Nmap.me new version - now with vulnerability scan

Now service:

• Does full port and vulnerability scan of the caller's IP
• Immediately perform and return tcp scan results. Starts vulnerability scan in background.
• Visit nmap.me again in about 30min(depends on load), and results of the vulnerability scan (port, service, vulnerability, CVE) for you IP will be displayed. 
• You can use, console friendly endpoint : scan.nmap.me , or
•  use a human readable website: nmap.me

Scan results examples:

Good  scan results:

Not so good scan  results:

As previously service is built using AWS native capabilities, serverless and containerized approach and design to be extremely scalable.

Quick FAQ:

What's new? Now it does full vulnerability scan of the IP.

What it does? Scan your external IP for open TCP ports and known vulnerabilities.

How to use? Simply do _curl scan.nmap.me_ from your console/terminal or open this webite in browser. You will get TCP scan results immediately and you will need to visit same page in an hour to get vulnerability scan results.

What it's scanning for?: Uses nmap NSE script to perform scan for known vulnerabilities. Based on https://github.com/vulnersCom/nmap-vulners

How fast? Whole TCP scan takes about a few second and results are immediately shown. After this vuln scan is starting. Depending of the backend load it might take about an hour to get scanned. After this simply visit the same page again to get vulnerability scan results. Scan results for each requester IP are cached for 1 hour (TCP scan) and 24 hours (Vuln scan) to reduce load and prevent abuse.

Nmap.me completetly rebuilded

To improve performance and service scalability nmap.me was completely rebuild leveraging aws native services and serverless approach.

Now service:

• support both http and https
• has dedicated scanning endpoint: scan.nmap.me
• has a human readable website: nmap.me
• scanning endpoint now api driven and will support rest api calls for advanced functionality
• serverless and scalable

Main functionality so far unchanged: 

What it does? TCP Scan of you external IP.
What it scanning for: 100 most used tcp ports. Actually a bit more than 100 - I'm slowly adding more ports.
How to use: simply curl scan.nmap.me from your console/terminal or open it in browser or visit nmap.me(javascript will trigger scan)
How fast: whole scan takes about a second. Results for each requester IP are cached for 1 hour to reduce load and prevent abuse.

Why? Needed quick way to check open ports on server/gateway/fw/router while being inside the console.

Secure your AWS account using CloudFormation

      The very first thing you need to do while building your AWS infrastructure is to enable and configure all AWS account level security features such as: CloudTrail, CloudConfig, CloudWatch, IAM, etc..

       To do this, you can use mine Amazon AWS Account level security checklist and how-to or any other source.

        To avoid manual steps and to be align with SecuityAsCode concept, I use set of CloudFormation templates, simplified version of which I would like to share: 

GitHub: https://github.com/IhorKravchuk/it-security

Global Security stack template structure:

security.global.json - parent template for all nested templates to link them together and control dependency between nested stacks.

cloudtrail.clobal.json - nested template for Global configuration of the CloudTrail:

• creates S3 bucket for the logs
• creates CloudTrail-related IAM roles and policies
• creates CloudLog LogGroup
• enables CloudTrail on default region including global events and multi-region feature
• creates SNS ans SQS configuration for easy integration with Splunk AWS app.

cloudtrailalarms.global.json - nested template for Global CloudWatch Logs alarms and security metrics creation. Uses FilterMap to create different security-related filters for ClouTrail LogGroup, corresponding metrics and notifications for suspicious or dangerous events. You can customise filter per environment basis.

Predefined filters are:

• rds-change: RDS related changes
• iam-change; IAM changes
• srt-instance: Start, Reboot, Terminate instance
• large-instance: launching large instances
• massive-operations: massive operations- more 10 in 5 min 
• massive-terminations: massive terminations- more 10 in 5 min 
• detach-force-ebs: force detachment of the EBS volume from the instance
• change-critical-ebs: any changes related to the critical EBS volumes
• change-secgroup: any changes related to the security group
• create-delete-secgroup: creation and deletion of the security group 
• secgroup-instance: attaching security group to the instance
• route-change: routing  changes
• create-delete-vpc: creation and deletion of a VPC
• netacl-change: changes at Network ACL
• cloudtrail-change: changes in the CloudTrail configuration
• cloudformation-change: changes related to the CloudFormation
• root-access: any root access events
• unauthorised: failed and unauthorised operations
• igw-change: Internet Gateway related changes
• vpc-flow-logs: Delete or Create VPC flow logs
• critical-instance: any operation on the critical instances
• eip-change: Elastic IP changes
• net-access: Any access outside of predefined known IP ranges

4 preconfigured notification topics : 

• InfosecEmailTopic, 
• DevOpsEmailTopic
• InfosecSMSTopic
• DevOpsSMSTopic

awsconfig.global.json - nested template for Global AWS Config Service configuration.

