Hardening Techniques

Patching and firmware management

Let's run through a little scenario here. I have a server right here, and let's say that server is running Microsoft Windows Server. Microsoft releases a new feature, and that feature gets installed onto this machine, giving it some additional functionality. But with that additional functionality, it opened up a security hole, something that can be hacked by others. And so now that machine is unprotected. There is a way for somebody to get in and leverage that machine. So now what happens is that Microsoft will work really quickly on figuring out how can we patch this machine, and release a patch or an update that can happen on that machine.

So this can happen at the OS level. It can happen at the firmware or BIOS level on this machine. It can happen at the software level. It can happen on many different levels of this machine. So we're going to want to make sure that the firmware is updated on the hardware. We're going to want to make sure that the OS gets its updates. We're going to want to make sure that if there is any kind of third-party other software that's running on this machine, that that gets updated as well.

So we're going to want to make sure to go through on a regular basis, at least monthly, to go through and update this. And there's potential where something comes out that is really important to get updated right away, and so then they'll come out with a patch and you'll want to go in and patch those right away.

And that happens on every single piece of equipment. So as I mentioned, you have the hardware, you have the OS, and then you have any programs that are operating on top of that. And you might have multiple programs that you need to update on this one server. You have your client machines, and they have their own software, they have their own firmware, they have their own operating systems. You have the switches on your network. You have the routers that are on your network. You have a firewall that's on your network. So you have all of this equipment that's running on your network that needs to be patched and updated.

And there's patching and updating software that's out there as well. So you can go and get patching and updating software that will help manage some of the patching and updating of this equipment. But whatever the case may be, this is a huge part of patching and updating your equipment, making your equipment secure.

I will also mention, even out of the box, when you take things out of the box, usually what's happened is that's been manufactured somewhere, the firmware has been put onto that piece of equipment, it's been packaged into a box, and it sits in a warehouse for a while. So by the time you unpack something like a switch, you may think that it's updated and patched, but in fact it does need to go through its patching. Even right out of the box, you're going to need to install the patches and updates on those machines. Same thing even with your desktops and your laptops: those are going to be outdated by the time you actually get it in your hand, and you're going to need to make sure that you go through those updating and patching.

Changing the default passwords

A big security hole is default passwords. Let's say you get a switch and it may come with a default username and password, and so when you get onto that switch, you'll use that username and password to get onto that switch. Now, many devices like your OSs will have you set up a username and password when you start configuring it, but there are many devices that just work straight out of the box and either don't require a username and password or have this default username and password.

If you leave it on there, then anyone on the network can figure out what kind of model, what kind of brand it is of switch that they're plugged into, or hardware that they're plugged into, or whatever is on the network, and then be able to do a simple Google search to find out what the default username and password is for there, and then get onto that machine. So make sure you change those default passwords. Make sure you get rid of the default username and password and create your own on any of your equipment on your network.

Managing services

Another thing that happens is when you set up a Microsoft server, it assumes that there's already some services that you're going to want to have set up on that machine, so that way you can take it out of the box and start working with it right away. Same thing with switches. If you were to unpack a switch and start plugging equipment into it, but when you plug that equipment into it the switch doesn't work right away, you're going to assume that the switch is broken, package it back up, and send it back to the manufacturer. The manufacturer obviously doesn't want you to do that. So switches come with some stuff already preconfigured, with some services running, and it will do some, like for instance with Cisco, it'll do some Cisco Discovery Protocol, and it will do things on your network that you may not necessarily want.

If you're not using them and it's not adding value, then it is a risk. It's actually a risk either way, but if it adds a certain amount of value, maybe you're willing to take that risk. But if you don't want to take that risk, you need to get onto that equipment and start turning off unneeded services. So when you set up equipment, figure out what services are running on it. Figure out what it is that you could or should turn off, and start turning off those services.

Now, some of this equipment, like some of the Cisco equipment, some of the Microsoft equipment, you can actually run some programs on it to go through and harden the piece of equipment. It will analyze what you're using and what you're not using, and then turn off unneeded services on those devices.

Turning off unused switch ports

Another thing is your equipment will come with probably the switch ports on it already up and running, which means that you can plug devices into it and the device will come up right away. It just makes the most sense because, once again, if it didn't work then you would question what's wrong with this switch. And so one thing you may want to do is go off and turn off any unused switch ports.

This is especially important. Let's say you have jacks all throughout your building, and whether they're being used or not, they come back to your switch. Now anybody can plug in a rogue switch that's out there, or a rogue DHCP server, or rogue access point. They can plug this into your network and it exposes the rest of your network to this. So what you can do is you can go onto this switch and start turning off any of these ports that are not currently being used.

Now, the disadvantage to that is if somebody does have a legitimate reason and plugs in a laptop to this port, it's not going to function, it's not going to work. But it's one way that we can turn off security, and then they have to contact IT and ask for the switch port to be turned on before they can use it. So that is one way you can harden these devices, is by turning off unused switch ports, so that way no one can plug in any rogue equipment.

Control plane policing

Now, I'm not going to get real in depth into control plane policing, but I'm going to briefly mention what it is and briefly explain it. The devices on your network have several layers within the device of how it functions, and so one of those layers is the control plane, and it does the controlling or the forwarding or the directing of traffic. But what we can do is we can set up policing on there in order to start analyzing that traffic and start controlling that traffic. And where this can help out is with things like denial of service attacks. You can identify traffic that shouldn't be on that network and start controlling that. So this is control plane policing, and it's a way to start mitigating some of the issues like denial of service attacks.