Tag Archives: hardening

Enhancing Security: Managing Browser and Email Client Plugins with GPO in Active Directory

Posted on by
Reply

Controlling and managing plugins across various browsers and email clients is crucial for maintaining a secure enterprise environment. This blog post will explore how to effectively manage these plugins using Group Policy Objects (GPOs) in an Active Directory (AD) setting, aligning with the Center for Internet Security (CIS) Critical Security Controls Version 8.

The Importance of Plugin Management

CIS Control 2: Inventory and Control of Software Assets emphasizes the need to actively manage all software on the network. This includes plugins for browsers like Internet Explorer, Edge, Chrome, Firefox, and email clients such as Outlook, which can be potential vectors for security breaches if left unmanaged.

Implementing Plugin Management with GPO

Here’s a comprehensive guide to manage plugins using Group Policy across different browsers:

  1. Create a New GPO: In the Group Policy Management Console, create a new GPO or edit an existing one.
  2. Configure Internet Explorer Settings:
    • Navigate to User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer
    • Enable “Prevent running of extensions not listed in the Add-on List”
    • Add approved extensions to the “List of Approved Add-ons”
  3. Manage Microsoft Edge Settings:
    • Go to Computer Configuration > Policies > Administrative Templates > Microsoft Edge
    • Enable “Control which extensions cannot be installed”
    • Use “Allow specific extensions to be installed” to whitelist approved extensions
  4. Configure Google Chrome Settings:
    • Navigate to Computer Configuration > Policies > Administrative Templates > Google > Google Chrome > Extensions
    • Enable “Configure extension installation whitelist”
    • Add the extension IDs of approved extensions to the whitelist
  5. Manage Mozilla Firefox (requires additional setup):
    • Firefox requires the Firefox ADMX templates to be added to your Group Policy Central Store
    • Once added, go to Computer Configuration > Policies > Administrative Templates > Mozilla > Firefox
    • Enable “Extensions to Install” and specify allowed extensions
  6. Configure Email Client Plugins (Outlook):
    • Go to User Configuration > Policies > Administrative Templates > Microsoft Outlook > Security
    • Enable “Disable all COM add-ins”
    • Use the “List of Managed Add-ins” to specify allowed add-ins
  7. Apply GPO to Relevant OUs: Link the GPO to the appropriate Organizational Units (OUs) containing user accounts and computer objects.
  8. Test and Monitor: Apply the GPO to a test group before rolling out organization-wide. Monitor for any issues and adjust as necessary.

Aligning with CIS Controls

This comprehensive approach aligns with several CIS Controls Version 8:

  • Control 2: Inventory and Control of Software Assets
  • Control 4: Secure Configuration of Enterprise Assets and Software
  • Control 7: Continuous Vulnerability Management
  • Control 12: Network Infrastructure Management

By implementing these policies across various browsers and email clients, you’re taking significant steps towards a more secure and standardized environment.

Additional Considerations

  1. Browser Diversity: Be aware that different browsers may require different GPO settings. Ensure your policies cover all browsers used in your organization.
  2. Third-party Management Tools: For more granular control, especially in environments with multiple browsers, consider using third-party extension management tools that integrate with GPO.
  3. Regular Updates: Browser vendors frequently update their GPO capabilities. Stay informed about new policy options and adjust your configurations accordingly.
  4. User Education: Implement a policy to educate users about the risks of unapproved plugins and the process for requesting new plugins if needed for work purposes.

Regular Review and Updates

Remember to regularly review and update your plugin management policies. New plugins may need to be added to the approved list, while others may need to be removed due to emerging security concerns or obsolescence.

Conclusion

Managing plugins across various browsers and email clients through GPO is an effective way to enhance your organization’s security posture. It provides centralized control, reduces attack surfaces, and helps maintain compliance with cybersecurity best practices across diverse software environments.

Need assistance implementing this multi-browser approach or other security controls? The experts at MicroSolved are here to help. Contact us today to strengthen your organization’s cybersecurity defenses and ensure compliance with industry standards like the CIS Critical Security Controls.

 

 

* AI tools were used as a research assistant for this content.

