Chapter 4: OS Hardening and Virtualization

Question 1

Concept of Least Functionality

Answer 1

• Restrict and remove any functionality not required for operation
  - NIST CM-7 control procedures
  - Target features
  > Applications
  > Ports
  > Services (daemons)
  - Consider backwards compatibility when removing obsolete applications
  - SCCM (System Center Configuration Manager) for multiple machines
  - Application blacklisting / whitelisting

Question 2

Patch Management

Answer 2

• Process of planning, testing, implementing and auditing patches
  > Planning : Deciding which patches are required
  Checking Compatibility
  Plan how the patch will be tested / deployed
  > Testing : Test the patch on one machine / small system
  > Implement : Patch deployment to all machines
  Use SCCM or other centralized management system
  > Auditing : Confirm patch is live on system
  Check for any failures or changes due to the patch

Question 3

Hardening File Systems and Hard Drives

Answer 3

a) Use a secure file system
> NTFS for Windows, allows encryption, ACLs, logging
Use chkdsk and convert commands
> ext4 for Linux
Use fdisk –l or df –T
b) Hide important files (System files, personal etc)
c) Manage hard drives
> Delete temp files
> Periodically verify system files integrity
> Defrag hard drives
> Backup data
> Restore points
> Whole disk encryption
> Separate OS system and personal data

Question 4

Virtualization

Answer 4

VM(Virtual Machines) and VDE(Virtual Desktop Environment)

Question 5

VM Categories

Answer 5

1. System virtual machine : Runs an entire OS

2. Process virtual machine : Runs a single application (browser)

Question 6

Other forms of virtualization

Answer 6

> VPN (Virtual Private Network)
> VDI (Virtual Desktop Infrastructure)
> VLAN (Virtual Local Area Network)

Question 7

Hypervisor

Answer 7

(Virtual Machine Manager)

- Allows multiple virtual OS to run concurrently

Question 8

Type 1 vs Type 2 Hypervisor

Answer 8

• Type 1 - Native
  > Runs directly on host hardware
  > Flexible and efficient
  > Strict hardware/software restrictions, less common
  - Type 2 – Hosted
  > One level removed from host hardware
  > More available to most OS and hardware
  > Resource intensive

Question 9

Application Containerization

Answer 9

• Runs distributed applications w/o running an entire VM

- Efficient but less secure

Question 10

Securing Virtual Machines

Answer 10

Generally equivalent to securing regular OS, but with little more work
1. Update virtual machine software (e.g. VirtualBox)
2. Be wary of VM-VM and VM-host network connections
3. Protect NAS and SAN from virtual hosts
4. Disable unnecessary USB and external ports on VMs
5. Alter boot priority for virtual BIOS
6. Limit and monitor VM resource usage to prevent DOS attacks
7. Protect raw virtual machine image
> Snapshots, Encryption, Access permission and signatures

Question 11

Virtualization Sprawl

Answer 11

When there are too many VMs to manage at once

> Employ a VMLM (Virtual Machine Lifecycle Management) tool