• creates S3 bucket for the config dumps
• creates AWS Config-related IAM roles and policies
• creates AWS config delivery channel and schedule config dumps (hourly)
• creates and enables AWS config recorder 
• creates SNS ans SQS configuration for easy integration with Splunk AWS app.

cloudwatchsubs.global.json - nested template for configuring AWS CloudWatch Subscription Filter to extract and analyse most severe CloudTrail events using custom Lambda function:

• creates Lambda function and all requred roles and permissions
• creates Subscription filter as a compilation of the filters from the FilterMap
    

Currently uses following filters and aggregate them to one due to the AWS CloudWatch Logs subscription limitation (only one filter supported):

• critical-instance
• iam-change
• srt-instance
• cloudtrail-change
• root-access
• net-access
• detach-force-ebs
• unauthorised

iam.global.json - nested template for IAM Global configuration: 

• creates Infosec Team IAM Group and managed policy
• creates DevOps Team IAM Group and managed policy
• creates DBA Team IAM Group and managed policy
• creates Self Service Policy  for users to manage API keys and MFA
• creates  ProtectProdEnviroment to protect production environment from destructive actions 
• creates EnforceMFAPolicy to enforce MFA for sensitive operations
• creates EnforceAccessFromOfficePolicy to restrict some operation to office source IPs
• creates DomainJoin role and all required policy to perform automated domain join
• creates SaltMasterPolicy and Role for Configuration Management Tool (in this case - Salt)
• creates SQLDataBaseInstancePolicy and Instance profile example policy
• creates SIEM system example policy
• creates VPC flow log role
• creates and manages SIEM user and API keys
• creates and manages SMTP user (for the AWS SES service ) and API keys

cloudwatchsubs_kinesis.global.json - PoC template (not linked as nested to the security.global.json)  for configuring AWS CloudWatch Subscription Filter to send most severe CloudTrail events to AWS Kinesis stream using subscription filter similar to the cloudwatchsubs.global.json 

Supported features:

Environments and regions: Stack supports unlimited amount of environments with 4 environments predefined (staging, dev, prod, and dr) and use 1 account and 1 region per environment concept to reduce blast radius (if account become compromised)

AWS services used by stack: CloudTrail, AWS Config, CloudWatch, CloudWatch Logs and Events, IAM,  Lambda, Kinesis.

To deploy:

1. Create bucket using following naming convention: com.ChangeMe.EnviromentName.cloudform, replacing ChangeMe and EnviromentName with your value to make it look like this:            com.it-security.prod.cloudform
2. Enable bucket versioning 
3. in the templates  security.global.json and cloudwatchsubs.global.json replace "ChangeMe" with name used in the bucket creation.
4. In the template cloudtrailalarms.global.json modify SNS endpoints for email notification infosec@ChangeMe.com and devops@ChangeMe.com; Add endpoints with mobile phone numbers for SMS notification to appropriate SNS topics if needed.
5. Modify iam.global.json template to adrress you SQL DataBase bucket location (com-ChangeMe-", {"Ref": "Environment"} , "-sqldb/)  and modify any permission if need according to your organisation structure, roles, responsibilities and services.
6. Modify FilterMap in cloudtrailalarms.global.json and cloudwatchsubs.global.json templates make filters work for your infrastructure (Critical Instance IDs, Critical Volume IDs, you ofiice IP range, you NAT gateways, etc) 
7. Zip example Lambda function LogCritical_lambda_security_global.py like LogCritical_lambda_security_global.zip
8. Upload this function into S3 bucket created at step 1 and copy object version (GUI- show version -object properties ) and insert into cloudwatchsubs.global.json template into "LogCriticalLambdaCodeVer" mapping at the appropriate environment (prod, staging ..)
9. Modify "regions" Environments mapping in the iam.global.json, and cloudwatchsubs.global.json templates to specify correct AWS region you are using for the deployment.
10. Upload all *.global.json templates into S3 bucket created at step 1. 
11. Create new CloudFormation stack  using parent security template security.global.json and your bucket name (Example: ttps://s3.amazonaws.com/com.it-security.prod.cloudform/security.global.json ),  call it "Security" and specify environment name you going to deploy.
12. Done!

Self-Defending Cloud PoC or Amazon CloudWatch Events usage

Problem:  Malicious attacker get privileged access to your AWS account and destroying your production infrastructure in a matter of seconds.

In case of cloud based infrastructures you can't rely on classic SIEM solutions - by the time your SIEM will detect attack, your infrastructure will be gone. We need a "near real time" way to detect and mitigate the attack.

Attack scenario: using compromised aws api key (no MFA) and CLI/SDK to perform destructive actions.

Attack detection and mitigation strategy:  
All destructive actions start with EC2 instance termination. To prevent such scenario, you should always have "TerminationProtection" feature enabled on your production instances. Based on this, attacker must disable termination protection before demolishing your environment. For the PoC, I will use disabling "TerminationProtection" event as a attack detector (sure thing, real attack detection is a way more complicated process).

Starting point: AWS api key with admin policy attached, all production instances protected using AWS Termination Protection.

Possible solutions and attack mitigation delays:

SIEM:

CloudWatch Logs and alarms:

CloudWatch Subscriptions:

CloudWatch Events:

Implementation: 

Design:
Based on the implementation scenarios shown above and their performance (tested during PoC)  - the fastest way is to leverage AWS CloudWatch events and trigger a lambda function.

Speaking AWS technical language we need:

1. choose what type of AWS event we are looking for. Based on the our attack detection strategy, we are looking for ec2 call: modify-instance-attribute. Using exactly this API call you can enable/disable TerminationProtection. So let's look for "AWS API Call Events" type of the CloudWatch events.
2. Create: event rule : "match incoming events and route them to one or more targets for processing" in our case target is a Lambda function.
3. Create all required policies and Lambda function role in IAM.
4. Build the Lambda function itself.