Improving Enterprise Security Posture with MachineTruth: Global Configuration Assessment

Posted on by
Reply

 

In today’s complex IT environments, ensuring proper and consistent device and application configurations across an entire enterprise is a major challenge. Misconfigurations and unpatched vulnerabilities open the door to cyberattacks and data breaches. Organizations need an efficient way to assess their configurations at scale against best practices and quickly identify issues. This is where MicroSolved’s MachineTruth: Global Configuration Assessment comes in.

MTSOC

MachineTruth is a proprietary analytics and machine learning platform that enables organizations to review their device and application configurations en masse. It compares these configs against industry standards, known vulnerabilities, and common misconfigurations to surface potential issues and ensure consistency of controls across the enterprise. Let’s take a closer look at the key features and benefits of this powerful assessment.

Comprehensive Config Analysis at Scale

One of the core capabilities of MachineTruth is its ability to ingest and analyze a huge volume of textual configuration files from an organization’s devices and systems. This allows it to provide a comprehensive assessment of the security posture across the entire IT environment.

Rather than having to manually check each individual device, MachineTruth can review thousands of configurations simultaneously using advanced analytics and machine learning models. It understands the formats and semantics of various config file types to extract the relevant security settings.

Not only does this drastically reduce the time and effort required for such a wide-ranging assessment, but it also ensures that the review is exhaustive and consistent. No device is overlooked and the same benchmarks are applied across the board.

Comparison to Standards and Best Practices

MachineTruth doesn’t just parse the configuration files, it intelligently compares them to industry standards, vendor hardening guidelines, and established best practices for security. It checks for things like:

  • Insecure default settings that should be changed
  • Missing patches or outdated software versions with known vulnerabilities
  • Inconsistent security controls and policies across devices
  • Configurations that violate the organization’s own standards and requirements

By analyzing configurations through the lens of these guidelines, MachineTruth can identify deviations and gaps that introduce risk. It augments the automated analytics with manual reviews by experienced security engineers using custom-built tools. This combination of machine intelligence and human expertise ensures a thorough assessment.

Actionable Reports and Remediation Guidance

The findings from the assessment are compiled into clear, actionable reports for different audiences. An executive summary provides a high-level overview for leadership and less technical stakeholders. A detailed technical report gives security and IT managers the information they need to understand and prioritize the issues.

Crucially, MachineTruth also provides mitigation recommendations for each finding. It includes a spreadsheet of all identified misconfigurations and vulnerabilities, sorted by severity, with a suggested remediation step for each. This enables the IT team to immediately get to work on fixing the issues.

For even easier remediation, device-specific reports can be generated listing the problems found on each individual machine. These are immensely useful for the personnel who will be implementing the changes and closing the gaps.

By providing this clear guidance on what needs to be fixed and how, MicroSolved helps organizations quickly translate the assessment results into meaningful corrective actions to reduce their cyber risk.

Flexible Engagement Model

MicroSolved offers flexible options for engaging with the MachineTruth assessment to match different organizations’ needs and capabilities. The typical process takes 4-8 weeks from when the configuration files are provided to the generation of the final reports.

Customers can gather the necessary configuration files from their devices on their own or with assistance from MicroSolved’s team as needed. The files are securely transferred to MicroSolved for analysis via an online portal or designated server. The assessment team keeps the customer informed throughout the process of any significant issues or signs of compromise discovered.

For organizations that want an ongoing program to maintain proper configurations over time, multi-year engagements are available. This continuity enables MicroSolved to provide enhanced features like:

  • Tracking reporting preferences to streamline assessments
  • Showing trends over time to measure improvement
  • Storing customer-defined policies and standards for reference
  • Tuning findings based on accepted risks and false positives

These value-added services optimize the assessment process, accelerate remediation work, and help demonstrate the security program’s progress to both technical personnel and executive leadership.

Focus on Outcomes Over Rote Auditing

With MachineTruth, the focus is on identifying and mitigating real issues and risks, not just rotely comparing settings to a checklist. While it leverages standards and best practices, it goes beyond them to surface relevant problems given each organization’s unique environment and requirements.

The assessment process includes validation steps and quality checks, with peer reviews of findings before they are finalized. The reporting phase involves dialogue with the customer to make sure the results are accurate, understandable, and suited to their needs. Workshops and presentations help various stakeholders understand the outcomes and key mitigation steps.

