『楼 主』:
你好，安全君！
使用 LLM 解释/回答一下
如何保证企业的系统运营安全
企业系统的安全管理运维涉及到公司信息化系统和数据的防木马入侵、防泄露工作，这是为所有CSO、COO非常关注的基础性工作。虽然基础，但是一旦处理不到位，将会给企业带来重大数据、经济损失或者声誉损失，后果不堪设想。
大牛网针对企业系统的安全管理，针对现有国内外文献进行了一些整理，希望更加有效的强化企业的系统运营，能够帮助企业系统管理员发现和提前处理系统可能存在的风险和漏洞，从而在事前保证企业系统的安全运营，减少事后维护的风险和成本。
从安全意识的角度上，国外学者在《企业IT系统安全性提升困难的六个原因》进行了分析。
早在2014年，索尼公司的安全防御机制就早已饱受诟病，2015年Target公司CEO及CIO在遭遇到有史以来规模最大的支付卡信息窃取案件后相继宣布辞职，自它之后各大媒体的头条：Michaels、PF Cahng’s、美国社区卫生系统、UPS、Dairy Queen、Goodwill、家得宝、摩根大宝、Kmart、Staples以及广受关注的索尼已经相继被攻陷——不仅是索尼影业执行官Amy Pascal，整个索尼品牌都遭受到了灾难性的打击。防止攻击活动成功实施的最佳实践几乎可以说显而易见。
1. 高层采取忽视态度
安全事务不仅带来额外成本，而且可能会给正常业务流程带来额外步骤、并因此影响生产力水平。没有哪位高管会因为安全事务处理得宜而备受关注，但却往往因短期盈利丰厚而得到赞誉。此外，首席执行官们往往会频繁跳槽，这更使得安全事务这类长期性工作遭到严重忽视。
2. 受到供应商的错误引导
安全方案供应商们永远走在安全威胁炒作的第一线(旨在宣传自己的安全保护品牌)，并致力于销售其所谓包治百病的保护妙药。从技术层面讲，这些威胁的确真实存在，但相较于这些小打小闹、为未受保护的系统安装正确补丁往往能带来更理想的保护效果。如果一味听从供应商的建议，大家很可能会把最宝贵的资源从最紧要的领域挪出来并移为它用。
3. 运营惯性导致问题拖延
假设企业管理层高度关注，并希望快速解决组织内的头号安全风险，即客户端Java。但就在这时，几位LoB经理提出了反对意见，表示几款关键性应用程序的正常运行需要以客户端Java为基础。那么企业有可能先把运营放在一边，利用安全技术对此类应用程序进行重新创建吗?或者说，他们更倾向于先把问题搁置起来，等到明年的大规模技术更新规划上马时再一道加以解决?
4. 在最明显的问题上缺乏正确引导
管理员们往往认为只有白痴才会轻易点击某个文件附件、打开某个指向被恶意软件所感染之网站的链接，或者轻信伪造的病毒警报而安装名为杀毒软件、实乃恶意软件的程序。但事实上，钓鱼邮件的效果确实非常、非常好，而且如果普通员工从来没见过真正的反恶意木马检测软件，他们根本不可能知道如何加以分辨。用户需要系统的安全培训，并在遭遇钓鱼活动时得到正确的提示及引导。每次培训时间不需要太长，但此类活动必须长期推进。
5. 自以为安全无忧
防火墙、入侵检测系统、安全事件监控、网络监控、双因素认证、身份管理……我们的企业已经把这些方案全部部署到位，没人能够随便闯得进来!然而残酷的事实证明，如果大家已经被贼惦记上了，那么以上机制根本不足以彻底消灭数字化资产损失。要防止问题的发生，大家必须拥有审慎的心态——对闲置中的关键性信息进行加密、避免设置永久性管理员权限并通过各种举措降低恶意人士得逞后可能带来的交叉性损失。
6.抱有听天由命的心态
在我看来，大多数企业都很清楚安全问题的严重性。然而面对残酷的现实，他们几乎放弃了抵抗。那些有能力组织APT(即先进持续性威胁)攻击的专业黑客几乎不可阻挡。金融行业每年遭受的欺诈与犯罪活动损失高达数十亿美元，而这已经成为其运营成本中的组成部分。走了这么多过场，笑到最后的还是那帮恶意分子。
这种心态也有其合理性，毕竟在安全对抗当中、漏洞总是抢先于防御机制出现。是的，攻击活动确实无法避免，但这并不能成为我们放弃最佳实践以显著减小攻击面的理由。
国内学者孙小俊在《中国新通信》中提出了两点看法，他认为：
1.在工作流程及管理制度方面进行改善。企业要根据自身情况建立网络配置管理系统使威胁出现的第一时间及时通知管理人员增加对危险状况的响应速度使企业受到的威胁程度降低到最小。与此同时要加强对企业网络管理的监控力度进行实时监控随时对安全事件进行查看使潜在安全隐患转化成可见的危险因素使企业在发现的第一时间及时发现并且解决。
2.利用图像方式使安全隐患“浮出水面”。图像可以清晰的反映出网络安全问题使潜在的安全隐患“浮出水面”变成可视化的安全威胁便于工作人员解决问题。图像化界面的形成有效的减轻了工作人员分析数据的压力使威胁更加直观化、透明化可以有效促进企业的网络安全管理。【2】