Setting-up event rule:

I was using following event pattern inside the CloudWatch Event rule:
{ "detail-type": [ "AWS API Call via CloudTrail" ], "detail": { "eventSource": [ "ec2.amazonaws.com" ], "eventName": [ "ModifyInstanceAttribute" ] } }


Getting sample event:

To start writing our event-detection-mitigation lambda function we need to get example of the AWS events for the API call we are monitoring.
We can achieve this with the following simple Lambda function:

import json

def lambda_handler(event, context):
    print event


or, if you need nice formatted json to test you lambda function offline:

import json

def lambda_handler(event, context):
    print json.dumps(event, indent=4, sort_keys=False)

You will find output of your lambda function (result of the print statement) in appropriate (naming as your lambda function) CloudWatch Log Stream


Challenges with event format:

During first tests, I've found that Amazon AWS not following any JSON contract (defined format)  even for the same 1 API call. Making the same API call in the 3 different ways produced 3 different event formats:

Disabling TerminationProtection from GUI with MFA:

{u'account': u'150905', u'region': u'eu-west-1', u'detail': {u'eventVersion': u'1.05', u'eventID': u'b3c4d3b4-353e-44bf-8973-37abccd085b5', u'eventTime': u'2016-10-14T17:31:37Z', u'requestParameters': {u'instanceId': u'i-d8916d57', u'disableApiTermination': {u'value': False}}, u'eventType': u'AwsApiCall', u'responseElements': {u'_return': True}, u'awsRegion': u'eu-west-1', u'eventName': u'ModifyInstanceAttribute', u'userIdentity': {u'userName': u'ihork', u'principalId': u'AIDAI3UNW', u'accessKeyId': u'ASIAIN2', u'invokedBy': u'signin.amazonaws.com', u'sessionContext': {u'attributes': {u'creationDate': u'2016-10-14T16:48:44Z', u'mfaAuthenticated': u'true'}}, u'type': u'IAMUser', u'arn': u'arn:aws:iam::150905:user/igor', u'accountId': u'150905'}, u'eventSource': u'ec2.amazonaws.com', u'requestID': u'e7b585e-af38-49d0-88a8-979ef5052f', u'userAgent': u'signin.amazonaws.com', u'sourceIPAddress': u'174.231.5.2'}, u'detail-type': u'AWS API Call via CloudTrail', u'source': u'aws.ec2', u'version': u'0', u'time': u'2016-10-14T17:31:37Z', u'id': u'55084ea-e4bc-45e6-a7a6-0c8e7d16b32', u'resources': []}

Disabling TerminationProtection from aws cli (no MFA):

command:
$ aws ec2 modify-instance-attribute --no-disable-api-termination --instance-id i-378579b8 

event:
{u'account': u'150905', u'region': u'eu-west-1', u'detail': {u'eventVersion': u'1.05', u'eventID': u'f8ae9323-91b0-4100-b27b-dce348641a5c', u'eventTime': u'2016-10-14T17:31:46Z', u'requestParameters': {u'instanceId': u'i-d8916d57', u'disableApiTermination': {u'value': True}}, u'eventType': u'AwsApiCall', u'responseElements': {u'_return': True}, u'awsRegion': u'eu-west-1', u'eventName': u'ModifyInstanceAttribute', u'userIdentity': {u'userName': u'ihork', u'principalId': u'AIDAI3UNW', u'accessKeyId': u'ASIAIN2', u'invokedBy': u'signin.amazonaws.com', u'sessionContext': {u'attributes': {u'creationDate': u'2016-10-14T16:48:44Z', u'mfaAuthenticated': u'true'}}, u'type': u'IAMUser', u'arn': u'arn:aws:iam::150905:user/igor', u'accountId': u'150905'}, u'eventSource': u'ec2.amazonaws.com', u'requestID': u'cd889e-039e-4f8f-bfe9-4d293012335', u'userAgent': u'signin.amazonaws.com', u'sourceIPAddress': u'174.231.5.2'}, u'detail-type': u'AWS API Call via CloudTrail', u'source': u'aws.ec2', u'version': u'0', u'time': u'2016-10-14T17:31:46Z', u'id': u'cd32fc6-39ae-4237-b46d-62d237d4d89', u'resources': []}

Disabling TerminationProtection from aws cli. 2nd variant

command:

