
- The browser initiates an HTTP request for the webpage.
- The browser initiates the download of the malware.
- The browser requests another DNS resolution for greatrecipesforme.com.
- The DNS server responds with the new IP address.
- The browser initiates an HTTP request to the new IP address.
A senior analyst confirms that the website was compromised. The analyst checks the source code for the website. They notice that javascript code had been added to prompt website visitors to download an executable file. Analysis of the downloaded file found a script that redirects the visitors’ browsers from yummyrecipesforme.com to greatrecipesforme.com.
The cybersecurity team reports that the web server was impacted by a brute force attack. The disgruntled baker was able to guess the password easily because the admin password was still set to the default password. Additionally, there were no controls in place to prevent a brute force attack.
Your job is to document the incident in detail, including identifying the network protocols used to establish the connection between the user and the website. You should also recommend a security action to take to prevent brute force attacks in the future.
Step-By-Step Instructions
Step 1: Access the template
To use the template for this course item, click the link below and select Use Template.
Link to template:
Step 2: Access supporting materials
The following supporting materials will help you complete this activity. Keep them open as you proceed to the next steps.
To use the supporting materials for this course item, click the link below and select Use Template.
Links to supporting materials:
Step 3: Identify the network protocol involved in the incident
Imagine that you are one of the cybersecurity analysts in this scenario and you are tasked with writing an incident report for this security event. Using the DNS & HTTP log file you produced with tcpdump, determine which network protocol is identified in the packet captures during the investigation. You will use what you learned about the four layers of the TCP/IP model and which protocols happen at each layer. If needed, you can review the video and reading about the TCP/IP model to use as guides for your response. Then review the DNS & HTTP traffic log and record which protocol you identified in the first section of the security incident report template.
Step 4: Document the incident
Summarize the incident in the second section of the report. Provide as many details and facts as possible in your documentation. When writing the documentation, be sure to:
- Avoid using strong emotional language (good, terrible, awful, etc.).
- Include as many facts about the issue as you can, including where the incident occurred, how it happened, whether anyone witnessed it, how it was discovered, etc.
- Indicate your sources for information and evidence.
Writing accurate and detailed documentation for cybersecurity incidents can serve as a reference point for other cybersecurity analysts. Additionally, quality documentation can be used to educate other employees about cybersecurity measures taken within the company when incidents occur and can help businesses comply with various security audits.
Step 5: Recommend one remediation for brute force attacks
After documenting the incident, write one recommendation to help your organization prevent brute force attacks in the future.
Some of the common security methods used to prevent brute force attacks include:
- Requiring strong passwords
- Enforcing two-factor authentication (2FA)
- Monitoring login attempts
- Limiting the number of login attempts
Select one security measure, and explain why it is effective in section three of the security incident report template.
The more safety measures that are in place, the less likely a malicious actor will be able to access sensitive information.
Pro tip: Save the template
Finally, be sure to save a blank copy of the template you used to complete this activity. You can use it for further practice or in your professional projects. These templates will help you work through your thought processes and demonstrate your experience to potential employers.
What to Include in Your Response
Be sure to address the following criteria in your completed activity:
- Name one network protocol identified during the investigation
- Document the incident
- Recommend one security measure
Reading: Activity Exemplar: Apply OS hardening techniques
Reading
Completed Exemplar
To review the exemplar for this course item, click the link below and select Use Template.
Assessment of Exemplar
Compare the exemplar to your completed activity. Review your work using each of the criteria in the exemplar. What did you do well? Where can you improve? Use your answers to these questions to guide you as you continue to progress through the course.
Note: The exemplar represents one possible explanation for the issues that the end users are facing. Yours will likely differ in certain ways. What’s important is that you identified the network protocols involved and created a report. In your role as a security analyst, you and your team would document any issue that occurs on the network and come up with solutions to help prevent the same issues from occurring in the future. Good quality documentation can save you and your organization time and potentially manage the attack early on.
First, analyze the DNS & HTTP traffic log to identify a network protocol. Then, document the cybersecurity incident. Finally, recommend one security measure your organization could implement to prevent brute force attacks in the future. Creating this process will, in turn, help improve the organization’s security posture.
The exemplar is accompanied by the activity, and presents a professional documentation example to include the following:
- One network protocol identified during the investigation
- Documentation of the incident
- A recommended security measure
Key Takeaways
As a security analyst, you might not always know exactly what is the primary cause of a network issue or a possible attack. But being able to analyze the protocols involved will help you make an informed assumption about what happened. This will allow you and your team to begin resolving the issue.
Practice Quiz: Test your knowledge: OS hardening
Fill in the blank: The _ acts as an intermediary between software applications and computer hardware.
operating system
The operating system acts as an intermediary between software applications and computer hardware.
Which of the following activities are security hardening tasks? Select all that apply.
- Disposing of hardware and software properly
- Making patch updates
- Enforcing password policies
Making patch updates, disposing of hardware and software properly, and enforcing password policies are security hardening tasks. Security hardening is the process of strengthening a system to reduce its vulnerability and attack surface.
Multifactor authentication (MFA) is a security measure that requires a user to verify their identity in at least two ways before they can access a system or network.
True
MFA is a security measure that requires a user to verify their identity in at least two ways before they can access a system or network.
What are examples of physical security hardening? Select all that apply.
Installing security cameras, Hiring security guards
Physical security is also a part of security hardening and may include securing a physical space with security cameras and security guards.
Network hardening
Video: Network hardening practices
Network hardening is the process of improving the security of a network by implementing a variety of measures, such as port filtering, network access privileges, and encryption.
