If you’re planning to take the Security+ exam, you should have a good understanding of appropriate solutions to establish host security. This includes operating system and application hardening that protects management interfaces and applications.
For example, can you answer this question?
Q. Attackers recently attacked a web server hosted by your organization. Management has tasked administrators with reducing the attack surface of this server to prevent future attacks. Which of the following will meet this goal?
A. Disabling unnecessary services
B. Installing and updating antivirus software
C. Identifying the baseline
D. Installing a NIDS
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Disabling Unnecessary Accounts
Many operating systems and applications come with default accounts. A basic principle in hardening systems and applications is to disable unnecessary accounts before deploying the system. For example, the Guest account is disabled by default in current Windows systems, but in the past, administrators disabled it before deploying Windows systems.
Similarly, database server applications include default database accounts and have used blank or default passwords in the past. If the deployed application doesn’t need the default accounts, administrators disable them before deployment. If the application needs the accounts, administrators ensure the accounts have strong passwords.
Some applications also include backdoor accounts. A backdoor is an access point to an application or service that bypasses normal security mechanisms. Developers use backdoors for legitimate purposes to view the internal workings of an application or for ease of administration. However, the use of backdoors is strongly discouraged in the final released version. If a backdoor exists, you can expect attackers to locate and exploit it.
Eliminating Unneeded Applications
In addition to disabling unnecessary services to reduce vulnerabilities, it’s important to uninstall unneeded software. Software frequently has bugs and vulnerabilities. Although patching software frequently closes these vulnerabilities, you can eliminate these vulnerabilities by simply eliminating unneeded applications.
Management Interfaces and Applications
Many devices and applications have built-in tools used for administration. These tools often provide administrators with the ability to manage the devices, but their access needs to be protected to prevent unauthorized personnel from modifying them. One of the primary ways you can protect them is by disabling unnecessary accounts and changing the default passwords.
As an example, Chapter 4 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide covers wireless networks and many wireless devices come with predefined accounts and passwords used in the application. A common combination is an Administrator account named “admin” and a password of “admin.” Unless this password is changed, an attacker can easily break into the network and cause considerable damage.
It’s also important to use best practices when creating and modifying passwords.
Q. Attackers recently attacked a web server hosted by your organization. Management has tasked administrators with reducing the attack surface of this server to prevent future attacks. Which of the following will meet this goal?
A. Disabling unnecessary services
B. Installing and updating antivirus software
C. Identifying the baseline
D. Installing a NIDS
Answer is A. Disabling unnecessary services is a primary method of reducing the attack surface of a host.
Installing up-to-date antivirus software is valid preventive control, but it doesn’t reduce the attack surface.
Identifying the baseline should be done after disabling unnecessary services.
A network-based intrusion detection system (NIDS) helps protect the server, but it doesn’t reduce its attack surface.
If you’re studying for the SY0-501 version of the exam, check out the CompTIA Security+ Get Certified Get Ahead: SY0-501 Study Guide.