$ aws ec2 modify-instance-attribute --attribute disableApiTermination --value false --instance-id i-199a6696 

event:
{u'account': u'150905', u'region': u'eu-west-1', u'detail': {u'eventVersion': u'1.05', u'eventID': u'75fe4852-d3d9-4c9c-a702-7f025e0c4c50', u'eventTime': u'2016-10-14T17:29:24Z', u'requestParameters': {u'instanceId': u'i-d8916d57', u'attribute': u'disableApiTermination', u'value': u'false'}, u'eventType': u'AwsApiCall', u'responseElements': {u'_return': True}, u'awsRegion': u'eu-west-1', u'eventName': u'ModifyInstanceAttribute', u'userIdentity': {u'userName': u'ihork', u'principalId': u'AIDAI3U7LBIY', u'accessKeyId': u'AKIAJL7', u'type': u'IAMUser', u'arn': u'arn:aws:iam::150905:user/igor', u'accountId': u'150905'}, u'eventSource': u'ec2.amazonaws.com', u'requestID': u'd3c46-2def-4450-b3c1-4827d9f78', u'userAgent': u'aws-cli/1.10.45 Python/2.7.11 Linux/4.7.3-100.fc23.x86_64 botocore/1.4.60', u'sourceIPAddress': u'174.231.5.2'}, u'detail-type': u'AWS API Call via CloudTrail', u'source': u'aws.ec2', u'version': u'0', u'time': u'2016-10-14T17:29:24Z', u'id': u'9fb88a9e-025b-4859-9b98-6180cd14a9b', u'resources': []}


Take a precise look on:

'sessionContext': {u'attributes': {u'creationDate': u'2016-10-14T16:48:44Z', u'mfaAuthenticated': u'true'}} - not expect this part of JSON if you are not using Mfa

 u'disableApiTermination': {u'value': True}} and 'attribute': u'disableApiTermination', u'value': u'false'} same API call done using different AWS CLI options, but serving the same purpose produce 2 different events

How we can disable a user in AWS ?

You just can't disable user in AWS. You can delete it, but you need to remove it from the groups first. It takes times, lines of code and API calls. Solution? - attach inline user policy with explicit deny (will override all allows) for all the actions you need to block.

Lambda function:

Here my PoC lambda function: really "dirty" and serving only one simple use case:

def lambda_handler(event, context):
    print event
# analyzing event
    if event['detail']['requestParameters'].get('disableApiTermination')!= None:
        protection_status = event['detail']['requestParameters']['disableApiTermination']['value']
        UserName = event['detail']['userIdentity']['userName']
        UserID = event['detail']['userIdentity']['principalId']
        if event['detail']['userIdentity'].get('sessionContext') != None:
            mfa = event['detail']['userIdentity']['sessionContext']['attributes']['mfaAuthenticated']
        else:
            mfa = "false"
        print protection_status, UserName, UserID, mfa
# disabling user using inline user policy if no MFA being used
        if mfa != "true" and not protection_status:
            iam = boto3.resource('iam')
            user_policy = iam.UserPolicy(UserName,'disable_user')
            response = user_policy.put(PolicyDocument='{ "Version": "2012-10-17", "Statement": [{"Sid": "Disableuser01","Effect": "Deny","Action": ["ec2:StopInstances", "ec2:TerminateInstances"],"Resource": ["*"]}]}')
            print response



How near  this "near real time" events:
My test showed about 40 second delay. IMHO too much for the "near real time". I'm looking for the potential bottleneck and delays that may caused by Lambda function itself on Event type I used. 


Conclusions:
- not a "near real time" to react fast and mitigate attack without additional protective measures.
- could work if you able to detect attack 40 second earlier
- could reduce overall damages
- definitely very very promising if reaction delay will be less (let's say 5-10 sec).

Update:

Fill free to pull from GitHub AWS CloudFormation template for the  PoC above.

To deploy you need: 

1. selfdefence.infosec.vpc.json - template itself.

2. selfdefence_infosec.py - Lambda function. You will need to Zip it and upload to the s3 bucket with versioning enabled.

3. Edit template (selfdefence.infosec.vpc.json) and specify: S3 bucket name in format you.bucket.name.env.cloudform (where env - is your environment name: prod, test, staging, etc) and S3 version for  selfdefence_infosec.zip file. 

4. upload template to the same s3 bucket.

5. Create a stack using this template end specify corresponding environment name at the creation time.

Enjoy! 

AWS CloudFormation template security group viewer

        Almost any AWS CloudFormation template are more then long enough. It's OK when you are dealing with different relatively "static" resources but become a big  problem for something way more dynamic like security group.
    This kind of resource you need to modify and review a lot, especially if you cloud security professional.  Reading AWS CloudFromation template JSON manually  makes your life miserable and you can easily miss bunch of security problems and holes.
     My small aws_secgroup_viewer Python program helps you to quickly review and analyse all security groups in your template.

     https://github.com/IhorKravchuk/it-security/blob/master/aws_secgroup_viewer.py

     Supports both security group notations used by CloudFormation: firewall rules inside security group or as separate resources linked to group.

Using CFEngine for Linux systems hardening

What is CFEngine? The best answer to this question is CFEngine website: https://cfengine.com/what-is-cfengine

In nutshell CFEngine is "is a popular open source configuration management system, written by Mark Burgess. Its primary function is to provide automated configuration and maintenance of large-scale computer systems, including the unified management ofservers, desktops, embedded networked devices, mobile smartphones, and tablet computers." Wiki

I'm using CFengine for various sysadmin and infosec tasks and it proved to be  reliable and stable configuration management system.

I would like to share with you cfengine promises (  system configuration description written on cfengine language  ) for the RH based Linux systems. These "promises" enforce system to become and stay hardened, provide centralized user management and take care of initial system configuration.

https://github.com/IhorKravchuk/cfengine


file system_setup.cf - covers system configuration and hardening.
file users.cf - user and group management
file site.cf - allows you to describe different environments or data-centers (Global variables for the system configuration )
file promises.cf - main file that links all components together.
file update.cf and failsafe.cf - responsible for promises update in normal operations and in case of failure.

