Chapter - 20 - Hardening

Question 1

What are few ways to perform system hardening?

Answer 1

1. Changing default configurations - i.e. changing default username/passwords.
2. Creating a secure base of systems
3. Closing unneeded ports
4. Removing unneeded applications and services
5. Creating a allow-list of applications that we can install on our system.

Question 2

How can we open Services utility on a Windows system?

Answer 2

By running services.msc

Question 3

What command can we use to stop a service in Linux?

Answer 3

sc stop wuauserv ### or

net stop wuauserv

Question 4

What are Trusted Operating system?

Answer 4

These are the operating systems that have a implementation of very strict or secure access control policies. For example - such OS is SELinux that implement access policies using MAC(Mandatory Access Control).

Question 5

What metric do we use to rate Trusted Operating systems?

Answer 5

EAL value - EAL stands for Evaluation Assurance level. It goes from 1 to 7

Most Linux and windows operating system user EAL4 or plus.

Question 6

Give me an example of an element of Trusted operating system in Android Devices.

Answer 6

Use of Sandboxing.

Question 7

What is Patch Management?

Answer 7

It is the process of planning, testing, implementing and auditing software patches.

Patches can be deployed in rings - Ring1, Ring2, Ring3

Question 8

Give me an example of patch management software that we can use in Windows environment.

Answer 8

Microsoft Endpoint Configuration Manager

Question 9

What are group policies?

Answer 9

Group policies are the set of rules and policies/configurations that we can deploy on a system or to a group of system or users, usually from a central point (such as Active Directory).

To access group policy tool in Windows Operating System, we can gpedit tool.

Example of few group policies -
Password requirements
Account lockout policies
Software Restriction
etc

Question 10

What is SELinux?

Answer 10

SELinux is a trusted Operating system and it uses MAC to implement access control policies on the OS.

SElinux is used to enforce MAC on processes and resources and enable information to be classified and protected

SElinux defines 3 main contexts for each file and process:
- user
- Role
- Type - It groups objects together that have similar security requirements or characteristics.
- Level - It is used to describe the sensitivity level of a file, directory or process.

Question 11

What are 3 different modes that we can run SElinux mode in?

Answer 11

1. Disabled mode
2. Enforcing mode
3. Permissive mode

Question 12

What are different data encryption levels?

Answer 12

1. Full Encryption
2. Partition Encryption
3. Volume Encryption
4. Database Encryption
5. Record Encryption
6. File Encryption