LetsDefend | IT Security Basis for Corporates Training

Welcome to the world of “IT Security Basis for Corporates”! In this blog, I’ve crafted an easy-to-read and engaging overview of the LetsDefend course, covering essential questions to evaluate your organization’s level of protection against cyber disasters. Join me as we explore practical insights, interactive quizzes, and real-world examples to enhance your understanding and fortify your corporate IT security. Get ready to unlock the secrets of effective cyber defense and safeguard your organization’s assets against evolving threats.

Link: https://app.letsdefend.io/training/lesson_detail/introduction-to-it-security-basis-for-corporates

Badge you will earn after successful completion of this course.

Inventory

• An inventory is essential for protecting your infrastructure and understanding your network.
• It should include information such as hardware and software details of workstations and servers.
• Date of the last inventory report should be recorded for reference.

End-of-Life Equipment:

• Identify equipment that has reached its end-of-life and is no longer supported.
• Such equipment should be excluded from the network as they won’t receive security patches.
• In case of necessity, a risk acceptance by the CISO should be performed and documented.

Secure Boot:

• Enable secure boot on compatible devices to ensure booting with manufacturer-approved software.
• Secure boot has been available for a long time and is unlikely to cause issues.

Software List:

• Implement a strict policy regarding authorized and unauthorized software to reduce the attack surface.
• Use tools like GPO or Intune to provide users with a software library without administrative rights.
• Block forbidden software through Intune or AppLocker and report any prohibited application usage.

Security Hardening:

• Follow proven hardening guides to configure devices securely.
• Consider station handover procedures, secure configuration audits, and alerts for configuration changes.
• Hardening can be implemented using tools like Ansible, GPO, or Intune.

Antivirus/EDR:

• Deploy antivirus or EDR (Endpoint Detection and Response) solutions across the entire fleet.
• Prioritize critical devices for protection.
• Establish a process to track and respond to generated alerts.

Question:

Q. Which is not one of the issues to be considered while doing hardening work?

A) Station handover procedures with prerequisite checklist

B) Audit of the secure configuration of the devices

C) Alert in case of configuration modification

D) Mouse movements of devices

Ans:- Mouse movements of devices

Backups

• Backups are crucial for protecting your data and ensuring business continuity in case of an attack or failure.

The 3–2–1 rule is a basic guideline for backups:

• Have at least three copies of your data, including the original and two backups.
• Store the backups on two different media, ensuring redundancy.
• One backup copy should be stored offsite, protecting against risks like fire.

The 3–2–1–1–0 rule adds additional conditions for critical resources:

• Maintain at least one offline copy of the backup, disconnected from the network to prevent tampering by attackers.
• Ensure zero errors during the restoration process by regularly testing and verifying backups.
• Minimum storage time for backups should allow restoring data up to 30 days old, considering the average time it takes to detect intrusions.
• Conduct regular backup tests and track the restoration process to ensure the integrity and effectiveness of backups.
• Each server should be restored at least once a year to validate the backup and restoration process.

Phishing Prevention

• Implement antispam and email protection measures to filter out malicious emails and attachments.
• Ensure that all emails received by employees go through a spam filter and that antivirus software analyzes email attachments.
• Regularly review and update the configuration of spam filters and antivirus software to stay protected against new threats.
• Establish an analysis procedure for employees who have doubts about suspicious emails, providing them with a way to contact someone for email analysis.
• Conduct phishing drills or tests to assess employee awareness and preparedness against phishing attacks.
• Phishing drills simulate phishing attacks to test and educate employees on identifying and handling phishing emails.
• By conducting these drills, organizations can identify areas of improvement and provide additional training to enhance employee awareness and response to phishing attacks.

Question:

Q. What is the simulation study done to raise awareness of corporate employees against phishing attacks?

Ans: phishing drill

Internet Browsing Protection

Filter Policies:

• Implement filters to block connections to unauthorized websites.
• Block access to suspicious domain names and known malicious domain names.

DNS Filtering:

• Use DNS filtering to block dangerous sites and filter unwanted content.
• Configure firewalls to prevent access to malicious domains.
• Monitor and review attempts to access blocked sites.

URL Shorteners:

• Block URL shorteners, which are commonly used for phishing attacks.
• Control and analyze the blocked sites that employees have attempted to visit.

Centralized Browser Management:

• Update browser security settings centrally to enhance protection against malware.
• Configure browsers to restrict the installation of plugins and extensions.
• Disable the automatic execution of certain types of content, such as Flash or JavaScript.

Question:

Q. What should be done to block unwanted addresses to be accessed within the institution?

Ans: dns filtering

Patching

Timely Deployment:

• Deploy patches to software and firmware promptly to address vulnerabilities.
• Enable automatic updates whenever possible to ensure timely patching.