从技术的角度上文章《企业系统安全管理和强化的十个建议》进行了强有力的建议。他针对企业系统的安全管理，给出了10个非常实用、有效的系统强化措施，能够较好地帮助企业系统管理员发现和提前处理系统可能存在的风险和漏洞，从而在事前保证企业系统的安全运营。
1.从运行路径中去掉“.”
在超级用户(root)模式下，用户必须明确正在运行的命令是用户想要的。考虑下面的场景，用户在哪里登录了超级用户，那么用户的路径变量就是
.:/usr/bin:/usr/sbin:/bin:/sbin.
用户在ls目录下创建了一个包含如下命令的脚本：
#!/usr/bin/ksh
cp /usr/bin/ksh /tmp
chown root:bin /tmp/ksh
chmod 6755 /tmp/ksh
rm -f ls
/bin/ls $*
现在A用户呼叫并上报一个问题，在他的主目录里有些不明文件。用户作为超级管理员，使用cd命令进入他的目录并运行ls -l命令去查看。突然，在用户不知情的情况下，A用户可以运行一个shell脚本来获取用户的超级用户权限!
这样的情况经常发生，但是很容易避免。如果在用户的路径中没有“.”，用户会看到一个名为ls的脚本在他的主目录中，而不会去执行它。
2.规避风险脚本
当用户写一个脚本，总是指定正在使用的应用程序的完整路径。参考下面的脚本：
#!/usr/bin/ksh
date > log
find . -mtime +7 -ls -exec rm -rf {} \; 》 log 2>&1
虽然只有三行，并且只有两行执行命令，然而却存在很多安全漏洞：
它没有指定一个路径、它没有给出日期的完整路径、它没有给出查找的完整路径、它没有给出rm的完整路径、它执行错误检查、它没有验证目录的正确性。
当编写一个脚本，经常需要遵循这些简单的规则：
总是指定一个路径。
总是为每个应用程序使用的完整路径。
始终运行错误检查，特别是在运行具有潜在破坏性的命令时，如rm命令。
3.盯紧容易忽视的计划任务
要掌握用户的系统，用户需要清楚的了解它正在运行的程序。定期审核用户的计划任务列表文件中哪些程序正在运行。许多系统的计划任务文件存储在/var/spool/cron中。一些计划任务守护进程另外支持每小时计划任务，每周计划任务，每月计划任务和每年计划任务的文件，以及一个cron.d目录。使用man cron命令来将确定用户的计划任务守护进程的确切功能。
在每个目录检查所有的文件。注意每个工作的所有者，如果用户的计划任务守护进程(crond服务)支持，请锁定计划任务并且只对需要使用的用户ID开放。请注意每个正在运行的文件和它所运行的时间。如果用户正在运行一些用户觉得他们不需要的东西，与他们联系，问其原因，然后进行相应处理。
持续跟踪用户的计划任务作业并且定期检查他们是否有任何的变化。如果用户发现有些事情已经改变了，进行调查并确定原因。持续跟踪用户的系统正在做什么是保持用户系统安全的一个关键步骤
4.记录所有守护进程的日志
众所周知，如果守护进程不在第一个时间记录任何信息，那么保存和记录日志也是没用的。在默认情况下有一些守护进程会创建日志，有一些则没有。当用户审核用户的系统时，验证用户的守护进程是否记录日志信息。
任何公开的守护进程都需要配置日志，日志需要被保存。试着访问用户的一些服务，查看用户的日志服务器收集的日志。如果没有，阅读该服务的线上说明手册并查找所需的操作来激活记录。启动它，并尝试再次使用该服务。持续检查用户所有的服务直到确保记录和保存了所有的日志。
5. 运行CIS扫描
CIS基准测试最好的地方是他们给出的说明，报告中并不会只是简单的提到“用户有什么，哪个不好”;它会告诉用户为什么说它不好的更深层的原因，它可以让用户自己决定是否要禁用“坏东西”或维持原样。基准工具可能会检查很多用户没有想到的地方，并且给用户一份系统的详细报告。
CIS工具安装完成后，用户应该有一个目录/opt/CIS。运行命令cis-scan来了解用户的系统。扫描完成后，用户将会有一个名为cis-ruler-log.YYYYMMDD-HH:MM:SS.PID的文档。该文档是系统的总结报告，包含了所有的测试结果。其中该文档不包详细信息--这意味着只能作为索引来参考扫描工具自带的PDF文档。逐行审阅ruler-log文件，如果有一个负面的结果，建议在PDF文档中确定是否可以执行变更。大部分变更可以在不影响服务器的操作下实现，但并不是所有。谨防漏报;用户可能需要使用PortSentry工具查看端口515是否存在lp漏洞，这会导致了CIS工具报告用户有lp漏洞的错误。在报告末尾，数字越高用户的系统越“坚固”。
6.运行过程避免使用超级用户特权