I'll add more comments and descriptions in subsequent code release or upon your request.
IMHO the code is self-explaining and really easy to read  as soon as you become familiar with a basic CFEngine principles.

Junk Cloud POC project.

Junk Cloud is fast deploying CloudStack environment running on KVM hypervisor and using outdated equipment.

As first attempt to build Junk Cloud I have tested CloudStack baremetal support. What I expect from baremetal support?

• reduce time to configure and deploy each host
• you can add computing resources (physical hosts) to the cloud in a minutes instead of hours. 
• fast deployment of the new private cloud
• allow easy utilization of outdated hardware

Unfortunately CloudStack built-in baremetal support is limited: http://cloudstack.apache.org/docs/en-US/Apache_CloudStack/4.2.0/html/Installation_Guide/choosing-a-hypervisor.html

• not support advanced networking
• not support central storage (SAN)
• not support vmotion and HA

So, it was decided to build own version of the barematal support for theCloudStack:

• network boot (pxe boot)
• network auto install of lnux + kvm + network + CloudStack
• storage configuration 
• upon completion auto selfprovisionng to the CloudStack as a new host (resource)

The Anaconda install script for building and configuring Centos based KVM host for CloudStack (Advanced networking support) on GitHub:  https://github.com/IhorKravchuk/cloudstack_ingvar/blob/master/Centos_6x64_kvm_cloudstack.cfg

This script is missing auto selfprovisionng to the CloudStack feature for test purpose. It will be updated after final tests.

Tested and suggested deployment architecture (for the small deployments):

From my point of view implementation of proposed architecture will be:

• core components: cloud controller + network storage installed and configured. 
• to add new host just connect it to network and power.
• all rest done automatically.

Private Cloud? it's that simple:

Build a Cloud Controller:

Add NFS NAS:

And finally add all your old hardware:

Open Security Self-Test initiative

Hi folks!

I'd like to establish  Open Security Self-Test initiative:

It' will allow any user to make security audit of his gadget (laptop, tablet, smartphone) on free of charge and self-service basis.

Desc: Free wifi APs located in public places connected to special designed security audit server.

• All users nearby will be able connect to this AP (all communication gonna be encrypted, password for connection will be included into AP's SSID )
• After connection to AP, user's workstation security scan will be started and all user's trafic to Internet (or Internet emulation sandbox) will be monitored by NIDS.
• In couple of minutes user will get  report about any security threats found on his workstation and short recommendations how to solve the problems including the links to updates/patches and free/trial anti-viruses.
• All security audits will be done by open-source solutions (some commercial tools could be involved if  vendors will allow such usage)
• Whole solution will work on free of charge basis.

Architecture:

Updated: 

Proposed architecture could use Cloud tendency: in this case  Security Audit Servers will be located in the Cloud and being connected by VPN to distributed across the world WiFi APs. APs will use modified firmware (OpenWrt) and tunnel all the traffic from connected users' gadgets to the Cloud.
It will definitely reduce the operation costs and give a great scalability, flexibility and reliability for whole solution.

1. Access Point (AP)

2. Security Audit Server/s  including:

• Captive portal 
• Firewall
• Vulnerabilities  scanner/s
• Network Intrusion Detection System (NIDS)
• Internet connection or Internet emulation

Current implementation:

Nginx+ Bind+iptables+snort+ nmap +OpenVAS+tcpdump+Scripts


Usage:

1. User  connects to public AP by his laptop, tablet or smartphone. PSK for connection included in broadcasted AP's SSID. Connection encrypted.

User get IP form DHCP and all connection attempt forwarded to Captive portal

2. Users establish connection via https with Open Security Self-Test web server.
Read end-user agreement, Accept it and start the security audit:

3. Vulnerabilities scan runs against user's device:

4.  During vulnerabilities scan and mostly after it user computer get connected to Internet (or Internet emulation). All traffic between user's device and Internet intercepted and monitored by NIDS.

5. Finally, user will get brief (with option to download full) description of security problems found and recommendations how to fix it. Recommendations will include links to vendors' patches, updates and free and trial antivirus software.

During security audit process user will see progress bar and will be able surf Internet.



Current stage: Alfa-testing.  Scheduled for  first implementation on late February, Montreal, QC.

Solution could be implemented on a stand-alone basis in public places or as a part of current free-WiFi access infrastructure. Showing advertisement to a users during the scan will allow using some commercial security audit solution or ,even, make project profitable.

PKI authentication and legacy web application

One of the most secure ways of user authentication- is the PKI authentication. A lot of modern systems support this method and everything works nice and smoothly (almost everything - details in the my next post). But, as usually, in real big enterprise you have a dilemma: you need the strongest authentication but you have a lot of legacy systems (or it takes ages to get changes in authentication method from vendor).

The best way (IMHO) to resolve this problem is to use mutual ssl on certificates.

SSL will terminate on reverse proxy server in front of your Business Application Server inside the high secure network zone . So, here the scheme:

It looks really easy, isn't it?

