Operating System Hardening

Jerry Grugin

 

In this blog on operating system hardening, we will take a look at four key areas:

• Service Packs and Hotfixes
• Patches and Patch Management
• Group Policy:  Security Templates
• Configuration Baselines

Service Packs and Hotfixes

The process of releasing network operating systems, applications, and programs to the market is a very competitive one.  Typically, the first company that can get a system out to the market is going to get a much needed market share.  Sometimes, these products and systems do not really undergo the necessary pilot testing before they are released to the market.  Thus a lot of network operating systems do not go through a full-fledged development cycle because of the rush to get to the market first.  Because of the rush to market, there is a great need for service packs and hotfixes that will follow.  Service packs and hotfixes are needed to fix things such as security holes that were not initially discovered, to enhance interoperability with other vendor's products, to fill operability loopholes, to add additional features, or to bring the product up to speed with international standards.  Further, and this should be understood quite clearly, support packs, service packs, and other such things are all part of the normal development process.

It is important to know that all service pack updates should be authenticated with certificate authorities (CA).  It is also important to know that not all service packs can be rolled back.

There are also different types of updates besides application updates.  There are also updates called operating system updates.

Patch Management

A patch is a small chunk of code to fix problems or update computer applications and supporting data.  This can be improving usability, improving interoperability, improving performance, sealing up some security holes, fixing problems, or fixing bugs.  Accordingly, patch management is talked about under the umbrella of change management, which is an open process that is used in ITIL, Microsoft's MSF, for example.  Change implies that something will definitely change.  Therefore, we have to have a way to manage these changes.  There needs to be set scheduling to manage these changes.  This could be time based or event based.  Time based management could be every few months or every few weeks.  Event based might be based on attacks to a computer.  Patches or updates need to be tested in a prototype environment.  However, some companies do not have this luxury.  It is important to remember that change management is the vital component to the patch management process.

Group Policy and Security Templates

Group policy is actually a feature of the operating system.  The goal should always be improved productivity and improved security.  Group policy is a very popular tool to use in small to medium sized business all the way up to enterprise organizations.  It is a way to allow these organizations to define rules or policies throughout the organization.  They can apply these at different levels of the organization.  Group policy allows organizations to control such things as registry, NTFS security, audit and security policy, software installations, scripts, and application settings (IE).  Group policy uses administrative and security templates.  These are predefined settings at a workstation or a domain, for example.  Group policy objects (GPO) have a built-in inheritance.

Configuration Baselines

This is the initial system that one has when the operating system is installed.