Some network hardening tasks are performed regularly, such as firewall rules maintenance, network log analysis, patch updates, and server backups. Other tasks are performed once, such as port filtering on firewalls, network access privileges, and encryption for communication.
Here is a summary of some of the key network hardening practices:
- Port filtering: Port filtering is a firewall function that blocks or allows certain port numbers to limit unwanted communication. Only ports that are needed should be allowed. Any port that isn’t being used by the normal network operations should be disallowed. This helps to protect against port vulnerabilities.
- Network access privileges: Network access privileges should be granted to only those users who need them. This can be done by using user accounts and passwords, and by configuring firewalls and other security devices to restrict access to certain resources.
- Encryption: All network communication should be encrypted using the latest encryption standards. This helps to protect data from being intercepted and stolen.
- Network segmentation: Network segmentation involves dividing the network into smaller subnets. This can help to contain security breaches and prevent them from spreading throughout the entire network.
- Wireless security: Wireless networks are particularly vulnerable to attack, so it is important to implement strong security measures for these networks. This includes using strong encryption, disabling unused wireless protocols, and changing the default passwords on wireless devices.
By implementing these network hardening practices, organizations can help to protect their networks from attack and reduce the risk of data breaches.
Tutorial on Network Hardening Practices in Cybersecurity
Introduction
Network hardening is the process of improving the security of a network by implementing a variety of measures. These measures can help to protect the network from attack, reduce the risk of data breaches, and ensure the confidentiality, integrity, and availability of data and systems.
Common network hardening practices
Some of the most common network hardening practices include:
- Port filtering: Port filtering is a firewall function that blocks or allows certain port numbers to limit unwanted communication. Only ports that are needed should be allowed. Any port that isn’t being used by the normal network operations should be disallowed. This helps to protect against port vulnerabilities.
- Network access privileges: Network access privileges should be granted to only those users who need them. This can be done by using user accounts and passwords, and by configuring firewalls and other security devices to restrict access to certain resources.
- Encryption: All network communication should be encrypted using the latest encryption standards. This helps to protect data from being intercepted and stolen.
- Network segmentation: Network segmentation involves dividing the network into smaller subnets. This can help to contain security breaches and prevent them from spreading throughout the entire network.
- Wireless security: Wireless networks are particularly vulnerable to attack, so it is important to implement strong security measures for these networks. This includes using strong encryption, disabling unused wireless protocols, and changing the default passwords on wireless devices.
Other network hardening practices
In addition to the common network hardening practices listed above, there are a number of other measures that can be taken to improve the security of a network. These include:
- Patch management: It is important to regularly install security patches for all operating systems and software applications. This helps to close known security vulnerabilities that could be exploited by attackers.
- Log monitoring: Network logs should be monitored for suspicious activity. This can help to identify security breaches early on, before they cause significant damage.
- Security awareness training: Employees should be trained on security best practices, such as how to create strong passwords and how to identify phishing emails. This can help to reduce the risk of human error, which is a common cause of security breaches.
Conclusion
Network hardening is an important part of any cybersecurity program. By implementing a variety of network hardening measures, organizations can help to protect their networks from attack and reduce the risk of data breaches.
Here are some additional tips for network hardening:
- Use a layered security approach: No single security measure is 100% effective. Therefore, it is important to use a layered security approach that includes a variety of measures.
- Keep your security up-to-date: Security threats are constantly evolving, so it is important to keep your security measures up-to-date. This includes installing security patches, updating security policies, and training employees on the latest security threats.
- Test your security: It is important to regularly test your security to identify any weaknesses. This can be done using a variety of tools and methods, such as penetration testing and vulnerability scanning.
By following these tips, you can help to ensure that your network is as secure as possible.
Fill in the blank: A _____ is an application that collects and analyzes log data to monitor critical activities in an organization.
Security Information and Event Management tool (SIEM)
A SIEM tool is an application that collects and analyzes log data to monitor critical activities in an organization.
Earlier, you learned that
OS hardening focuses on device safety and
uses patch updates, secure configuration, and
account access policies. Now we’ll focus on
network hardening. Network hardening focuses on network-related
security hardening, like port filtering,
network access privileges, and encryption over networks. Certain network hardening
tasks are performed regularly, while others are performed once and then updated as needed. Some tasks that are regularly performed are firewall
rules maintenance, network log analysis, patch
updates, and server backups. Earlier, you learned that
a log is a record of events that occurs within
an organization’s systems. Network log analysis
is the process of examining network logs to
identify events of interest. Security teams use
a log analyzer tool or a security information
and event management tool, also known as a SIEM, to conduct network log analysis. A SIEM tool is an application
that collects and analyzes log data to monitor critical activities
in an organization. It gathers security
data from a network and presents that data on
a single dashboard. The dashboard
interface is sometimes called a single pane of glass. A SIEM helps analysts
to inspect, analyze, and react to security events across the network based
on their priority. Reports from the SIEM
provide a list of new or ongoing network
vulnerabilities and list them on a scale of priority from high to low, where high priority
vulnerabilities have a much shorter
deadline for mitigation. Now that we’ve covered tasks that are performed regularly, let’s examine tasks that
are performed once. These tasks include port
filtering on firewalls, network access privileges, and encryption for communication,
among many things. Let’s start with port filtering. Port filtering can be
formed over the network. Port filtering is a firewall
function that blocks or allows certain port numbers to limit unwanted communication. A basic principle is that the only ports that are needed are the ones
that are allowed. Any port that isn’t
being used by the normal network operations
should be disallowed. This protects against
port vulnerabilities. Networks should be set up with the most up-to-date
wireless protocols available and older wireless protocols
should be disabled. Security analysts also use network segmentation to create isolated subnets for different departments
in an organization. For example, they
might make one for the marketing department and one for the finance department. This is done so the issues in each subnet don’t spread
across the whole company and only specified users
are given access to the part of the network that
they require for their role. Network segmentation
may also be used to separate different
security zones. Any restricted zone on
a network containing highly classified or
confidential data should be separate from
the rest of the network. Lastly, all network
communication should be encrypted using the latest
encryption standards. Encryption standards are
rules or methods used to conceal outgoing data and uncover or decrypt
incoming data. Data in restricted zones should have much higher
encryption standards, which makes them more
difficult to access. You’ve learned about the most
common hardening practices. This knowledge will be
useful as you complete the certificate program and it’s essential to your career
as a security analyst.
