Why protect systems¶

Exercise why-protect-systems-annex.pdf · PDF

Friday, 12 May 2017. In England, ambulances are sent to other hospitals because the computers of some public hospitals have stopped working. In Madrid, Telefónica tells its staff to switch their PCs off. Nobody chose those hospitals as a target. So why were they hit?

"Nobody will attack us, we are too small" is the most expensive sentence in computing. Tramuntana Apps is a 12-person studio in Palma, and its office server now holds shares, a Git service and every employee's account. This page is about what can go wrong with it — attacks and accidents — and how you decide what to protect first.

WannaCry: the update existed 59 days before¶

• 14 March 2017. Microsoft publishes a security update, MS17-010. It fixes a flaw in SMB version 1 — the file-sharing protocol behind Samba shares, port 445.
• April 2017. A group calling itself the Shadow Brokers leaks a tool that uses that flaw, EternalBlue. It had been written by the NSA, the United States intelligence agency.
• Friday 12 May 2017. A program called WannaCry starts to spread. It is ransomware: it encrypts your files and asks for money, here 300 dollars in bitcoin. And it is a worm: it needs no click. It finds the next Windows machine with port 445 open and no update, and jumps.
• The same day. More than 200,000 computers in about 150 countries. Telefónica tells its staff in Madrid to switch their computers off; hospitals of England's public health service (NHS) divert ambulances, and about 19,000 appointments are cancelled in the following days.
• That afternoon. A British researcher, Marcus Hutchins, sees that the program asks for a web address that does not exist, and registers it. The program was written to stop if that address answers: a kill switch, found almost by accident. The spread slows down.

Ransomware is malware that locks (encrypts) your files and demands a payment. A worm is malware that spreads by itself from machine to machine, with no human help.

Nobody had to be a genius to be safe on 12 May. They had to have pressed "update" in March.

Three things to protect: the CIA triad¶

Go back to the kitchen of Unit 1 — now it is a restaurant with a secret recipe. Three different things can go wrong.

The three initials make the CIA triad. Nothing to do with the spy agency.

Try it: a stolen laptop with the client list (C) · a power cut (A) · a student changes his mark in the database (I) · WannaCry (A: the files are still there, but nobody can use them) · a disk dies and there is no backup (A, then I).

Five case files¶

Calvià is our own town: many of the council's services stopped while it rebuilt its systems.

Two lessons from the table:

• Updates appear on both sides. Not updating sank Equifax and the WannaCry victims; an update sank 8.5 million PCs. So: update, but keep a way back (snapshots).
• A backup only counts if a restore has been tried. GitLab had several backup mechanisms, and none worked that night.

Threat, vulnerability, risk, control¶

Stay in the restaurant.

You cannot remove threats. You remove vulnerabilities and add controls. And you never rely on one control: defence in depth means several layers — a lock, an alarm and insurance — so that if one fails the next still stands.

flowchart LR
    T["<b>Threat</b><br>a worm scanning<br>the Internet"] -->|"uses"| V["<b>Vulnerability</b><br>port 445 open,<br>no update"]
    V -->|"likely × bad"| R["<b>Risk</b><br>files encrypted"]
    C["<b>Controls</b><br>update · firewall · backup"] -->|"lower"| R

The hardening checklist¶

Hardening means making a system harder to break: removing what it does not need and closing what is open by default.

1. Updates installed, and automatic for security fixes.
2. Only the services you need are running; only their ports are open.
3. A firewall that denies by default.
4. Remote access with keys, not passwords; no direct root login.
5. Least privilege: few administrators; folders open to groups, not to everybody.
6. Strong passwords and a lockout policy.
7. Backups that follow the 3-2-1 rule and have been restored once.
8. Somebody reads the logs — or a program does.

Each line answers at least one case file. Line 1: WannaCry, Equifax. Line 7: GitLab. Line 3: WannaCry again.

Audit your own server¶

Now look at ubu-srv (ssh srv) with read-only commands. Today you change nothing: you only look, write what you find and mark OK or RISK. The checks are on the Exercise sheet.

The SSH check prints the settings the SSH server is really using, filtered to the two that matter:

sudo sshd -T | grep -Ei 'passwordauth|permitroot'

What a typical project server shows: port 22 (SSH), 139 and 445 (Samba), 2049 and 111 (NFS), 631 (printing), 8080 and 2222 (Tramuntana Git). The database, port 5432, is not in the list, because the compose file gives it no ports line: that is a good finding. The firewall is inactive, and almost nobody has a backup of the server — the top risk for most.

Finish by ranking your three biggest risks, the worst first, with what you will do about each. The next page fixes them.

Key takeaways¶

• The CIA triad: confidentiality (only the right people read it), integrity (nobody changed it), availability (it is there when needed).
• WannaCry (12 May 2017) hit more than 200,000 computers through an SMB flaw fixed 59 days earlier: automatic attacks do not choose their victims.
• Not every incident is an attack: GitLab (a mistake) and CrowdStrike (a bad update) broke availability with no attacker.
• A threat uses a vulnerability; risk is how likely × how bad; controls lower it, in layers (defence in depth).
• Hardening: update, close what you do not need, deny by default, keys not passwords, least privilege, tested backups, read the logs.
• Update with a way back, and a backup only counts if a restore has been tried.

Quick check¶

You have your list of the three worst risks. Next, you install the tools that fix them and evaluate what each one really stops — Basic security utilities.