3.2 Host or Application Security Solutions Flashcards
- The user’s access - Applications and data
- Stop the attackers - Inbound attacks, outbound attacks
- Many different platforms - Mobile, desktop
- Protection is multi-faceted - Defense in depth
The endpoint
• Anti-virus is the popular term
– Refers specifically to a type of malware
– Trojans, worms, macro viruses
• Malware refers to the broad malicious
software category
– Anti-malware stops spyware, ransomware,
fileless malware
• The terms are effectively the same these days
– The names are more of a marketing tool
– Anti-virus software is also anti-malware software now
– Make sure your system is using
– a comprehensive solution
Anti-virus and anti-malware
• A different method of threat protection
– Scale to meet the increasing number of threats
• Detect a threat
– Signatures aren’t the only detection tool
– Behavioral analysis, machine learning,
process monitoring
– Lightweight agent on the endpoint
• Investigate the threat
– Root cause analysis
• Respond to the threat
– Isolate the system, quarantine the threat, rollback
to a previous config
– API driven, no user or technician intervention required
Endpoint detection and response (EDR)
• Where’s your data?
– Social Security numbers, credit card numbers,
medical records
• Stop the data before the attacker gets it
– Data “leakage”
• So many sources, so many destinations
– Often requires multiple solutions
– Endpoint clients
– Cloud-based systems
– Email, cloud storage, collaboration tools
Data Loss Prevention (DLP)
• The OSI Application Layer - All data in every packet
• Can be called different names
– Application layer gateway
– Stateful multilayer inspection, deep packet inspection
• Broad security controls
– Allow or disallow application features
– Identify attacks and malware
– Examine encrypted data
– Prevent access to URLs or URL categories
Next-generation firewall (NGFW)
• Software-based firewall – Personal firewall, runs on every endpoint • Allow or disallow incoming or outgoing application traffic – Control by application process – View all data • Identify and block unknown processes – Stop malware before it can start • Manage centrally
Host-based firewall
• Host-based Intrusion Detection System (HIDS)
– Uses log files to identify intrusions
– Can reconfigure firewalls to block
• Host-based Intrusion Prevention System (HIPS)
– Recognize and block known attacks
– Secure OS and application configs, validate
incoming service requests
– Often built into endpoint protection software
• HIPS identification
– Signatures, heuristics, behavioral
– Buffer overflows, registry updates, writing files
to the Windows folder
– Access to non-encrypted data
Finding intrusions
• Security is based on trust – Is your data safely encrypted? – Is this web site legitimate? – Has the operating system been infected? • The trust has to start somewhere – Trusted Platform Module (TPM), – Hardware Security Module (HSM) – Designed to be the hardware root of the trust • Difficult to change or avoid – It’s hardware – Won’t work without the hardware
Hardware root of trust
• A specification for cryptographic functions
– Hardware to help with encryption functions
• Cryptographic processor
– Random number generator, key generators
• Persistent memory
– Comes with unique keys burned in during production
• Versatile memory
– Storage keys, hardware configuration information
• Password protected
– No dictionary attacks
Trusted Platform Module (TPM)
• The attack on our systems is constant
– Techniques are constantly changing
• Attackers compromise a device
– And want it to stay compromised
• The boot process is a perfect infection point
– Rootkits run in kernel mode
– Have the same rights as the operating system
• Protecting the boot process is important
– Secure boot, trusted boot, and measured boot
– A chain of trust
Boot integrity
• Secure Boot
– Part of the UEFI specification
• UEFI BIOS protections
– BIOS includes the manufacturer’s public key
– Digital signature is checked during a BIOS update
– BIOS prevents unauthorized writes to the flash
• Secure Boot verifies the bootloader
– Checks the bootloader’s digital signature
– Bootloader must be signed with a trusted certificate
– Or a manually approved digital signature
UEFI BIOS Secure Boot
• Bootloader verifies digital signature of the OS kernel
– A corrupted kernel will halt the boot process
• The kernel verifies all of the other startup components
– Boot drivers, startup files
• Just before loading the drivers,
– ELAM (Early Launch Anti-Malware) starts
– Checks every driver to see if it’s trusted
– Windows won’t load an untrusted driver
Trusted Boot
• Nothing on this computer has changed
– There have been no malware infections
– How do you know?
• Easy when it’s just your computer
– More difficult when there are 1,000
• UEFI stores a hash of the firmware, boot drivers, and
everything else loaded during the Secure Boot and
– Trusted Boot process
– Stored in the TPM
• Remote attestation
– Device provides an operational report to a
verification server
– Encrypted and digitally signed with the TPM
• Attestation server receives the boot report
– Changes are identified and managed
Measured Boot
• Protecting stored data – And the transmission of that data • Intellectual property storage – Data is valuable • Compliance issues – PCI DSS, HIPAA, GDPR, etc. • Keep the business running – Security provides continuity • Breaches are expensive - Keep costs low
Database security
• Replace sensitive data with a non-sensitive placeholder – SSN 266-12-1112 is now 691-61-8539 • Common with credit card processing – Use a temporary token during payment – An attacker capturing the card numbers can’t use them later • This isn’t encryption or hashing – The original data and token aren’t mathematically related – No encryption overhead
Tokenization
- Static Application Security Testing (SAST)
- Help to identify security flaws
- Many security vulnerabilities found easily
- Buffer overflows, database injections, etc.
- Not everything can be identified through analysis
- Authentication security, insecure cryptography, etc.
- Don’t rely on automation for everything
- Still have to verify each finding
- False positives are an issue
Static code analyzers