许多运行在的服务器上的服务并不需要超级用户权限来执行他们的功能。通常，他们不需要任何特殊权限以外的读取和写入数据目录的能力。但由于Unix安全措施规定由超级用户权限的运行的开放的TCP / IP端口必须低于1024，加上这一事实，大多数著名的端口都低于1024，意味着用户的守护进程必须在超级用户权限下开放其端口。
这种困境有几个解决方法。第一，最安全的并不是运行所有的服务。如果守护进程没有运行，那么它不需要作为超级用户运行。然而，这并不是每次都管用的。有时候用户也需要为守护进程提供运行服务。在这种情况下，创建一个专门的用户ID来运行守护进程，并且尽可能的严格控制它。只使用这个ID写入可写的目录，并且不要给这个ID特别高的权限。然后更改启动脚本，守护进程只属于这个新的用户ID。现在如果攻击者利用漏洞攻击用户的服务器并且损害用户的守护进程，攻击者将获得非特权账户并且必须做进一步的工作来获得超级用户权限，在更多的损失发生之前将给予用户更多的时间来跟踪和阻止他或她。
7.扫描并处理高权限文件
所有系统都有设置用户ID(SUID)和设置组ID(SGID)文件。这些文件可以使用特定的用户或组来运行应用程序、脚本和守护进程，而不是个人用户ID或组ID来运行。top命令是一个很好的例子，它的运行权限较高，所以它可以扫描内核空间中的进程信息。因为大多数用户的默认权限不能读取这些信息，top需要运行更高的权限是有必要的。
许多操作系统允许用户的指定某些磁盘不支持SUID和SGID，通常是通过在用户的系统挂载文件中使用一个命令来完成。在Solaris中，用户会在/etc/vfstab中指定nosuid命令。
8.掌控开放的端口
在用户向外界发布用户的系统之前，用户需要知道哪些端口是打开的并且允许连接。有些端口是在用户不知情的情况下开放的，用户应该在人们通过这些端口访问用户的服务器之前关闭它们。有一些工具可以让用户知道用户的系统是暴露的。
可以使用Netstat工具来进行排查。几乎每一个操作系统都附带Netstat命令。Netstat是一个简单的工具，可以显示用户的网络信息，如网络端口、路由表和网络连接信息。Netstat工具显示了/etc/services下所有已经被使用类似人名定义的端口，使其更容易解析和导出。这是一个确保用户系统上/etc/services持续更新的好理由。在用户的系统上使用man命令来发现netstat的能力。
建议用户花些时间去学习netstat吧。如果用户学会了如何使用，它将为用户提供丰富的网络信息，并且让用户清楚地看见是谁在什么时间连接到了用户的系统。
9.使用一个集中的日志服务器
如果用户负责维护多个服务器，那么检查每台服务器的日志将非常繁琐。为此，建立一台专用服务器来搜集其他所有服务器的日志消息。通过整合用户的日志，用户只需要扫描一台服务器，将大大节省用户的时间。在用户的服务器被攻破后，这也是一个好的归档文件;用户仍然可以在别的地方查阅这些日志文件。
创建一个核心日志服务器，使用高速CPU和大量的磁盘可用空间。关闭除syslogd之外的其他所有端口和服务，这个系统受到损害的几率降到最低，可能除了使用TCP-wrapped SSH守护进程来限制用户的工作站进行远程访问。然后验证syslogd可以从远程系统接收消息。这不同于从消息提供服务器到消息提供服务器。有些服务器默认接收消息，用户可能需要关掉它;有些默认不接收消息，用户需要打开它。
创建一个系统来归档旧日志并形成文件。如果用户的日志曾经被用作为证据，用户需要能够证明它们没有被更改过，用户需要出示他们是如何创建的。建议用户压缩一个星期以上的所有带时间戳的日志并且通过只读的媒体，例如CD光盘来复制他们。
一旦用户有了一个接收日志的服务器，用户需要启动其他服务器指向它。编辑/etc/syslog.conf并且确定用户想复制的信息。最起码，用户应该复制最高的紧急程度状态，紧急状态，重要信息，临界状态和警告信息和更多用户认为有用的信息。
10.保持软件更新
每款软件都有漏洞。大多数厂商对代码进行审计并且删除发现的所有漏洞，但也有些不可避免地发布到外界。某些人花大量的时间去试图找出这些漏洞;有的人会报告给厂商，但有的人则是自己个人利用。
许多厂商会提供一个工具来帮助您保持您的系统上的补丁。HP-UX有软件更新管理软件、Solaris有patchdiag和patchpro，AIX使用SMIT，等等。至少每月运行用户的诊断工具一次，看看用户的系统可以更新的补丁，并决定是否需要安装它们。每个周日下午留出至少一个小时 (或者更多的时间) 专门作为系统维护时间，利用这段时间来安装补丁和执行其他必要的维护。
用户应该养成为一个习惯经常去网站上查看用户安装的每个应用程序是否有bug修复或安全补丁发布。使用前面创建的应用程序列表来确定是否有适用于用户的补丁。当用户更新完补丁后记得更新用户的列表信息。