Reading: Network security applications
Practice Quiz: Activity: Analysis of network hardening
Reading: Activity Exemplar: Analysis of network hardening
Reading
Completed Exemplar
To review the exemplar for this course item, click the link below and select Use Template.
Security risk assessment report exemplar
Assessment of Exemplar
Compare the exemplar to your completed activity. Review your work using each of the criteria in the exemplar. What did you do well? Where can you improve? Use your answers to these questions to guide you as you continue to progress through the course.
Note: The exemplar represents one possible explanation for the issues that the social media organization is facing. There are multiple correct security hardening tools and methods to use. What’s important is that you identified the network hardening measures that are most effective for managing the vulnerabilities selected. In your role as a security analyst, you and your team would then explain your decisions and make a case for why those measures will be effective at securing the network.
The exemplar focuses on the vulnerability of an outdated software for an on-premises database. One potential solution to the vulnerability is identified and included in the report for the direct supervisors. The report explains how the company might be compromised in the future if the database is not patched and if employees continue to share passwords.
In the section about the organization’s information security policy, the report includes information about adding general security hardening practices, a recommendation for how often the hardening practices should be performed, and an explanation of what the potential consequences are if the policy is not followed. This is one example of how a security risk assessment report can be analyzed and how an information security policy might be written.
Key Takeaways
As a security analyst, you may be responsible for initiating network security practices. Making executive decisions about which tools to use based on what you know about certain vulnerabilities will be a starting point for helping the organization improve its network security. Explaining and documenting your decisions as a cybersecurity analyst will help in the future if the network ever needs to be troubleshooted. It will also help give non-technical employees buy-in and help them follow security practices, such as multifactor authentication.
Practice Quiz: Test your knowledge: Network hardening
Fill in the blank: Security teams can use _ to examine network logs and identify events of interest.
security information and event management (SIEM) tools
Security teams can use security information and event management (SIEM) tools to examine network logs and identify events of interest. SIEM tools collect and analyze log data to monitor critical activities in an organization.
AI assistant
The answer is: security information and event management (SIEM) tools
SIEM tools are used to collect and analyze log data from a variety of sources, including firewalls, intrusion detection systems, and servers. SIEM tools can be used to identify a wide range of security events, such as unauthorized access attempts, malware infections, and denial-of-service attacks.
Security teams can use SIEM tools to investigate security incidents, monitor for suspicious activity, and generate reports on security trends. SIEM tools can also be used to automate security tasks, such as responding to security alerts and generating incident reports.
The other options are not used to examine network logs and identify events of interest:
- network segmentation is used to divide a network into smaller subnets to improve security and performance.
- port filtering is used to block or allow certain port numbers to limit unwanted communication.
- baseline configuration is a reference set of security settings that are used to configure devices and systems.
I hope this helps! Let me know if you have any other questions.
What is a basic principle of port filtering?
Allow ports that are used by normal network operations.
A basic principle of port filtering is to allow ports that are used by normal network operations. Any port that is not being used by the normal network operations should be disallowed to protect against vulnerabilities.
AI assistant
The basic principle of port filtering is to allow ports that are used by normal network operations and disallow ports that are not.
Port filtering is a firewall function that blocks or allows certain port numbers to limit unwanted communication. This can help to protect against port vulnerabilities and prevent unauthorized access to systems and data.
When configuring port filtering, it is important to identify the ports that are needed for normal network operations. This can be done by reviewing documentation for the operating systems and applications that are running on the network. Once the needed ports have been identified, they can be allowed in the firewall rules. All other ports should be disallowed.
It is also important to keep the firewall rules up to date. As new applications are installed or existing applications are updated, new ports may need to be allowed. Additionally, if any ports are no longer needed, they should be disallowed to reduce the attack surface of the network.
Here are some examples of ports that are commonly used by normal network operations:
- Port 80: HTTP traffic
- Port 443: HTTPS traffic
- Port 22: SSH traffic
- Port 25: SMTP traffic
- Port 110: POP3 traffic
- Port 143: IMAP traffic
Ports that are not used by normal network operations should be disallowed. This includes ports that are commonly used by malware and attack tools. For example, ports 135 and 445 are commonly used by the SMB protocol, which has been known to be exploited by malware.
By following these principles, port filtering can be used to improve the security of a network and reduce the risk of cyberattacks.
A security professional creates different subnets for the various departments in their business, ensuring users have access that is appropriate for their particular roles. What does this scenario describe?
Network segmentation
This scenario describes network segmentation, which involves creating isolated subnets for different departments in an organization.
AI assistant
The scenario you described describes network segmentation.
Network segmentation is the process of dividing a network into smaller subnets. This can help to improve security and performance by isolating different parts of the network from each other.
In the scenario you described, the security professional is creating different subnets for the various departments in the business. This will ensure that users only have access to the resources they need for their job. For example, the marketing department may have its own subnet with access to marketing-related resources, such as the company website and CRM system. The accounting department may have its own subnet with access to accounting-related resources, such as the ERP system and financial data.