How it works:

1. Each user has his own certificate and private key. It could be located on smart card, token or inside OS key storage.

2. User's browser must be configured to use this certificate for authentication (It's easy - just import it in browser or point it to OS key storage)

3. User must connect to revers proxy server (ssl termination point) for getting access to Business Application Server.

4. Revers proxy server checks validity of user's certificate and some certificate's fields (if you need to restrict access to only some users groups) like OU, CN or "extended key usage" and establish mutual ssl connection.

5. Revers proxy server offloads ssl and make direct connection over http (or non-mutual ssl connection) to your business application server.

6. Business application server authenticate user and authorised them by user/password pair.

The key point of this scheme is the Revers Proxy Server with ssl offloading feature (May be the better name for it - Secure Application Gateway).

How this servers looks like?

1. Open Source:

Any *nix + Apache web server with mod_proxy and mod_ssl + some changes in Apache config for certificate verification.

2. Load balancer or Web Application firewall from your favorite vendor. I have tested this on F5 BigIP and everything works perfectly.

Almost forget. You will get a lot of users' web request logging possibilities during  implementation of this scheme. So you can easily control users' activity within business application server.

That's all folks. Stay secure.

using smart card for standalone management station security

Dedicated standalone management workstation frequently used for control automated equipment (telco systems, smart devices, etc) and is a part of vendor's solution. Usually these stations run on Windows and vendor do not recommend to connect it to the domain or it couldn't be done (or not recommended) by some technical reasons.

Very often these management nodes control company's mission critical equipment, so, password protection not enough for real security. For better security you must use two-factor authentication. I prefer to use smart card. The problem is, that normally, windows does not support smart card authentication on standalone workstation. But,there is a trick: you can use smart card for store windows password on it. In this case your smart card vendor must provide custom logon GINA. In my case ActivIdentity provide me this GINA and all necessary software. So, what have been done:

1. Created a list of management nodes

2. Installed smart card drivers and software on each node.

3. Create account for each technician and store it on smart card. (Hint: password must be randomly generated or created manually by 2 persons who only know a part of whole password. )

4. Prohibit user from changing password manually.

5. If you would like to secure even physical network connection of this node - add 802.1x support based on smart card certificates (But it a bit more tricky)

More over, using this scheme you could create a high secure management node for emergency direct access to your mission critical systems (bypassing terminal servers, firewalls or switches)

Vulnerabilities scanners architecture in big enterprise

Let's talk about vulnerabilities scanners within corporate security infrastructure. Everybody knows that vulnerability identification is one of the major component of security risk management process. So we must be sure that information about vulnerabilities is correct and up to date .
It's easy when you scan the network from your own laptop and use direct connection to the target system. But what about huge corporate network with a lot of routers, firewalls and packet filters between you and target system?
First of all you must install multiply instances of vulnerabilities scanners across the network. why you should avoid to use one scanner for all network ?
- compromising this scanner will give possibilities to attacker easily get access to all hosts. (For same scanner it's snap - IBM ISS internet scanner only works on Windows XP SP1 , so the scanner is vulnerable himself. )
- scanning through the firewalls will impact to the scan performance and could produce firewall cpu overload.
-low accuracy of the scans results (firewalls, routers and packets filters between scanner and the target can distort the scan )
So, does installing multiply scanner fix all problems? Sure thing, not. What about scan accuracy? It's depends of scanners and network configuration. So, if you would like to get trusted result you must be sure in scanner and network configuration before run each scan. It is not easy and can consume a lot of time without any warranty. How to solve this problem? Just do the same as engineers do for the precision instruments - calibrate them using master or template.
I recommend to use a bunch of calibration systems and allocate them across the network. It could be virtual systems based on well known vulnerable distributive such as Damn Vulnerable Linux or simple unpatched Windows with a test services running.
So, before scan the target system you must choose nearest calibration system, scan it and check result for accuracy. From my experience it's very important to do this because often even very famous vulnerabilities scanners fail during simple scan.

Terminal server with advanced logging capabilities.

How we (Information security guys) get the information about user activities within information system? Sure thing – from the logs, produced by this system. But what could we do if some business critical system do not produce such logs or we cannot trust them? It could be in cases below:

1. Legacy system with no logging at all.

In the any big enterprise you can find old legacy system that have been designed a lot of years ago and do not fit any information security requirements at all. Very often you even haven’t possibility to install any additional software on such system (restricted by vendor or lack of performance). Sure thing you could protect this system from the network side by firewall but it not helps to get more logs from the system inside.


2. Business/ Mission critical systems supported on site or remotely by vendor.
It’s very popular now to give IT system operation support to the vendor or special outsourcing company. It’s very useful and helps to reduce you costs. But what about security? In such case you should fully trust to this company and couldn’t trust to the system logs (they could be changed easily with admin privileges on system and vendor knowledge of the system internals).

3. Protect your Business/ Mission critical systems from the evil systems administrators’ activities.
These guys have full knowledge and enough permission to do whatever they want. Sure thing well designed system must send logs to the central log’s storage and you could do investigation based on these logs. But what happened if it’s not enough or some subsystem of the system does not produce logs at all?

In all this case you must have a special designed infrastructure with terminals servers with advanced logging capabilities and give users access to the protected systems only through this terminal servers.

So , below samples of such infrastructures for each case.