【1】 企业IT系统安全性提升困难的六个原因,2015.3,核子/译 编辑: 董建伟
原文链接： http://www.infoworld.com/article/2896513/security/why-improving-security-is-so-hard.html
【2】中国信通信，2013.4，孙小俊
【3】企业系统安全管理和强化的十个建议，2015.5，羽扇纶巾
How to Ensure the Operational Security of Enterprise Systems
The security management and operation and maintenance of enterprise systems involve the anti-trojan horse intrusion and anti-leakage work of the company's information system and data, which is a fundamental work that all CSOs and COOs are very concerned about. Although it is basic, once the treatment is not in place, it will bring重大 data, economic losses or reputation losses to the enterprise, and the consequences are unimaginable.
Daniu Network has sorted out some existing domestic and foreign literatures for the security management of enterprise systems, hoping to more effectively strengthen the operation of enterprise systems, and help enterprise system administrators discover and handle in advance the possible risks and vulnerabilities of the system, so as to ensure the safe operation of the enterprise system in advance and reduce the risk and cost of post-maintenance.
From the perspective of safety awareness, foreign scholars analyzed in "Six Reasons for the Difficulty in Improving the Security of Enterprise IT Systems".
As early as 2014, Sony's security defense mechanism had long been criticized. In 2015, after Target's CEO and CIO encountered the largest payment card information theft case in history, they successively announced their resignations. Since then, major media headlines: Michaels, PF Cahng’s, American Community Health Systems, UPS, Dairy Queen, Goodwill, Home Depot, Morgan Dai Baos, Kmart, Staples, and the widely concerned Sony have successively been hacked - not only Sony Pictures Executive Amy Pascal, but the entire Sony brand has suffered a catastrophic blow. The best practices to prevent the successful implementation of attack activities are almost obvious.