Network segmentation can also be used to isolate critical systems from the rest of the network. For example, the company’s servers may be placed on a dedicated subnet to protect them from unauthorized access.
Here are some of the benefits of network segmentation:
- Improved security: Network segmentation can help to improve security by isolating different parts of the network from each other. This can help to contain security breaches and prevent them from spreading throughout the entire network.
- Enhanced performance: Network segmentation can also help to improve performance by reducing traffic congestion. When different departments are on separate subnets, traffic is less likely to be congested, which can improve the performance of applications and services.
- Increased compliance: Network segmentation can also help organizations to comply with regulations. For example, organizations that are subject to PCI DSS compliance must segment their network to protect credit card data.
Overall, network segmentation is an important security practice that can help organizations to improve their security, performance, and compliance.
Data in restricted zones should have the same encryption standards as data in other zones.
False
Restricted zones on a network, which contain highly classified or confidential data, should have much higher encryption standards than data in other zones to make them more difficult to access.
AI assistant
False.
Data in restricted zones should have much higher encryption standards than data in other zones, which makes them more difficult to access.
Restricted zones are typically used to store sensitive data, such as financial data, customer data, and intellectual property. This data is more valuable to attackers, so it is important to protect it with the strongest possible encryption.
Common encryption standards include AES, DES, and RSA. AES is the most widely used encryption standard and is considered to be very secure. DES is an older encryption standard that is not as secure as AES, but it is still widely used in some applications. RSA is an encryption standard that is used for public key cryptography.
When choosing an encryption standard for restricted zones, it is important to consider the sensitivity of the data and the level of security that is required. For example, financial data may require a higher level of security than customer data.
Here are some tips for encrypting data in restricted zones:
- Use a strong encryption standard, such as AES.
- Use a strong encryption key.
- Store the encryption key in a secure location.
- Regularly rotate the encryption key.
- Monitor the encryption process for errors.
By following these tips, you can help to ensure that the data in your restricted zones is protected from unauthorized access.
Cloud hardening
Video: Network security in the cloud
Cloud networks are a collection of servers or computers that store resources and data in a remote data center that can be accessed via the internet. They can host company data and applications using cloud computing to provide on-demand storage, processing power, and data analytics.
Cloud servers require proper maintenance done through various security hardening procedures. Cloud service providers cannot prevent intrusions in the cloud, so organizations need to take their own security measures.
One distinction between cloud network hardening and traditional network hardening is the use of a server baseline image for all server instances stored in the cloud. This allows you to compare data in the cloud servers to the baseline image to make sure there haven’t been any unverified changes.
Similar to OS hardening, data and applications on a cloud network are kept separate depending on their service category. For example, older applications should be kept separate from newer applications, and software that deals with internal functions should be kept separate from front-end applications seen by users.
Even though the cloud service provider has a shared responsibility with the organization using their services, there are still security measures that need to be taken by the organization to make sure their cloud network is safe.
Network security in the cloud
Cloud computing has become increasingly popular in recent years, as it offers a number of benefits for businesses, such as scalability, flexibility, and cost savings. However, cloud computing also introduces new security challenges.
In a traditional on-premises network, the organization has complete control over the security of the network. However, in a cloud environment, the organization is sharing responsibility for security with the cloud service provider (CSP).
This means that the organization needs to take steps to secure their own data and applications in the cloud.
Here are some of the key areas of network security in the cloud:
- Identity and access management (IAM): IAM is the process of managing who has access to what resources in the cloud. This includes managing users, roles, and permissions.
- Data encryption: Data encryption is the process of scrambling data so that it cannot be read by unauthorized users. This is important for protecting sensitive data at rest and in transit.
- Network security: Network security is the process of protecting the network from unauthorized access, use, disclosure, disruption, modification, or destruction. This includes firewalls, intrusion detection and prevention systems (IDS/IPS), and web application firewalls (WAFs).
- Vulnerability management: Vulnerability management is the process of identifying, assessing, and remediating vulnerabilities in software and systems. This is important for keeping the cloud environment up to date with the latest security patches.
- Security monitoring: Security monitoring is the process of collecting and analyzing security logs and events for signs of suspicious activity. This can help to identify and respond to security incidents quickly.
- Incident response: Incident response is the process of dealing with a security incident. This includes containing the incident, investigating the cause, and remediating the damage.
By taking steps to secure their network in the cloud, organizations can help to protect their data and applications from unauthorized access, use, disclosure, disruption, modification, or destruction.
What services can cloud networking usually provide to their customers?
Host company data and applications
Cloud networks can host company data and applications using cloud computing to provide on-demand storage, processing power, and data analytics.
In recent years, many organizations
are using network services in the cloud. So in addition to securing
on-premises networks, a security analyst will need
to secure cloud networks. In a previous video, you learned that
a cloud network is a collection of servers or
computers that stores resources and data in a remote data center that
can be accessed via the internet. They can host company data and
applications using cloud computing to provide on-demand storage,
processing power, and data analytics. Just like regular web servers, cloud
servers also require proper maintenance done through various security
hardening procedures. Although cloud servers are hosted
by a cloud service provider, these providers cannot prevent
intrusions in the cloud—especially intrusions from
malicious actors, both internal and external to an organization. One distinction between
cloud network hardening and traditional network hardening is
the use of a server baseline image for all server instances stored in the cloud. This allows you to compare data in
the cloud servers to the baseline image to make sure there haven’t been
any unverified changes. An unverified change could come from
an intrusion in the cloud network. Similar to OS hardening, data and
applications on a cloud network are kept separate depending on
their service category. For example, older applications should be
kept separate from newer applications, and software that deals with internal
functions should be kept separate from front-end applications seen by users. Even though the cloud service provider
has a shared responsibility with the organization using their services,
there are still security measures that need to be taken by the organization to
make sure their cloud network is safe. Just like traditional networks, operations
in the cloud need to be secured. You’re doing great!