1. Legacy system with no logging at all.




Except terminal server in this case sometimes you will need install network sniffer for control data flow within legacy information system (because old switches do not support acl or installing acl on network equipment prohibited by vendor )

2. Business/ Mission critical systems supported on site or remotely by vendor.



3. Protect your Business/ Mission critical systems from the evil systems administrators’ activities.



There are a lot of very expensive commercial terminal server solutions that could record all activities and produce a lot of logs or even be a man of the middle for ssh session. From my point of view one of the best solutions is Shell Control Box from Balabit. But it cost a lot and you should by license per each user ho access to the system and per each server access to whom this device protect.

In this article I gonna propose you alternative solution that will be much much cheaper but have almost the same functionality.

As a terminal server core I use Windows Terminal Server (Windows Server 2003). I chose licensing type – per user, but you could choose whatever you want.

1. Installing Windows Server 2003 and Terminal Server Service

Here there are two options:

• use local authentication for terminal users (for small amount of users )

• join the AD domain and use domain authentication for terminal users (for big amount users). If your company do not use AD, but you need to manage a lot users, especially on a multiply terminals servers you could install special AD Domain controller for this purpose.

Registering Windows Terminal Server and installing CAL licenses. (On domain controller for multiply terminal servers within domain)

2. Hardening terminal server.

First of all install Microsoft Windows Server 2003 Security Guide Tools and Templates (download it from Microsoft site) and configure your server as a Specialized Security - Limited Functionality server.

Then turn off or uninstall all unused services and windows components.

Modify the group policy and the registry to prohibit users to mount disk, copy clipboard, redirect ports and etc through RDP.

Do not forget do disable windows admin shares!

3. Set up a file share for users file transfer.

Very often users should have possibility to copy files to or from protected servers. We cannot allow users to use for this purpose RDP drive mounting for a lot of security reasons. The best way is to setup dedicated file share for such purpose. So, how user will transfer file to the protected area?
First of all user copy file to the terminal server file share. After that, he logon to the protected area through terminal server and copy file from terminal server to the protected server. So, he uses the terminal server as temporary transfer storage.

For you , as a security guy, it give possibility to copy this files for further analysis, scan it by anti-virus, log file transfer event, etc.

So, what should you do for this:

• Create a file share on separate disk.

• Turn on disk quotas.

• Modify folder and subfolder permissions for allowing only to file owner view o modify own files and folders. (It will protect information of one user from others during file transfer through terminal server)

4. Install Antivirus software and configure it to scan files in shared folder.

5. Install a Screen Anytime software.

It cost about 1K$ per terminal server without session limitation. This really amazing soft could capture the user’s terminal session and store it as a high compressed video file. More over this software provide you session player and records management tools.
Configure Screen Anytime software for recording all session in shadow mode (hide it from users). If you have centralized log storage you can configure this software to send captured session video files to this log storage from all your terminals servers.

6. Change default shell to mstsc.exe instead of explorer.

Changing shell you prevent users from access data and software stored on terminal server. So, users can only go through this terminal server without possibilities to do something on the terminals server.
So, using mstsc ( RDP client) you can easily manage only windows servers.
But what happens if you would like to control access to the unix based systems? No problem! Create custom shell based on ssh client like Putty or even write small shall and include in it RDP, ssh, sql or other clients that you need. I strongly recommend you to check and modify these clients for preventing user access to terminal server file system. For example in my terminal server I using modified Putty with record session option and without any possibility to change it. So, I get two logs in one time: video from Screen Anytime and commands log in text from Putty.

7. Create a custom startup script to start Screen Anytime video capture on user log on.

Normally Screen Anytime does it for you. But, when you change this default shell you must take care of starting screen capturing.

8. Configure and startup a firewall.

Transit terminal server infrastructure
Sometimes you would like to allow users to install some software on terminal server or you cannot modify some client software to securely install it on terminal server. I recommend you to create a chain of terminal servers. First terminal server will have mstsc ( RDP client) as a shell and work as a transit terminal server with one purpose – record users activity. First server will only allow user to get to second terminal server. On this terminal server users will have all their software installed or even be administrators!



This scheme works amazing especially in case number 2 - giving ability to vendor easily remotely support your business critical systems.





Last tip: Use virtual infrastructure for these terminal servers! It really simplify your life.

That’s all folks!

Security requirements for new Information systems

Any company that taking care about information security should have a some security requirements or standard.
Usually it's huge and very formal document created for using within the company. It's OK.
But, what's happens when some new information system (product, solution ) have purchased from foreign supplier and going to integration with your corporate environment? Sure thing this new system must pass your security audit. Lucky you if everything ok. But what could you do if not? Even if couple of words about security exist inside contract or agreement with supplier you will spent a lot of time pushing him to close security holes and slow down whole integration and whole project.
From my point of view the best way to save your time and money is to create short and concrete document calling "Security requirement for new IS " and make whole this document a part of agreement with supplier.
Sample of this document you can find below :