SLA for Patching:

• Set up a service-level agreement (SLA) for patching, which defines the maximum update time for workstations, servers, and software.
• Consider factors such as the Common Vulnerability Scoring System (CVSS) score, the exposure of the server to the internet, and whether the vulnerability is actively exploited (0-day).

Access Control

Password and Multi-Factor Authentication (MFA):

• Implement a password policy that ensures strong and unique passwords.
• Apply the policy at the domain level in a Windows environment to cover all computers.
• Use stronger authentication mechanisms like biometrics, one-time passwords, and application tokens.
• Implement multi-factor authentication (MFA) for enhanced security, starting with privileged users and expanding to all users.

Zero Trust:

• Identify and disable unused accounts to minimize the attack surface.
• Eliminate shared accounts to ensure accountability and individual access control.
• Remove unnecessary privileges to limit potential damage in case of compromise.
• Enforce strong password policies to prevent easy unauthorized access.

Audit of Account Usage:

• Monitor and analyze user activity to detect anomalies and suspicious behavior.
• Look for access attempts outside of normal business hours or from unusual locations.
• Aim to have less than 15% of accounts with “domain administrator” privilege to minimize the impact of potential breaches.

Risk Analysis

Risk Assessments:

• Conduct risk assessments to identify and evaluate potential risks to your organization.
• Prioritize risks based on their likelihood and potential impact.
• Use the assessment results to allocate resources and investments effectively.

Return to Service:

• Perform a study to determine the critical resources that should be recovered first in the event of disruptions.
• Estimate the impact of disruptions and define allowable downtime for each resource.
• This analysis helps in developing a prioritized recovery plan and minimizing the impact of incidents.

Review of Risks on Connected Networks:

• Recognize that every connection to your company, whether internal or external, presents a potential risk.
• Evaluate the security requirements and practices of your partners and connected entities.
• Ensure that your partners are committed to the same level of security and timely updates for vulnerabilities.
• Verify that they adhere to best practices, such as not using default certificates on VPNs and aligning their configurations with your security needs.

Network

PCAP (Packet Capture):

• Utilize SPAN ports of network equipment to capture network activities.
• Monitor and analyze captured data for abnormal behavior and post-mortem analysis.

Segmentation:

• Divide the network into smaller parts using techniques like VLAN and PVLAN.
• Improve network performance and security by reducing the attack surface.
• Limit the range of an attack by separating different networks.

Review of Blocked Flows:

• Conduct a review to identify the origin of requests that are blocked based on the network policy.
• Identify potential compromised workstations or applications that may have been missed during inventory.

Alerting for Abnormal Network Usage:

• Generate alerts when network usage deviates from standard patterns.
• Identify security threats and vulnerabilities, as well as non-security issues such as network saturation caused by backup tools.

Incident Response for IT Security

Incident response is a coordinated approach to managing and addressing security incidents in an organization. It involves following a well-defined plan and executing a series of stages to effectively handle and mitigate the impact of a security incident. The six stages of incident response are as follows:

1. Preparation: Establishing an incident response plan, defining roles and responsibilities, and implementing necessary tools and technologies to handle security incidents effectively.
2. Identification: Detecting and identifying security incidents through monitoring systems, threat intelligence, and user reports.
3. Scope: Assessing the extent and impact of the incident, determining the affected systems, data, and potential vulnerabilities.
4. Eradication: Taking immediate actions to contain the incident, isolating affected systems, removing malicious elements, and preventing further unauthorized access.
5. Recovery: Restoring systems and data to their normal functioning state, implementing necessary patches and updates, and verifying the integrity of the restored environment.
6. Lessons Learned: Conducting a post-incident analysis, documenting lessons learned, identifying areas for improvement, updating the incident response plan, and providing training and awareness to prevent future incidents.

By following these stages, organizations can effectively respond to security incidents, minimize the impact, and improve their overall security posture.

Quiz:

Q1. Which of the options should be in your IT inventory kept for security purposes?

Ans:- The software installed with the exact version

Q2. Why is it important to restrict various software?

Ans:- To prevent known malware from running

Q3. What is the main reason to keep an offline backup of backups?

Ans:- To use in case of damage to online backups

Q4. How many days should the Minimum Retention Time be?

Ans:- 30

Q5. What does Phishing Drill do?

Ans:- The company provides awareness to employees about phishing

Q6. Why is it important to use a password policy?

Ans:- To standardize password security

Q7. What should be done to detect abnormal activities in the network?

Ans:- Monitoring

Q8. Which of the following should be included in the scope of Hardening?

Ans:- Audit of the secure configuration of the devices

Q9. Why should endpoint devices have EDR or at least AV?

Ans:- To track and secure devices

Q10. Why is it important not to use end of life device?

Ans:- Because they pose a security risk

That’s it! See you in the next Training :)