1. High-level neglect
Security matters not only bring additional costs, but may also bring additional steps to normal business processes and thus affect the productivity level. No executive will be noticed because of the proper handling of security matters, but they are often praised for the high short-term profits. In addition, CEOs often change jobs frequently, which makes long-term work such as security matters seriously neglected.
2. Misguided by suppliers
Security solution suppliers are always at the forefront of security threat hype (aimed at promoting their own security protection brands) and are committed to selling their so-called panacea. Technically, these threats are indeed real, but compared with these small tricks, installing the correct patches for unprotected systems can often bring more ideal protection effects. If you blindly follow the advice of suppliers, everyone is likely to move the most valuable resources from the most critical areas to other uses.
3. Problem delay due to operational inertia
Suppose the enterprise management is highly concerned and hopes to quickly solve the top security risk in the organization, that is, client Java. But at this time, several LoB managers raised objections, saying that the normal operation of several key applications needs to be based on client Java. Then, will the enterprise possibly put the operation aside and re-create such applications using security technology? Or do they prefer to put the problem aside and solve it together when the large-scale technology update plan for next year is launched?
4. Lack of correct guidance on the most obvious problems
Administrators often think that only idiots will easily click on a file attachment, open a link to a website infected with malware, or credulously believe a forged virus alert and install anti-virus software that is actually malware. But in fact, phishing emails are indeed very, very effective, and if ordinary employees have never seen a real anti-malware detection software, they simply can't know how to distinguish it. Users need systematic security training and correct prompts and guidance when encountering phishing activities. The training time doesn't need to be too long each time, but such activities must be promoted for a long time.
5. Thinking that everything is safe
Firewalls, intrusion detection systems, security event monitoring, network monitoring, two-factor authentication, identity management... Our enterprise has deployed all these solutions, and no one can break in casually! However, the cruel fact proves that if everyone has been targeted by thieves, the above mechanisms are not enough to completely eliminate the loss of digital assets. To prevent the problem, everyone must have a prudent mentality - encrypt key information that is idle, avoid setting permanent administrator privileges, and reduce the cross-loss that may be caused by malicious people after they succeed through various measures.
6. Having a fatalistic mentality
In my opinion, most enterprises are very clear about the seriousness of security problems. However, in the face of the cruel reality, they almost give up resistance. Professional hackers who have the ability to organize APT (Advanced Persistent Threat) attacks are almost unstoppable. The financial industry suffers billions of dollars in fraud and criminal activities every year, and this has become a part of its operating costs. After going through so many formalities, the malicious people are the ones who laugh last.
This mentality also has its rationality, after all, in the security confrontation, vulnerabilities always appear ahead of defense mechanisms. Yes, attack activities are indeed unavoidable, but this cannot be used as a reason to give up the best practices to significantly reduce the attack surface.
Domestic scholar Sun Xiaojun put forward two views in "China New Communications". He believes:
1. Improve in work processes and management systems. Enterprises should establish a network configuration management system according to their own situation to make the management personnel be notified in the first time when a threat occurs, increase the response speed to dangerous situations, and reduce the threat degree to the enterprise to the minimum. At the same time, strengthen the monitoring strength of enterprise network management, conduct real-time monitoring, view security events at any time, convert potential security hidden dangers into visible risk factors, and enable the enterprise to find and solve them in the first time when discovered.
2. Use the image method to make security hidden dangers "come to light". Images can clearly reflect network security problems, make potential security hidden dangers "come to light" into visual security threats, which is convenient for staff to solve problems. The formation of the image interface effectively reduces the pressure of staff to analyze data, makes threats more intuitive and transparent, and can effectively promote enterprise network security management. [2]
From the technical perspective, the article "Ten Suggestions for Enterprise System Security Management and Strengthening" gives strong suggestions. It gives 10 very practical and effective system strengthening measures for enterprise system security management, which can better help enterprise system administrators discover and handle in advance the possible risks and vulnerabilities of the system, so as to ensure the safe operation of the enterprise system in advance.
1. Remove "." from the running path
In the super user (root) mode, the user must be clear about the command being run is what the user wants. Consider the following scenario, where the user logs in as the super user, then the user's path variable is.:/usr/bin:/usr/sbin:/bin:/sbin.