Meet you in the next video.
Video: Kelsey: Cloud security explained
Kelsey started her career in the tech industry in 1999. She believes that the tech industry is a great place to start a career because there are always new opportunities. She also believes that certifications are a great way to get started in the tech industry.
Kelsey believes that the cloud is a great way to learn new skills. She encourages people to use the cloud to experiment with new technologies and to learn new tools. She also believes that learning is a superpower that can help people get the jobs they want and define their own careers.
[MUSIC] I’m Kelsey, I’m a distinguished
engineer at Google Cloud. I work on compute platforms and
security related topics. When I was starting,
the only jobs I had previous, the only jobs I was confident were
accessible to me were fast food jobs. I wanted a career,
I wanted more than just a job. So when I zoomed out and asked myself,
what were my career options? I couldn’t think of a better place in
the year 1999 than going into the world of technologies. I mean, on the news people were lining
up for the latest operating system. All the tech people were
the new rock stars. And I remember flipping
through the opening jobs or the job openings in the classified
section, and it said anyone that has one of these certifications let
us know because we’re hiring. The delta between getting started and getting your first job into that
career that I always wanted, it was $35 away in a certification book. So let’s talk about Cloud. So before the time of Cloud,
most companies had their own data center. Imagine it’s just you alone in your house,
you can put anything wherever you want. You may choose to never lock the doors
on the inside, it’s just you. And for a long time in our industry, that’s the way people
ran their data centers. Now, we just call that private Cloud,
it’s just you there. But Cloud is public. And so the analogy would be,
imagine getting roommates, now you start to think
differently about your stuff. You start to lock things up even
while you’re inside of the house, and your security discipline is
going to be very different. As more and
more companies move into Cloud. You may just be the person who can help
one of those organizations finally make that leap because they have
a professional on their team. All right, so
you’ve gotten the certification, you’ve gotten the fundamental skills, how do you make sure that you can
actually use them in the Cloud? I’m going to let you in a little secret. Go use the Cloud. Go take existing software,
throw it in the Cloud, and find all the tools that poke and
prod at the thing you just got running and it’s going to tell you where you’re weak. Learn those tools, because those
are the tools that the professionals use. Learning is a superpower. It gives you the ability to not only get
that job that you’ve been looking at, but it also gives you the ability
to define the next one. [MUSIC]
Reading: Secure the cloud
Reading
Earlier in this course, you were introduced to cloud computing. Cloud computing is a model for allowing convenient and on-demand network access to a shared pool of configurable computing resources. These resources can be configured and released with minimal management effort or interaction with the service provider.
Just like any other IT infrastructure, a cloud infrastructure needs to be secured. This reading will address some main security considerations that are unique to the cloud and introduce you to the shared responsibility model used for security in the cloud. Many organizations that use cloud resources and infrastructure express concerns about the privacy of their data and resources. This concern is addressed through cryptography and other additional security measures, which will be discussed later in this course.
Cloud security considerations
Many organizations choose to use cloud services because of the ease of deployment, speed of deployment, cost savings, and scalability of these options. Cloud computing presents unique security challenges that cybersecurity analysts need to be aware of.
Identity access management
Identity access management (IAM) is a collection of processes and technologies that helps organizations manage digital identities in their environment. This service also authorizes how users can use different cloud resources. A common problem that organizations face when using the cloud is the loose configuration of cloud user roles. An improperly configured user role increases risk by allowing unauthorized users to have access to critical cloud operations.
Configuration
The number of available cloud services adds complexity to the network. Each service must be carefully configured to meet security and compliance requirements. This presents a particular challenge when organizations perform an initial migration into the cloud. When this change occurs on their network, they must ensure that every process moved into the cloud has been configured correctly. If network administrators and architects are not meticulous in correctly configuring the organization’s cloud services, they could leave the network open to compromise. Misconfigured cloud services are a common source of cloud security issues.
Attack surface
Cloud service providers (CSPs) offer numerous applications and services for organizations at a low cost.
Every service or application on a network carries its own set of risks and vulnerabilities and increases an organization’s overall attack surface. An increased attack surface must be compensated for with increased security measures.
Cloud networks that utilize many services introduce lots of entry points into an organization’s network. However, if the network is designed correctly, utilizing several services does not introduce more entry points into an organization’s network design. These entry points can be used to introduce malware onto the network and pose other security vulnerabilities. It is important to note that CSPs often defer to more secure options, and have undergone more scrutiny than a traditional on-premises network.
Zero-day attacks
Zero-day attacks are an important security consideration for organizations using cloud or traditional on-premise network solutions. A zero day attack is an exploit that was previously unknown. CSPs are more likely to know about a zero day attack occurring before a traditional IT organization does. CSPs have ways of patching hypervisors and migrating workloads to other virtual machines. These methods ensure the customers are not impacted by the attack. There are also several tools available for patching at the operating system level that organizations can use.
Visibility and tracking
Network administrators have access to every data packet crossing the network with both on-premise and cloud networks. They can sniff and inspect data packets to learn about network performance or to check for possible threats and attacks.
