Automating security hardening

Integrating solutions for the digital energy system
Copyright ©2018 OMNETRIC. All rights reserved.
OMNETRIC Group Unrestricted Information.
Automating
security hardening

What is security
hardening?

The process of reducing the
attack surface and ensuring
resilience to known
vulnerabilities

Why is hardening important?
 Locking down delivered
functionality reduces the risk of
attackers exploiting vulnerabilities
i.e. implementation bugs
 Enforcing strict security policies
reduces the risk of attackers
exploiting misconfiguration issues
i.e. back-doors
 Employing layered defense
reduces the risk of attackers
exploiting design flaws
Software products are usually delivered with a general
use configuration that emphasizes features and ease of
use, at the expense of security

How to implement hardening?
Measures are derived from knowledge of potential threats and known exploits that realize
those threats
 Best-practice security configuration guides
 CIS Benchmarks
 DISA Security Technical Implementation
Guides (STIGs)
 NIST National Checklist Program
 Publically available dictionaries of security
recommendations and vulnerabilities
 NIST National Vulnerability Database
 Vendor’s proposed configurations and
security advisories

Why automate hardening?
 Security hardening is critical for achieving a
cyber resilient and compliant solution
 Once a system is hardened and deployed into
an environment, it’s critical to maintain its level
of security through continuous assessments
 Automating compliance checks reduces
administrative costs
Compliance must be continuous, which
requires automation
Monitor
Implement
Verify

If you don’t know where
to start, use standards!

Security Content Automation Protocol
 CVE – Common Vulnerabilities and Exposures
 Identifies vulnerabilities
 CVSS – Common Vulnerability Scoring System
 Vulnerability severity scores
 CCE – Common Configuration Exposure
 Identifies configuration controls
 CPE – Common Platform Enumeration
 Identifies packages and platforms
 OVAL – Open Vulnerability and Assessment Language
 Criteria to check presence of vulnerabilities,
configuration, assets
 XCCDF – Extensible Configuration Checklist
Description Format
 Language to express configuration guidance for
both automatic and manual vetting
CVE
CVSS
OVAL
CCE
XCCDF
CPE
Software vulnerability management
Configuration
management
Asset
management
Compliance management
PCI, CIS, …

Hardening guide example 1/2
 XCCDF is a XML document that represents a structured collection of rules

Hardening guide example 2/2
 OVAL is a XML document that represents a structured collection of checks

OVAL content repositories
 Non-profit and government
 Center for Internet Security (CIS)
 DISA STIG
 Vendor
 Cisco Systems
 Debian Project
 Red Hat
 SUSE
 Subscription
 Altex-Soft
 SecPod Technologies
 SECURITY-DATABASE
https://oval.mitre.org/repository/

SCAP validated products
 Rapid7 Nexpose
 SCAP Extensions for Microsoft
System Center Configuration
Manager
 Tenable Nessus
 RedHat OpenSCAP
 CIS-CAT Pro Assessor
 Qualys SCAP Auditor

Hardening measures
should be evaluated within
the context of the target
environment

Security hardening lifecycle
https://insights.sei.cmu.edu/devops/2017/07/incremental-security-hardening-the-devops-way.html

Let’s put this
into practice

SCAP Security Guide
checks
oval
cpe fixes
ansible
bash
profiles templates
csv
xccdf
Open source project to create custom SCAP content hosted on GitHub

Example: Identify exceptions
../profiles/cis.xml
../xccdf/services/nfs.xml

Example: Add new rules
template_OVAL_services_disabled
create_services_disabled.py
service_disabled.csv
template_BASH_services_disabled
service_%SERVICENAME%_disabled.sh
service_%SERVICENAME%_disabled.xml

Evaluate, fix and report with OpenSCAP
# oscap xccdf eval
--profile CIS
--results ssg-rhel7-CIS-result.xml
ssg-rhel7-xccdf.xml
# oscap xccdf generate fix
--result-id xccdf_org.open-scap_testresult_CIS
--template urn:xccdf:fix:script:sh
--output CIS_remediation.sh
ssg-rhel7-CIS-result.xml
# oscap xccdf generate report
--result-id xccdf_org.open-scap_testresult_CIS
--output CIS_report.html
ssg-rhel7-CIS-result.xml

Choose your automation tool

Summary
 Finding an authoritative hardening list
 Customizing rules based on the specifics of the
target system
 Automating hardening checks to achieve
compliance
Key challenges
 Start with either CIS or STIG
 Use the SCAP Security Guide to tailor the
checklists
 Use your default deployment tool to run
OpenSCAP
Guide to moving forward

OMNETRIC Group is dedicated to
helping energy providers reap the
benefits of the digital energy system
by integrating their energy operations
with IT to support their business
goals.
Our global team of engineering, IT,
security and data experts brings
extensive industry experience to help
customers discover and exploit data
intelligence to capitalize on industry
change, and realize new business
models.
Helping customers since 2014, we are
an inventive, technology services
company and a joint venture between
Siemens AG and Accenture.
For more, visit www.omnetric.com.
 Engineering and
energy technology
 Smart grid
applications
 Grid control
experience
 Dedicated to utilities
 OT-IT integration
specialist
 Integrated smart grid
solutions for
a digital grid
 Systems integration
and services
 Proven delivery
methodologies
 Industry-specific
technologies, assets
and processes
About the presenter
Ugljesa Novak is a Security Architect at OMNETRIC Group and a
Certified Information Systems Security Professional. With almost
nine years of experience in IT security, Ugljesa has designed and
developed security controls for grid control systems on many smart
grid projects. His experience ranges across multiple vendors,
working with project teams for vendors such as Schneider Electric
and Siemens.
ugljesa.novak@omnetric.com

Automating security hardening

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Automating security hardening

Similar to Automating security hardening (20)

Recently uploaded

Recently uploaded (20)

Automating security hardening