System Admin Security Training Orange Team

Overview System Admin Duties Employee Documents and Security Controls Security Threats Threat Mitigation Incident Response

System Admin Duties Perform backup and restore data Add and remove users Add and remove hardware and software Configure and maintain hardware and software General user support Maintain documentation and licenses Negotiate with vendors System planning Security management

System Admin Duties Monitor system resource usage and performance Detect and correct problems Optimize performance Manage resources Automate tasks Determine and enforce usage policy Educate users Corporate priority liaison “corporate priority liaison” - liaison between user needs, budgetary constraints and technological limitations

A Lot Of Things To Do… … and it’s better to do them securely! “Bake in” security Can’t anticipate all problems Can limit the problems you have

Perform Backup and Restore Data Encrypt backups Secure storage Physical access control Environmental protections Controlled restorations No network connections Clean destination (no malware) Verified assistance "Verified assistance" means the person doing the restoration should be trusted as much as the methods used to restore.

Add and Remove Hardware and Software Old accounts can be used as backdoor Completely remove old access rights Add users while adhering to… Need-to-know Minimum privilege

Add and Remove Hardware and Software Inform users of potential outages Secure install Configure first Attach to network as late as possible Secure removal Install replacements first Avoid loss of functionality Dispose securely (data retrieval)

Configure and Maintain Hardware and Software Keep copies of configurations Configure new elements before attaching to network Use standard maintenance routines Document Update Verified assistance

General User Support Beware of social engineering Callers provide credentials Educate users to safeguard credentials Do not prompt Safeguard credentials Do not reveal unnecessarily Protect methods for credential creation

Maintain Documentation and Licenses Document procedures New SA education Consistency Audit Assurance Do not use illegitimate software Cheaper Unethical Illegal Insecure

Negotiate With Vendors Licensed products can get expensive Minimize the cost of secure behavior Vendor relationships are important Inform them of security concerns Request new products/solutions Receive updated hard/firm/software Continued business is valued and will be rewarded

System Planning Scaling Assessing new technology Security problems and solutions scale differently New node = new possible failure New AV != more secure Assessing new technology Anticipate problems “Shinier” does not mean “safer” Anticipating and avoiding problems Malware/attack trends Follow day-to-day guidelines strictly

Security Management “An ounce of prevention is worth a pound of cure.” Prioritize security Ideal management solution Simple Reproducible Covers security needs Your job, not the users

Monitor System Resource Usage and Performance Do not invade privacy Use data to… Identify future purchases Notice potential threats Excessive or unusual usage Antivirus logs Ensure expectations are met (SLA)

Detect and Correct Problems Use system monitoring devices Preemptive corrections Patching Updating Upgrading Reactive corrections See incident response

Optimize Performance Users get frustrated with poor system performance Users will optimize for themselves Non-compliance Installing adware/freeware Working around slow or ineffective processes Don’t optimize by removing/compromising security

Manage Resources Know what you have and use Bad situations Unaccounted-for router on network Unconfigured workstation Ordering unneeded license keys Wasting resources leads to budget cuts and layoffs Misplacing resources leads to vulnerabilities

Automate Tasks Script day-to-day tasks Focus extra time on harder tasks Don’t introduce security holes Unauthorized use of privileged scripts/programs Scripts disabling security features Testing/Debugging/Configuration programs used on ‘live’ network

Determine and Enforce Usage Policy Correct usage is essential Meaningless without enforcement

Educate Users A smart user is a safe user Eliminate “low hanging fruit” Social engineering Bad links Phishing emails Removal media

Corporate Priority Liaison Competing goals Management’s budget Your security Customer’s service needs Employee convenience Security needs to win Sell to management Educate users

Employee Documents Acceptable Use Policy (AUP) Service Level Agreement (SLA) Non-Disclosure Agreement (NDA) Employee Contract Your responsibility to enact if there are no documents.

Security Controls Need-to-know Security awareness training Separation of duties Job rotation Vacations Auditing/reviews

Security Threats External Internal Hacking E-mail attacks Malware Ignorance Insider

Security Threats: Hacking Exploitation of web services Poorly configured gateways Use of backdoors Social engineering Previous intrusion Internal corroborator

Security Threats: E-mail Phishing Spam Trojans Viruses

Security Threats: Malware Many sources Hacking Insider Ignorance Spreads quickly Use up resources

Security Threats: Ignorance Clicking bad links Poor e-mail discretion Downloading malware USB attacks

Security Threats: Insider Usually hardest to detect They know the system Sometimes privileged user Disgruntled employee Abuse of trust

Threat Mitigation Preparation Incident Response Plan Security practices Education Incident Response Plan If none, create one Form a Computer Security Incident Response Team Individuals capable of correct response Include members of management

Incident Response Identify Initial Response Formulate strategy Record basic details Assemble CSIRT Notify important individuals Formulate strategy Investigate Thorough data collection Determine what/who/how Report Resolve

Rules To Work By A smart user is a safe user Policy enforcement is the first step to a secure system Put security first in everything you do

Bibliography Mandia, Kevin, Chris Prosise, and Matt Pepe. Incident Response & Computer Forensics. Second ed. N.p.: Brandon A. Nordin, n.d. 11-32. Print.