The user creates a script containing the following commands in the ls directory:
#!/usr/bin/ksh
cp /usr/bin/ksh /tmp
chown root:bin /tmp/ksh
chmod 6755 /tmp/ksh
rm -f ls
/bin/ls $*
Now user A calls and reports a problem that there are some unknown files in his home directory. The user, as the super administrator, uses the cd command to enter his directory and runs the ls -l command to view. Suddenly, without the user's knowledge, user A can run a shell script to obtain the user's super user privileges!
Such situations happen often, but are easy to avoid. If there is no "." in the user's path, the user will see a script named ls in his home directory and will not execute it.
2. Avoid risk scripts
When writing a script, always specify the full path of the application being used. Refer to the following script:
#!/usr/bin/ksh
date > log
find . -mtime +7 -ls -exec rm -rf {} \; 》 log 2>&1
Although there are only three lines and only two lines of execution commands, there are many security vulnerabilities:
It does not specify a path, it does not give the full path of the date, it does not give the full path of the find, it does not give the full path of the rm, it performs error checking, and it does not verify the correctness of the directory.
When writing a script, you often need to follow these simple rules:
Always specify a path.
Always use the full path for each application used.
Always run error checking, especially when running potentially destructive commands such as the rm command.
3. Keep an eye on easily overlooked scheduled tasks
To master the user's system, the user needs to clearly understand the programs it is running. Regularly review which programs are running in the user's scheduled tasks list file. The scheduled tasks files of many systems are stored in /var/spool/cron. Some scheduled task daemons additionally support files for hourly scheduled tasks, weekly scheduled tasks, monthly scheduled tasks, and yearly scheduled tasks, as well as a cron.d directory. Use the man cron command to determine the exact functions of the user's scheduled task daemon.
Check all files in each directory. Pay attention to the owner of each job. If the user's scheduled task daemon (crond service) supports, lock the scheduled tasks and only open them to the user IDs that need to use them. Please pay attention to each running file and the time it runs. If the user is running something that the user thinks they don't need, contact them, ask the reason, and then handle it accordingly.
Continuously track the user's scheduled task jobs and regularly check if there are any changes. If the user finds that something has changed, investigate and determine the reason. Continuously tracking what the user's system is doing is a key step to keep the user's system secure.
4. Record logs of all daemons
As we all know, if the daemon does not record any information at the first time, then saving and recording logs is useless. By default, some daemons create logs and some do not. When the user audits the user's system, verify whether the user's daemons record log information.
Any public daemon needs to be configured to log, and the logs need to be saved. Try to access some of the user's services and view the logs collected by the user's log server. If not, read the online manual of the service and find the required operations to activate recording. Start it and try to use the service again. Continuously check all of the user's services until ensuring that all logs are recorded and saved.
5. Run CIS scans
The best part of the CIS benchmark is the instructions they give. The report will not just simply mention "what the user has and which is bad"; it will tell the user the deeper reasons why it is bad, and it allows the user to decide whether to disable the "bad things" or keep them as they are. The benchmark tool may check many places that the user didn't think of and give the user a detailed report of the system.
After the CIS tool is installed, the user should have a directory /opt/CIS. Run the command cis-scan to understand the user's system. After the scan is completed, the user will have a document named cis-ruler-log.YYYYMMDD-HH:MM:SS.PID. This document is a summary report of the system, including all test results. However, this document does not include detailed information - which means it can only be used as an index to refer to the PDF document that comes with the scanning tool. Review the ruler-log file line by line. If there is a negative result, it is suggested to determine in the PDF document whether the change can be executed. Most changes can be implemented without affecting the operation of the server, but not all. Be careful of false negatives; the user may need to use the PortSentry tool to check if there is an lp vulnerability on port 515, which will cause the CIS tool to report that the user has an lp vulnerability incorrectly. At the end of the report, the higher the number, the "tougher" the user's system is.
6. Avoid using super user privileges during operation
Many services running on the server do not need super user privileges to perform their functions. Usually, they do not need any special privileges other than the ability to read and write data directories. But due to the Unix security measures that open TCP/IP ports running with super user privileges must be below 1024, plus the fact that most famous ports are below 1024, it means that the user's daemon must open its port with super user privileges.