This kind of visibility is also offered in the cloud through flow logs and tools, such as packet mirroring. CSPs take responsibility for security in the cloud, but they do not allow the organizations that use their infrastructure to monitor traffic on the CSP’s servers. Many CSPs offer strong security measures to protect their infrastructure. Still, this situation might be a concern for organizations that are accustomed to having full access to their network and operations. CSPs pay for third-party audits to verify how secure a cloud network is and identify potential vulnerabilities. The audits can help organizations identify whether any vulnerabilities originate from on-premise infrastructure and if there are any compliance lapses from their CSP.
Things change fast in the cloud
CSPs are large organizations that work hard to stay up-to-date with technology advancements. For organizations that are used to being in control of any adjustments made to their network, this can be a potential challenge to keep up with. Cloud service updates can affect security considerations for the organizations using them. For example, connection configurations might need to be changed based on the CSP’s updates.
Organizations that use CSPs usually have to update their IT processes. It is possible for organizations to continue following established best practices for changes, configurations, and other security considerations. However, an organization might have to adopt a different approach in a way that aligns with changes made by the CSP.
Cloud networking offers various options that might appear attractive to a small company—options that they could never afford to build on their own premises. However, it is important to consider that each service adds complexity to the security profile of the organization, and they will need security personnel to monitor all of the cloud services.
Shared responsibility model
A commonly accepted cloud security principle is the shared responsibility model. The shared responsibility model states that the CSP must take responsibility for security involving the cloud infrastructure, including physical data centers, hypervisors, and host operating systems. The company using the cloud service is responsible for the assets and processes that they store or operate in the cloud.
The shared responsibility model ensures that both the CSP and the users agree about where their responsibility for security begins and ends. A problem occurs when organizations assume that the CSP is taking care of security that they have not taken responsibility for. One example of this is cloud applications and configurations. The CSP takes responsibility for securing the cloud, but it is the organization’s responsibility to ensure that services are configured properly according to the security requirements of their organization.
Key takeaways
It is essential to know the security considerations that are unique to the cloud and understanding the shared responsibility model for cloud security. Organizations are responsible for correctly configuring and maintaining best security practices for their cloud services. The shared responsibility model ensures that both the CSP and users agree about what the organization is responsible for and what the CSP is responsible for when securing the cloud infrastructure.
Reading: Cryptography and cloud security
Reading
Earlier in this course, you were introduced to the concepts of the shared responsibility model and identity and access management (IAM). Similar to on-premise networks, cloud networks also need to be secured through a mixture of security hardening practices and cryptography.
This reading will address common cloud security hardening practices, what to consider when implementing cloud security measures, and the fundamentals of cryptography. Since cloud infrastructure is becoming increasingly common, it’s important to understand how cloud networks operate and how to secure them.
Cloud security hardening
There are various techniques and tools that can be used to secure cloud network infrastructure and resources. Some common cloud security hardening techniques include incorporating IAM, hypervisors, baselining, cryptography, and cryptographic erasure.
Identity access management (IAM)
Identity access management (IAM) is a collection of processes and technologies that helps organizations manage digital identities in their environment. This service also authorizes how users can leverage different cloud resources.
Hypervisors
A hypervisor abstracts the host’s hardware from the operating software environment. There are two types of hypervisors. Type one hypervisors run on the hardware of the host computer. An example of a type one hypervisor is VMware®’s EXSi. Type two hypervisors operate on the software of the host computer. An example of a type two hypervisor is VirtualBox. Cloud service providers (CSPs) commonly use type one hypervisors. CSPs are responsible for managing the hypervisor and other virtualization components. The CSP ensures that cloud resources and cloud environments are available, and it provides regular patches and updates. Vulnerabilities in hypervisors or misconfigurations can lead to virtual machine escapes (VM escapes). A VM escape is an exploit where a malicious actor gains access to the primary hypervisor, potentially the host computer and other VMs. As a CSP customer, you will rarely deal with hypervisors directly.
Baselining
Baselining for cloud networks and operations cover how the cloud environment is configured and set up. A baseline is a fixed reference point. This reference point can be used to compare changes made to a cloud environment. Proper configuration and setup can greatly improve the security and performance of a cloud environment. Examples of establishing a baseline in a cloud environment include: restricting access to the admin portal of the cloud environment, enabling password management, enabling file encryption, and enabling threat detection services for SQL databases.
Cryptography in the cloud
Cryptography can be applied to secure data that is processed and stored in a cloud environment. Cryptography uses encryption and secure key management systems to provide data integrity and confidentiality. Cryptographic encryption is one of the key ways to secure sensitive data and information in the cloud.
Encryption is the process of scrambling information into ciphertext, which is not readable to anyone without the encryption key. Encryption primarily originated from manually encoding messages and information using an algorithm to convert any given letter or number to a new value. Modern encryption relies on the secrecy of a key, rather than the secrecy of an algorithm. Cryptography is an important tool that helps secure cloud networks and data at rest to prevent unauthorized access. You’ll learn more about cryptography in-depth in an upcoming course.
Cryptographic erasure
Cryptographic erasure is a method of erasing the encryption key for the encrypted data. When destroying data in the cloud, more traditional methods of data destruction are not as effective. Crypto-shredding is a newer technique where the cryptographic keys used for decrypting the data are destroyed. This makes the data undecipherable and prevents anyone from decrypting the data. When crypto-shredding, all copies of the key need to be destroyed so no one has any opportunity to access the data in the future.
Key Management
Modern encryption relies on keeping the encryption keys secure. Below are the measures you can take to further protect your data when using cloud applications:
- Trusted platform module (TPM). TPM is a computer chip that can securely store passwords, certificates, and encryption keys.
- Cloud hardware security module (CloudHSM). CloudHSM is a computing device that provides secure storage for cryptographic keys and processes cryptographic operations, such as encryption and decryption.
