2.2 Security controls for host devices Flashcards
Analyze a scenario to integrate security controls for host devices to meet security requirements (42 cards)
SELinux
-Group of security extensions that can be added to Linux to provide additional security enhancements to the kernel
SEAndroid
-The SELinux extensions added to the android OS
Least functionality
-requirement that only the necessary privileges are granted users to access resources
TrustedSolaris
- DEPRECATED
- Was a group of security-evaluated OSs based on earlier versions of Solaris
Anti-Malware
-general purpose security tool designed to prevent, detect and eradicate multiple forms of malware
Anti-Spyware
specifically targets the removal of spyware
Spam filter
identifies malicious or undesirable e-mails and prohibit them from invading the user’s mailboxes
Patch Management
the process of acquiring, testing, deploying, and maintaining a patching solution for an organization’s devices
HIPS/HIDS
-Host Intrusion Prevention System/Host Intrusion Detection System
DLP
- Data loss prevention
- prevents desirable and sensitive materials from leaving the corporate boundary unless the policy permits it
Host-based Firewalls
Control which traffic is allowed or denied from entering and exiting the computer
Log Monitoring
The process of examining host logs in order to detect signs of malicious activity on the device
EDR
- Endpoint Detection Response
- initially monitor a threat by collecting event information from memory, processes, the registry, users, files, and networking and then upload the data to a local or centralized database
Standard operating environment
a pre-defined disk image of an operating system, applications, and configurations to provide consistent host device experiences across the organization
Configuration Baselining
standardizing configurations across applications or operating systems
Application Whitelisting
Focuses on explicitly allowing only certain applications to the exclusion of all others
Application Blacklisting
Focuses explicitly denying only certain applications to the exclusion of all others
Security/Group Policy implementation
Group policy is a set of rules that provides for centralized management and configuration of the operating system, user configurations, and applications
Command Shell restrictions
limits what commands are available to users and IT personnel
Manual vs automated Patch management
- manual patch management improves control
- automated improves speed
Configuring dedicated interfaces
-necessary to ensure that an interface is isolated from other interfaces and traffic flow patterns
Out-of-band Management
-a dedicated interface that requires a separate communication channel
ACLs
- Access Control Lists
- use packet filters to lock down network interfaces
Management interface
Dedicated physical port, or VLAN logical port, that permits in-band management of host devices