There are several solutions to this dilemma. First, the safest is not to run all services. If the daemon is not running, then it does not need to run as a super user. However, this does not work every time. Sometimes the user also needs to provide the daemon to run the service. In this case, create a dedicated user ID to run the daemon and control it as strictly as possible. Only use this ID to write to writable directories and do not give this ID particularly high privileges. Then change the startup script so that the daemon only belongs to this new user ID. Now if an attacker uses a vulnerability to attack the user's server and compromise the user's daemon, the attacker will get a non-privileged account and must do further work to get super user privileges, which will give the user more time to track and stop him or her before more losses occur.
7. Scan and handle high-privilege files
All systems have set user ID (SUID) and set group ID (SGID) files. These files can use specific users or groups to run applications, scripts, and daemons instead of personal user IDs or group IDs. The top command is a good example, which has high running privileges so that it can scan process information in the kernel space. Because most users' default permissions cannot read this information, it is necessary for top to run with higher privileges.
Many operating systems allow the user to specify that certain disks do not support SUID and SGID, usually by using a command in the user's system mount file. In Solaris, the user will specify the nosuid command in /etc/vfstab.
8. Take control of open ports
Before the user publishes the user's system to the outside world, the user needs to know which ports are open and allow connections. Some ports are open without the user's knowledge, and the user should close them before people access the user's server through these ports. There are some tools that can let the user know that the user's system is exposed.
The Netstat tool can be used for investigation. Almost every operating system comes with the Netstat command. Netstat is a simple tool that can display the user's network information, such as network ports, routing tables, and network connection information. The Netstat tool displays all ports that have been used and defined with similar names under /etc/services, making it easier to parse and export. This is a good reason to ensure that /etc/services on the user's system is continuously updated. Use the man command on the user's system to find the capabilities of netstat.
It is suggested that the user spend some time learning netstat. If the user learns how to use it, it will provide the user with rich network information and let the user clearly see who connected to the user's system at what time.
9. Use a centralized log server
If the user is responsible for maintaining multiple servers, then checking the logs of each server will be very tedious. To this end, establish a dedicated server to collect log messages from all other servers. By integrating the user's logs, the user only needs to scan one server, which will save the user a lot of time. After the user's server is compromised, this is also a good archive file; the user can still view these log files elsewhere.
Create a core log server with a high-speed CPU and a large amount of available disk space. Close all other ports and services except syslogd to minimize the chance of this system being damaged, possibly except for using the TCP-wrapped SSH daemon to limit the user's workstations for remote access. Then verify that syslogd can receive messages from remote systems. This is different from from message provider server to message provider server. Some servers receive messages by default, and the user may need to turn it off; some do not receive messages by default, and the user needs to turn it on.
Create a system to archive old logs and form files. If the user's logs have ever been used as evidence, the user needs to be able to prove that they have not been changed, and the user needs to show how they were created. It is suggested that the user compress all timestamped logs that are more than a week old and copy them through read-only media, such as CD-ROMs.
Once the user has a server that receives logs, the user needs to start other servers to point to it. Edit /etc/syslog.conf and determine the information that the user wants to copy. At the very least, the user should copy the highest emergency level status, emergency status, important information, critical status, and warning information and more information that the user thinks is useful.
10. Keep software updated
Every piece of software has vulnerabilities. Most vendors audit the code and remove all vulnerabilities found, but some are inevitably released to the outside world. Some people spend a lot of time trying to find these vulnerabilities; some report them to the vendor, but some use them personally.
Many vendors provide a tool to help you keep the patches on your system up to date. HP-UX has software update management software, Solaris has patchdiag and patchpro, AIX uses SMIT, and so on. Run the user's diagnostic tool at least once a month to see the patches that the user's system can be updated, and decide whether to install them. Set aside at least one hour (or more time) every Sunday afternoon specifically as system maintenance time, and use this time to install patches and perform other necessary maintenance.
The user should develop a habit of often checking the websites to see if there are bug fixes or security patches released for each application the user has installed. Use the application list created earlier to determine if there are patches applicable to the user. Remember to update the user's list information after the user updates the patches. [3]
【1】Six Reasons for the Difficulty in Improving the Security of Enterprise IT Systems, March 2015, Nuclear / Translator: Dong Jianwei
Original link: [url]http://www.infoworld.com/article/2896513/security/why-improving-security-is-so-hard.html[/url]
【2】China Information and Communications, April 2013, Sun Xiaojun
【3】Ten Suggestions for Enterprise System Security Management and Strengthening, May 2015, Yushan Lunjin
|