By emphasizing communication, practical guidance, and alignment with the organization’s goals, MicroSolved ensures the assessment delivers meaningful results and measurable security improvements. It’s not just an audit report to stick on a shelf, but an action plan to strengthen the organization’s defenses.

Conclusion

Proper configuration of devices and applications is a fundamental part of any organization’s security program, but one that is increasingly difficult to get right given the scale and complexity of modern IT environments. MicroSolved’s MachineTruth: Global Configuration Assessment harnesses the power of machine learning and data analytics to verify configurations en masse against standards and best practices.

This innovative assessment enables organizations to efficiently identify and remediate misconfigurations, vulnerabilities, and inconsistent controls across their IT infrastructure. With clear, actionable reports and a flexible engagement model, MicroSolved makes it easier to strengthen security posture and concretely mitigate risks.

As cyber threats continue to escalate, organizations need next-generation assessment capabilities like MachineTruth to meet the challenge. It marries the subject matter expertise of world-class security professionals with the speed and scalability of artificial intelligence to deliver a truly enterprise-grade solution for configuration security.

More Information

To learn more about MicroSolved’s MachineTruth: Global Configuration Assessment and how it can help improve your organization’s security posture, contact us today. Our team of experienced security professionals is ready to discuss your specific needs and provide a tailored solution. Don’t wait until it’s too late; take proactive steps to strengthen your defenses and mitigate risks. Contact MicroSolved now and empower your organization with advanced configuration security capabilities. (Email info@microsolved.com or call us at +1.614.351.1237 to speak to our expert team)

 

* AI tools were used as a research assistant for this content.

 

How To Implement a Basic ZTNA Architecture

Posted on by
Reply

 

Implementing a Basic Zero Trust Network Access Architecture

Implementing a Zero Trust Network Access (ZTNA) architecture is increasingly essential for organizations aiming to secure their networks against evolving cyber threats. Zero Trust is a security concept centered on the belief that organizations should not automatically trust anything inside or outside its perimeters and instead must verify everything trying to connect to its systems before granting access.

1. Define the Protect Surface

Identify the critical data, applications, assets, and services (DAAS) that need protection. This step is crucial as it allows you to focus your resources and security measures on the most valuable and vulnerable parts of your network.

2. Map the Transaction Flows

Understand how traffic moves across your network. Mapping the traffic will help you identify legitimate access patterns and needs, which is essential for setting up appropriate security policies.

3. Architect a Zero Trust Network

Create a micro-segmented network architecture. Micro-segmentation involves dividing the network into small zones to maintain separate access for different parts of the network. Each segment or zone should have its own security settings, and access should be restricted based on the principle of least privilege.

4. Create a Zero Trust Policy

Develop a policy that specifies how resources in the network are accessed, who can access these resources, and under what conditions. This policy should enforce that only authenticated and authorized users and devices are allowed access to the specified network segments and resources.

5. Monitor and Maintain Network Security

Implement security monitoring tools to inspect and log network traffic constantly. This can help detect and respond to threats in real-time. Regular audits and updates of the zero trust policies and architecture should be performed to adapt to new threats and changes in the organization.

6. Leverage Multi-factor Authentication (MFA)

Enforce MFA to ensure that the chance of unauthorized access is minimized. MFA requires users to provide two or more verification factors to gain access to a resource, adding an extra layer of security.

7. Implement Least Privilege Access

Ensure that users only have access to the resources that they need to perform their job functions. This should be strictly enforced through rigorous access controls and ongoing management of user permissions.

8. Utilize Endpoint Security Solutions

Secure all endpoints that access the network by ensuring they meet the security standards before they are allowed to connect. This often includes anti-malware and anti-virus software, and endpoint detection and response (EDR) solutions.

9. Educate and Train Employees

Provide regular training to all employees about the cybersecurity policies, the importance of security in the workplace, and best practices for maintaining security hygiene. A well-informed workforce can be your first line of defense against cyber threats.

10. Engage Expert Assistance

For organizations looking to develop or enhance their Zero Trust architectures, it is often beneficial to engage with cybersecurity experts who can provide tailored advice and solutions. MicroSolved, Inc. (MSI) has been at the forefront of information security, risk management, and compliance solutions since 1992. MSI offers expert guidance in strategic planning, configuration, policy development, and procedure optimization to ensure your Zero Trust implementation is robust, effective, and tailored to your specific organizational needs. Contact MSI to see how we can help your security team succeed in today’s threat landscape.

