In this lesson,
we will learn about attack surface management.
Attack surface management involves identifying, reducing,
and continuously monitoring all potential paths
of attack into a systems architecture.
This minimizes the exposure to security threats.
Let's quickly discuss a few concepts
that relate directly to attack surface management.
First, we have hardening.
Hardening is the process of securing systems
by reducing their attack surface,
in part, by disabling unnecessary services
and applying up-to-date security patches.
Next, defense-in-depth implements multiple security controls
such as firewalls, intrusion detection systems,
and access controls
to provide redundant protections against attacks.
Then vulnerability management can be used to regularly scan
and address network and asset security weaknesses,
including those in legacy components
that may no longer receive updates,
but are still a critical part
of the enterprise architecture.
Let's learn more about hardening, defense-in-depth,
vulnerability management, and legacy components.
Then we will conduct a device hardening demonstration.
First, we have device hardening.
Device hardening is the process of securing a system
by reducing its attack surface.
Hardening involves running only essential services,
applying regular patches
and tightening system configurations.
This applies not only to servers, but also to endpoints,
mobile devices and network infrastructure.
Hardening involves actions
such as disabling unused services and ports,
ensuring that critical security software
like antivirus, host-based firewalls
and log collection agents are installed
and using encryption for data protection.
For example, if you are managing a Linux server
that isn't using printing services,
you should disable the Common UNIX Printing System
or CUPS Daemon to minimize the attack surface.
Other hardening steps include:
removing unnecessary applications,
renaming default accounts,
and applying group policies
to enforce strict security settings.
Additionally, modern hardware features
such as the Unified Extensible Firmware Interface or UEFI,
Trusted Platform Module or TPM,
and Hardware Security Module or HSM
contribute to stronger device security
by offering secure boot processes
and cryptographic functions.
The goal is to balance usability with security
by only enabling the minimum number of
and features required for operation.
Second, we have defense-in-depth.
defense-in-depth refers to a layered approach to security
where multiple security measures work together
to protect a system.
This strategy ensures
that if one defense mechanism is compromised,
others remain in place to protect the system.
For example, an organization may use a combination
of firewalls, intrusion detection systems or IDSs,
endpoint protection software
and data encryption to safeguard its network.
In this example, multiple layers of security can be applied
to protect an organization's systems,
each focusing on a specific type of threat.
The first layer is a firewall.
Firewalls prevent unauthorized external access
by filtering incoming
or outgoing network traffic
based on established security rules.
Firewalls can block malicious traffic
while allowing legitimate communications.
The second layer is an intrusion detection system, or IDS.
An IDS monitors network activity for unusual behavior,
alerting administrators to potential threats
that may bypass the firewall.
Next, encryption of data in transit adds protection
by securing data as it moves across the network,
ensuring that even if intercepted,
it cannot be read without the proper decryption keys.
The fourth layer is endpoint detection software,
such as antivirus and anti-malware tools,
which protect individual devices from threats like malware
that could enter the network through other means.
Finally, encryption of data at rest
secures sensitive information stored within systems,
making it inaccessible to unauthorized users even
if the data is compromised.
Additionally, a good defense-in-depth approach
also includes physical security,
such as securing server rooms.
Each layer of security compliments the others,
together creating a more resilient security posture.
Third, we have a vulnerability management.
Vulnerability management is the process of identifying,
prioritizing, and addressing security vulnerabilities
within a system.
This involves regularly scanning systems
with tools like Nessus or the Center
for Internet Securities Configuration Assessment Tool
to detach potential weaknesses
and ensure compliance with security benchmarks
such as the Center for Internet Security
or DOD Security Technical Implementation Guides.
Effective management also requires
keeping all software up-to-date
with the latest patches to mitigate known threats.
For example,
if a vulnerability is discovered
in a widely used service like in Apache HTTP server,
a patch should be applied promptly to prevent exploitation.
Beyond patching,
Vulnerability management also includes actions
such as removing unnecessary services,
closing unused ports,
and disabling default accounts to reduce risk further.
Automated tools like SCAP compliance checkers
help system administrators
continuously monitor configurations
to ensure compliance with industry standards.
Regular assessments of vulnerabilities are essential
for maintaining a strong security posture
and mitigating the risk of attack.
Fourth, we have legacy components.
Legacy systems are those approaching
or exceeding their End of Life or EOL
or End of Support, or EOS dates.
Legacy systems pose significant security risks.
This security risk exists
because after a system reaches End of Life,
the manufacturer no longer sells or updates the product,
and when it hits End of Support,
no further patches or security updates are provided.
This makes legacy systems vulnerable to new attacks
since any discovered vulnerabilities will go unpatched.
For instance, Microsoft will cease
selling Windows Server 2019 licenses in 2024,
and support for the system will end in 2029.
Organizations that continue
using the unsupported Windows server 2019
after these dates will face the risk
of known vulnerabilities being exploited indefinitely.
To address this, organizations must plan upgrades
or replacements ahead of time,
ensuring they remain within supported lifecycles.
Legacy systems left in place without support
can create weak points in an otherwise secure environment,
so managing the lifecycle of every component is essential
for maintaining overall security.
Finally, let's conduct a demonstration
of hardening a Linux machine.
In this example,
our Kali Linux machine does not require printing services,
so let's disable the common Unix printing system
or CUPS Daemon to minimize the attack surface.
First, I'm going to bring up a command line
and we'll check the status of the CUPS service.
This is done by entering the following command
into the terminal: sudo systemctl status cups.
You can see here that the service is active and running
and that it is enabled.
Active running means
that the service is currently operational
and performing its functions on the system.
Enabled means that the service is configured
to start automatically at boot time,
ensuring it runs whenever the system is powered on.
Since CUPS on this machine is not needed,
we are going to disable it.
First, let's stop the CUPS Daemon.
This is done by entering the following into the terminal:
sudo systemctl stop cups.
Now let's check on the status.
As you can see here, the service has stopped
and is now marked inactive or dead.
However, because the service is still enabled,
it will restart when the machine starts,
so we need to disable the service too.
To disable the CUPS service, we'll enter the following
into the terminal: sudo systemctl disable cups.
There we go.
Now let's check that status again.
Here we can see that the service is both inactive and dead
and disabled.
Aside from removing the CUPS package altogether,
there is one additional hardening step we can take.
This is masking the CUPS Daemon.
Masking a service prevents it from being started
either manually or automatically
by linking the service to /dev/null.
When the service is masked, it is entirely disabled
and cannot be accidentally or intentionally started.
This is a more restrictive action
than simply disabling a service
which prevents it from starting automatically,
but would still allow it to be started manually.
Masking add an extra layer of security
by fully blocking the service.
So let's mask the CUPS service by entering:
sudo systemctl mask cups.
As you can see, the cup service is now linked to /dev/null.
Let's just take one last look at that status of CUPS.
As you can see here, the service is inactive and dead,
and also masked.
This is the end of our demonstration.
So remember,
attack surface management involves identifying, reducing,
and continuously monitoring all potential entry points
that attackers might exploit
within an organization's infrastructure.
Hardening is one key strategy,
which involves securing systems
by disabling unnecessary services
and applying security patches.
Another concept is defense-in-depth,
which layers multiple security measures like firewalls,
intrusion detection,
and encryption to protect systems even if one defense fails.
Next, vulnerability management plays a significant role
by scanning systems regularly to find
and address security weaknesses, ensuring all components,
including those that are outdated, remain protected.
Finally, legacy systems which no longer receive updates,
pose a higher security risk,
so it's vital to manage their lifecycle
and replace or upgrade them
before they become vulnerabilities.