Organizations and customers do not have access to the cloud service provider (CSP) directly, but they can request audits and security reports by contacting the CSP. Customers typically do not have access to the specific encryption keys that CSPs use to encrypt the customers’ data. However, almost all CSPs allow customers to provide their own encryption keys, depending on the service the customer is accessing. In turn, the customer is responsible for their encryption keys and ensuring the keys remain confidential. The CSP is limited in how they can help the customer if the customer’s keys are compromised or destroyed. One key benefit of the shared responsibility model is that the customer is not entirely responsible for maintenance of the cryptographic infrastructure. Organizations can assess and monitor the risk involved with allowing the CSP to manage the infrastructure by reviewing a CSPs audit and security controls. For federal contractors, FEDRAMP provides a list of verified CSPs.
Key takeaways
Cloud security hardening is a critical component to consider when assessing the security of various public cloud environments and improving the security within your organization. Identity access management (IAM), correctly configuring a baseline for the cloud environment, securing hypervisors, cryptography, and cryptographic erasure are all methods to use to further secure cloud infrastructure.
Practice Quiz: Test your knowledge: Cloud hardening
Fill in the blank: A key distinction between cloud and traditional network hardening is the use of a server baseline image, which enables security analysts to prevent _ by comparing data in cloud servers to the baseline image.
unverified changes
A key distinction between cloud and traditional network hardening is the use of a server baseline image, which enables security analysts to prevent unverified changes by comparing data in cloud servers to the baseline image.
Data and applications on cloud networks do not need to be separated based on their service category, such as their age or internal functionality.
False
Similar to OS hardening, data and applications on a cloud network should be kept separate depending on their service category. For example, older applications should be kept separate from new applications. And software that deals with internal functions should be kept separate from front-end applications seen by users.
Who is responsible for ensuring the safety of cloud networks? Select all that apply.
Cloud service provider, Security team
Both the organization’s security team and its cloud service provider are responsible for ensuring the safety of cloud networks.
Fill in the blank: _ cloud services are a common source of cloud security issues. 1 point Misconfigured Unauthorized Shared Managed
Misconfigured
Misconfigured cloud services are a common source of cloud security issues.
Review: Security hardening
Video: Wrap-up
Security hardening is the process of strengthening systems and networks to reduce the likelihood of an attack. It is important for organizations to harden their infrastructure because it can help to prevent attackers from gaining access to sensitive data.
OS hardening is the process of securing operating systems by applying patch updates, using baseline configurations, and properly disposing of hardware and software. Network hardening is the process of securing networks by implementing network log analysis, maintaining firewall rules, and using intrusion detection and prevention systems (IDS/IPS). Cloud network hardening is the process of securing cloud networks by using shared responsibility models, virtual private clouds (VPCs), and cloud access security brokers (CASBs).
Security analysts are responsible for working with operating systems, on-premise networks, and cloud networks. They use their knowledge of security hardening to help organizations protect their infrastructure from attack.
Great work on learning
about security hardening! Let’s take a few minutes to
wrap up what you’ve learned. You learned about
security hardening and its importance to an
organization’s infrastructure. First, we discussed how security hardening
strengthens systems and networks to reduce the
likelihood of an attack. Next, we covered the
importance of OS hardening, including patch updates,
baseline configurations, and hardware and
software disposal. Then we explored network
hardening practices, such as network log analysis and
firewall rule maintenance. Finally, we examined cloud network hardening and
the responsibilities of both organizations and cloud service providers
in maintaining security. As a security analyst, you’ll be working with
operating systems, on-premise networks,
and cloud networks. You’ll be using all the
knowledge that we learned in this section in your career
as a security analyst.
Reading: Glossary terms from module 4
Terms and definitions from Course 3, Module 4
Baseline configuration (baseline image): A documented set of specifications within a system that is used as a basis for future builds, releases, and updates
Hardware: The physical components of a computer
Multi-factor authentication (MFA): A security measure which requires a user to verify their identity in two or more ways to access a system or network
Network log analysis: The process of examining network logs to identify events of interest
Operating system (OS): The interface between computer hardware and the user
Patch update: A software and operating system update that addresses security vulnerabilities within a program or product
Penetration testing (pen test): A simulated attack that helps identify vulnerabilities in systems, networks, websites, applications, and processes
Security hardening: The process of strengthening a system to reduce its vulnerabilities and attack surface
Security information and event management (SIEM): An application that collects and analyzes log data to monitor critical activities for an organization
World-writable file: A file that can be altered by anyone in the world
Quiz: Module 4 challenge
What are the purposes of performing a patch update for security hardening? Select all that apply.
- Upgrading an operating system to the latest software version.
- Fixing known security vulnerabilities in a network or services.
AI assistant
The correct answers are:
- Fixing known security vulnerabilities in a network or services.
- Upgrading an operating system to the latest software version.
Patch updates are released by software vendors to address known security vulnerabilities in their products. By applying patch updates, organizations can help to protect their systems from attack.
Requiring a user to verify their identity to access a system or network is a form of authentication. Authentication is important for preventing unauthorized access to systems and data. However, it is not a purpose of performing a patch update.
Preventing malicious actors from flooding a network is a form of denial-of-service (DoS) protection. DoS protection is important for preventing attackers from disrupting the availability of systems and services. However, it is not a purpose of performing a patch update.
What is the term for all the potential system vulnerabilities that a threat actor could exploit?
Attack surface
Fill in the blank: Requiring employees to turn off their personal devices while in secure areas is an example of a _ security hardening practice.
physical
A company’s executive team approves a proposal by the security director. The proposal involves security professionals simulating an attack on the company’s systems in order to identify vulnerabilities. What does this scenario describe?