 

* AI tools were used as a research assistant for this content.

 

3 Essential Tips for Enhancing Site-to-Site VPN Security

Posted on by
Reply

 

Site-to-site VPNs are a crucial tool for securing communication between different network locations. To ensure the utmost security for your VPN connections, consider implementing these three key suggestions:

1. Select Strong Secrets or Secure Certificates

The foundation of any secure site-to-site VPN is the authentication mechanism. Opt for strong pre-shared keys or secure digital certificates when configuring your VPN. Using weak passwords or keys can leave your VPN vulnerable to attacks. Remember, a strong password should be lengthy, complex, and incorporate a mix of letters, numbers, and special characters. Alternatively, employing secure certificates provides an added layer of protection as they are difficult to intercept or guess.

2. Implement Modern, Peer-Reviewed Cryptography

Ensure that your site-to-site VPN employs modern encryption protocols have been rigorously reviewed by the security community. Protocols like IKEv2/IPsec are popular choices that offer robust encryption and authentication mechanisms. Peer-reviewed cryptography guarantees that the algorithms have undergone extensive scrutiny and are less likely to contain vulnerabilities or backdoors. Currently, AES is the suggested cryptographic mechanism for most VPNs. DES and 3DES should be eliminated wherever possible.

3. Create Proper Firewall Rules or ACLs

Managing traffic over your VPN connection is essential for maintaining a secure network environment. Utilize firewall rules or Access Control Lists (ACLs) to carefully regulate data flow between connected sites. You can prevent unauthorized access and potential breaches by explicitly defining what types of traffic are permitted and denied. Regularly review and update these rules to adapt to changing security requirements.

In Conclusion

Enhancing your site-to-site VPN’s security involves strong authentication, robust encryption, and intelligent traffic management. By selecting strong secrets or certificates, implementing modern cryptography, and creating well-defined firewall rules, you can significantly bolster the security of your VPN connections. Securing your network is an ongoing process, so staying updated on the latest security practices and adapting your configurations is essential.

Implement these tips today to build a resilient and secure site-to-site VPN that safeguards sensitive data and ensures seamless communication between your network locations.

 

* Just to let you know, we used some AI tools to gather the information for this article, and we polished it up with Grammarly to make sure it reads just right!

 

3 Essential Raspberry Pi Hardening Steps

Posted on by
Reply

Raspberry Pi hardening is essential for securing your device against attacks.

Here are three essential Raspberry Pi hardening steps:

1. Disable SSH If You Don’t Need It

Disable SSH access to your Raspberry Pi using the following command:

sudo raspi-config

Choose “Advanced Options” and then choose “No ssh”.

2. Change Your Password

Change your password to something secure. You can use the following command:

passwd

3. Update Raspbian

Update your Raspberry Pi’s operating system to the latest version available. This ensures that your device is up to date with security patches and bug fixes.

To update your Raspberry Pi, follow these instructions:

sudo apt-get update

sudo apt-get upgrade

In summary, hardening your device by following these steps will help you protect your Pi from attacks. Making these three basic steps a part of every Pi install you do will go a long way to giving you a safer, more dependable, and more private experience.

 

 

Ask The Experts: New Device Check Lists

Posted on by
2

This time around on Ask The Experts, we have a question from a reader and it got some great responses from the team:

 

Q: “I need a quick 10 item or less checklist that I can apply to new devices when my company wants to put them on our network. What kinds of things should I do before they get deployed and are in use around the company?”

 

Bill Hagestad started us off with:

The Top 10 checklist items a CISO/or equivalent authority should effectively manage before installing, configuring and managing new devices on a network includes the following;

 

1)Organize your staff and prepare them for the overall task of documenting and diagramming your network infrastructure – give them your commander’s network management intent;

2)Create a physical and logical network map – encourage feedback from your team regarding placement of new hardware and software;

3)Use industry standards for your network including physical and logical security, take a good look at NIST Special Publication SP 800-XX Series;

4)Make certain that you and your team are aware of the requisite compliance standards for your business and industry, it will help to ensure you are within legal guidelines before installing new devices or perhaps you may discover the hardware or software you are considering isn’t necessary after all;

