Another concept within secure systems design is secure staging and deployment concepts. If you’re planning to take the SY0-501 version of the Security+ exam, you should be able to explain the importance of secure staging deployment concepts. These include sandboxing, controlling the environment, using secure baselines, and performing integrity measurements.
For example, can you answer this practice test question?
Q. A software vendor recently developed a patch for one of its applications. Before releasing the patch to customers, the vendor needs to test it in different environments. Which of the following solutions provides the BEST method to test the patch in different environments?
A. Baseline image
B. BYOD
C. Sandbox
D. Change management
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation are available at the end of this post.
Sandboxing with VMs
Sandboxing is the use of an isolated area on a system and it is often used for testing.
Administrators and security professionals also use sandboxing to test various security controls before deploying them to a live production network. Virtualization provides a high level of flexibility when testing security controls because the environments are easy to re-create. For example, they can test the effectiveness of antivirus software to detect malware released within a sandbox. If the antivirus software doesn’t detect the malware and the malware causes problems, it is easy to revert the system to a previous state. Also, the isolation within the sandbox prevents the malware from spreading.
Similarly, virtualized sandboxes are useful for testing patches. For example, software vendors typically develop software updates and patches, but they need to test them in various environments before releasing them. They could create VMs for multiple operating systems. When they’re ready to test, they turn on one of the VMs, take a snapshot, and then apply and test the patch. If the patch causes a problem, they can easily revert the VM.
Sandboxing with Chroot
Another method of sandboxing is with the Linux-based chroot command. It is used to change the root directory for an application, effectively isolating it. Normally, the root of Linux is designated as / and all other directories can be accessed from here. Users often have their own home directories within the /home directory. For example, Lisa’s root directory on a Linux system might be /home/lisa. Regular users won’t have access to the root directory, but only to files within their directory. In contrast, a root user (or administrator) has root access and can access all files and folders on the drive.
Imagine Lisa is a root user and wants to test an application within an isolated area. She could create a directory named testing in her environment. It would be /home/lisa/testing. She would copy her application files and copy any other required directories such as the /bin and /lib directories into the sandbox directory. She would then use chroot to create the isolated sandbox in the testing directory. This sandbox is often referred to as a chroot jail.
At this point, any commands she enters can only access files within the /home/lisa/testing directory. Additionally, her application can only access files with the same path. If the application is malicious or buggy, it cannot access any system files.
Secure Staging Environment
A secure staging environment includes multiple environments, and typically includes different systems used for each stage. As an example, imagine a software development team is creating an application that will be used to sell products via the Internet. The different environments are:
- Development. Software developers use a development environment to create the application. This typically includes version control and change management controls to track the application development.
- Test. Testers put the application through its paces and attempt to discover any bugs or errors. The testing environment typically doesn’t simulate a full production environment, but instead includes enough hardware and software to test software modules.
The 601 Version of the Study Guide
The CompTIA Security+: Get Certified Get Ahead: SY0-601 Study GuideEach of the eleven chapters presents topics in an easy to understand manner and includes real-world examples of security principles in action.
You’ll understand the important and relevant security topics for the Security+ exam, without being overloaded with unnecessary details. Additionally, each chapter includes a comprehensive review section to help you focus on what’s important.
Over 300 realistic practice test questions with in-depth explanations will help you test your comprehension and readiness for the exam. The book includes:
- A 75 question pre-test
- A 75 question post-test
- Practice test questions at the end of every chapter.
Each practice test question includes a detailed explanation to help you understand the content and the reasoning behind the question. You’ll be ready to take and pass the exam the first time you take it.
If you plan to pursue any of the advanced security certifications, this guide will also help you lay a solid foundation of security knowledge. Learn this material, and you’ll be a step ahead for other exams. This SY0-601 study guide is for any IT or security professional interested in advancing in their field, and a must-read for anyone striving to master the basics of IT security.
- Staging. The staging environment simulates the production environment and is used for late stage testing. It provides a complete but independent copy of the production environment.
- Production. The production environment is the final product. It includes everything needed to support the application and allow customers and others to use it. In this example, it would include the live web server, possibly a back-end database server, and Internet access.
Remember this
Sandboxing is the use of an isolated area and it is often used for testing. You can create a sandbox with a virtual machine (VM) and on Linux systems with the chroot command. A secure deployment environment includes development, testing, staging, and production elements.
Secure systems design includes secure staging and deployment.
Q. A software vendor recently developed a patch for one of its applications. Before releasing the patch to customers, the vendor needs to test it in different environments. Which of the following solutions provides the BEST method to test the patch in different environments?
A. Baseline image
B. BYOD
C. Sandbox
D. Change management
Answer is C. A sandbox provides a simple method of testing patches and would be used with snapshots so that the virtual machine (VM) can easily be reverted to the original state.
A baseline image is a starting point of a single environment.
Bring your own device (BYOD) refers to allowing employee-owned mobile devices in a network, and is not related to this question.
Change management practices ensure changes are not applied until they are approved and documented.
See Chapter 5 of the CompTIA Security+: Get Certified Get Ahead: SY0-501 Study Guide for more information on implementing secure systems.