Penetration testing
What are some methods for hardening operating systems? Select three answers.
- Keeping an up-to-date list of authorized users.
- Configuring a device setting to fit a secure encryption standard
- Removing unused software to limit unnecessary vulnerabilities
Which OS hardening practice involves a security analyst comparing the current configuration to existing documentation about the OS?
Checking baseline configuration
Multi-factor authentication (MFA) is an example of which type of hardening practice?
OS hardening
Which of the following statements accurately describes port filtering?
A firewall function that blocks or allows certain port numbers in order to limit unwanted network traffic
A security team considers the best way to handle the different security zones within their network. They prioritize protecting the restricted zone by separating from the rest of the network and ensuring it has much higher encryption standards. What does this scenario describe?
Network segmentation
Fill in the blank: A __ is a collection of servers or computers that stores resources and data in remote data centers that can be accessed via the internet
cloud network
Quiz: Portfolio Activity: Use the NIST Cybersecurity Framework to respond to a security incident
Reading: Portfolio Activity Exemplar: Use the NIST Cybersecurity Framework to respond to a security incident
Reading
Completed Exemplar
To review the exemplar for this course item, click the following link:
Link to exemplar:
Assessment of Exemplar
Compare the exemplar to your completed incident report analysis and incident report. Review your work using each of the criteria in the exemplar. What did you do well? Where can you improve? Use your answers to these questions to guide you as you continue to progress through the program.
Note: The exemplar represents one example of how to complete the activity. Yours may differ in certain ways. What’s important is that you have an idea of what your incident analysis should resemble.
The exemplar is accompanied by the activity, and presents a complete incident report analysis to establish:
- What type of attack occurred, the scope of the incident, and its impact to the organization
- Potential network vulnerabilities and protection measures
- Detection tools to monitor and secure the network
- How to respond to cybersecurity incidents in the future
- Recovery plans to restore normal operations
Congratulations on completing Course 3!
Video: Course wrap-up
This course covered the basics of network security, including network architecture, network operations, and security hardening. Students learned about the structure of a network, how network protocols determine data transmission, and common security threats such as denial of service attacks, packet sniffing, and IP spoofing. They also learned about security hardening techniques used to reduce the attack area of a network. The course concluded with a discussion of the importance of network security for security analysts.
Wow, we have covered a lot in this course! Let’s review everything we’ve discussed. You learned about networks, network
architecture, and the best practices used by security professionals to secure
a network against security breaches. As we bring this course to a close, let’s review what you’ve learned
about security networks so far. First, we explored
the structure of a network. A security analyst must understand how
a network is designed to be able to identify parts of a network that present
vulnerabilities and need to be secured. Next, we learned about
network operations and how they affect the communication of data. Network protocols determine how the data
is transmitted over the network. As communication takes place over the
network, malicious actors may use tactics such as denial of service attacks,
packet sniffing, and IP spoofing. Security analysts employ tools and measures such as firewall rules
to protect against these attacks. We also discussed security hardening. Security hardening is used to reduce
the attack area of a network. This means the attack does not
disable an entire network. Security hardening can be done at
the hardware level, the software level, or the network level. Securing networks is an essential
part of a security analyst’s duties. Knowledge of a network and its operations
and security practices will ensure that you are successful in your
career as a security analyst. And that brings us to
the topic of our next course, which will cover computing basics for
security analysts. In that course, you’ll learn how to use
the Linux command line to authenticate and authorize users on the network, and
to use S-Q-L, otherwise known as SQL,
to communicate with databases. Great work getting here! All of the concepts you’ve learned in
this section will be essential for success in your role as security analyst. Now you can move on to the next course.
Enjoy!
Reading: Course 3 glossary
Reading
Reading: Get started on the next course
Reading
Congratulations on completing Course 3 of the Google Cybersecurity Certificate: Connect and Protect: Networks and Network Security! In this part of the program, you learned about the structure of networks and how to identify network vulnerabilities. You also explored network operations and how they affect the communication of data. Next, you discovered some common types of network attacks, their consequences on an organization, and ways to protect networks against attacks. Lastly, you learned how to reduce the attack surface of a network by applying various protective measures on a network.
The Google Cybersecurity Certificate has eight courses:
- Foundations of Cybersecurity — Explore the cybersecurity profession, including significant events that led to the development of the cybersecurity field and its continued importance to organizational operations. Learn about entry-level cybersecurity roles and responsibilities.
- Play It Safe: Manage Security Risks — Identify how cybersecurity professionals use frameworks and controls to protect business operations, and explore common cybersecurity tools.
- Connect and Protect: Networks and Network Security — Gain an understanding of network-level vulnerabilities and how to secure networks. (This is the course you just completed. Well done!)
- Tools of the Trade: Linux and SQL — Explore foundational computing skills, including communicating with the Linux operating system through the command line and querying databases with SQL.
- Assets, Threats, and Vulnerabilities — Learn about the importance of security controls and developing a threat actor mindset to protect and defend an organization’s assets from various threats, risks, and vulnerabilities.
- Sound the Alarm: Detection and Response — Understand the incident response lifecycle and practice using tools to detect and respond to cybersecurity incidents.
- Automate Cybersecurity Tasks with Python — Explore the Python programming language and write code to automate cybersecurity tasks.
- Put It to Work: Prepare for Cybersecurity Jobs — Learn about incident classification, escalation, and ways to communicate with stakeholders. This course closes out the program with tips on how to engage with the cybersecurity community and prepare for your job search.
Now that you have completed this course, you’re ready to move on to the next course: Tools of the Trade: Linux and SQL.
Keep up the great work!