5)Ensure that after you have created the necessary network maps for your infrastructure in Step 2) above, conduct a through inventory of all infrastructure which is both critical and important to your business, then document this baseline;

6)Create a hardware/software configuration change procedure; or if you already have his inlace, have your team review it for accuracy; make certain everyone on the team knows to document all changes/moves/additions on the network;

7)Focus not only on the correlation of newly implemented devices on the internal networks but also look at the dependencies and effects on external infrastructure such as voice/data networks – nothing worse than making an internal change to your network and having your Internet go down unnecessarily;

8)Ensure that new network devices being considered integrate gracefully into your existing logging and alerting mechanisms; no need to install something new only to have to recreate the proverbial wheel in order to monitor it;

9)Consider the second & third order effects of newly installed devices on the infrastructure and their potential impact on remote workers and mobile devices used on the network;

10)Install HoneyPoint Security Server (HPSS) to agentlessly & seamlessly monitor external and potential internal threats to your newly configured network….

 

Of course a very authoritative guide is published by the national Security Agency called appropriately “Manageable Network Plan” and available for download @:

 

http://www.nsa.gov/ia/_files/vtechrep/ManageableNetworkPlan.pdf


Jim Klun added:

1. Make sure the device is necessary and not just a whim on the part of management.   Explain that each new device increases risk. 

2. If the device’s function can be performed by an existing internal service, use that service instead. 

3. Inventory new devices by name, IP addresses, function and – most importantly – owners.  There should be a device owner and a business owner who can verify continued need for the device.  Email those owners regularly,   querying them about continued need. Make sure that these folks have an acknowledged role to support the application running on the devices and are accountable for its security. 

4. Research the device and the application(s) its support.  Have no black boxes in your datacenter.  Include an abstract of this in the inventory. 

5. Make sure a maintenance program is in place – hold the app and device owner accountable. 

6. Do a security audit of the device wehn fully configured. Hit it with vulnerability scanners and make sure that this happens at least quarterly. 

7. Make sure monitoring is in place and make very sure all support staff are aware of the device and any alerts it may generate. Do not blind-side the operations staff. 

8. If the device can log its activities ( system and application ) to a central log repository, ensure that happens as part of deployment. 

9. Make sure the device is properly placed in your network architecture. Internet-exposed systems should be isolated in an Internet DMZ.  Systems holding sensitive data should similarly be isolated. 

10. Restrict access to the device as narrowly as possible. 

 

Finally.. if you can, for every device in your environment, log its network traffic and create a summary of what is “normal” for that device.  

Your first indication of a compromise is often a change in the way a system “talks”. 

 

Adam Hostetler chimed in with: 

Will vary a lot depending on device, but here are some suggestions

 

1. Ensure any default values are changed. Passwords, SNMP strings, wireless settings etc.

2. Disable any unnecessary services

3. Ensure it’s running the latest firmware/OS/software

4. Add the device to your inventory/map, catalog MAC address, owner/admin, etc.

5. Perform a small risk assessment on the device. What kind of risk does it introduce to your environment? Is it worth it?

6. Test and update the device in a separate dev segment, if you have one.

7. Make sure the device fits in with corporate usage policies

8. Perform a vulnerability assessment against the device. 

9. Search the internet for any known issues, vulnerabilities or exploits that might effect the device.

  1. Configure the device to send logs to your logging server or SEIM, if you have one.

 

And John Davis got the last word by adding: 

From a risk management perspective, the most important thing a CISO needs to ensure is in place before new devices are implemented on the network is a formal, documented Systems Development Life Cycle or Change Management program. Having such a program in place means that all changes to the system are planned and documented, that security requirements and risk have been assessed before devices have purchased and installed, that system configuration and maintenance issues have been addressed, that the new devices are included in business continuity planning, that proper testing of devices (before and after implementation on the network) is undertaken and more. If a good SDLC/Change Management program is not in place, CISOs should ensure that development and implementation of the program is given a high priority among the tasks they wish to accomplish.

 

Whew, that was a great question and there is some amazing advice here from the experts! Thanks for reading, and until next time, stay safe out there! 

 

Got a question for the experts? Give us a shout on Twitter (@microsolved or @lbhuston) and we’ll base a column on your questions!