General IS Security Requirements
1.Information systems (IS) should be installed with maximum possible level of security (“hardened” mode)
2.All unused or service accounts (including OS/application standard ones) should be disabled or deactivated
3.On IS must be started only those services and applications which are required for functioning of this IS or Company’s business-processes
4.Unauthorised installation and initiation of services which provide functioning of the data transmission network (i.e. DHCP, DNS, all type of PROXY, NTP, SMTP relay, Gating/Routing, LPD, VPN, etc) are strictly forbidden
5.All integrated IS should pass an obligatory technical audit in Infosec group, considering such phases:
System architecture concordance on the phase of supplier's choice or technical decision
Audit of technical document on the chosen decision or system
IT audit prior to putting IS into operation in accordance with Company’s statutory acts
6.After making considerable alterations to the system (equipment, OS or application upgrades) it obligatory to conduct technical audit like in p.5
7.Test and development systems/instances should not contain any confidential information, either contain it in coded, incomplete and/or distorted way

Privileged access requirements
1.Remote privileged user authentication should be forbidden everywhere where it is technically feasibly
2.Remote privileged access is allowed only in case of production necessity, considerable reasons and only with the use of secure protocols (ssh, sftp/scp, SecureVNC, etc)
3.All actions, which do not require privileged rights for its execution should be made on behalf of less privileged accounts

Audit requirements
1.All implementing IS should synchronize system time with the specially selected NTP-server, which is a part of network infrastructure
2.Logging should be switched on. If it is possible, log files should be stored in encrypted way at least three months locally, whereupon must be copied and kept remotely, at least, three years in specially designed system
3.Log files should contain at least the following information:
-Successful or unsuccessful registration attempts in the system
-Name of the executed operation
-Object of the operation
-User login
-Result of operation
-Date and time of the event
-All privileged users’ actions (at least system and administrative accounts)


Updates and antivirus software requirements
1.Security updates should be installed as soon as they become available. If its possible, such updates should be tested on test IS prior to installation
2.In case of unstable work of updates, supplier or company, carrying out IS support, owes in strictly stipulated in Agreement on support terms (but less than in seven days) to propose and implement alternative decision of the security issue
3.For IS based on Windows OS it is obligatory to use anti-virus software with the regular automatically bases updates
4.Operating systems and application software should be of the latest stable release or updated to those versions which provide maximal level of protection (absence of known vulnerabilities, described in different security bulletins, bugtracks)


Password and authentication requirements
1.Implementing IS should provide the obligatory authentication mechanism for users. Use of the systems which do not support this mechanism is forbidden
2.IS should not give out any information about system type and version or any prompts or “system banners” prior to successful completion of authentication procedures
3.Verification of input information (login, password) is carried out only after its complete input. In case of an error, the system must not specify, whether user name or password entered incorrectly. Password should not be displayed while being entered
4.Logical access to IS resources should be granted only after the successful user identification and authentication
5.It is forbidden to save password undisguised in IS, executable files, scripts, databases, on servers, etc.
6.Password storage and transmission between client and authentication server should be carried out in protected by cryptographic algorithms way or with the use of protected communication channels
7.Created or acquired IS should comply the following requirements:
To grant users an opportunity to choose their password independently (letter-digital combinations) and change it at any time
To control changing of the primary password set by administrator during first logon to the system and checks up its quality in compliance with certain requirements (length, structure requirements - small or capital letters, digits, non-trivial password, etc)
To provide forced changing of password through the preliminary set interval of time
To have an opportunity to notify users in advance about the necessity of password changing (by means of reports/prompts or emails)
If user password was not changed until the date, set in advance, the system should have an opportunity to block user account
Provides storage for user's password history, at least, for the last 12 months for prevention of repeated use
To have an opportunity to set amount of unsuccessful login attempts, whereupon user account should be blocked for certain period
To have an opportunity to predefine user session duration, whereupon it should be interrupted
8.Password file or database owe kept separately from application programs using cryptographic methods. Only proof algorithms should be used


Data storing and exchange requirements
External systems
1.Any confidential data exchange process through external channels should be carried out with the use of encrypted data channel, with the use of one of the following protocols:
HTTPS with key not less than 128 bit
SFTP
S/MIME with the use of PGP
Х25 data exchange channel or VPN
2.Remote software support can be carried out by suppliers only with the use of VPN
3.Whether it is impossibility to use transmission methods, described in p.6.1, any confidential or sensitive information should be encrypted with the use of proof cryptographic algorithms
4.If IS requires an access to the Company systems or databases, located in Company's intranet, these IS must consist at least of two servers (WEB/Gateway server/Reverse proxy and Application Server) for placing them in DMZ or Application Zone. It is also necessary that exchange by information between these servers was in encrypted
5.If IS supposed to work with customer individual information (mail for subscribers, state of accounts, baskets of electronic shops, etc) then encrypted protocols should be used (https, iiop/ssl)

DMZ
6.IS, located in DMZ, must not contain any confidential information in order to avoid its loss as a result of hack attacks from public networks
7.IS which is assumed to place in DMZ should be built exceptionally on products and operating systems, satisfying all security requirements and having good producer's support
8.Setting up of the servers, operating under OS Microsoft in DMZ is forbidden, except for the cases when supplier guarantees compensation of all direct and indirect damages in case of system compromising

Company’s network
9.Only secure protocols of interaction between servers and information systems should be used, if it is possible


Service Level Agreements
1.In case of finding out critical OS/application vulnerabilities, IS supplier owe if it is possible to undertake certain actions on the removal of these vulnerabilities (development or installing of patches/updates) within the time described in SLA, but noе more than 7 days from the moment of vulnerability detection/proper patch release