There are many documents on the internet that describe how to address this common request.
In this article, I’ll give you a track to move easier around this topic pointing out the most interesting articles.
Before starting let me thank Edwin Weijdema who created an exhaustive guide to answer the common question (please click here to get it)
Are you ready? Let’s start
1- The first magic point for starting is Wikipedia where I got a good definition:
In computing, hardening is usually the process of securing a system by reducing its surface of vulnerability, which is larger when a system performs more functions; in principle, a single-function system is more secure than a multipurpose one. Reducing available ways of attack typically includes changing default passwords, the removal of unnecessary software, unnecessary usernames or logins, and the disabling or removal of unnecessary services.
2- The second point is to understand the concept of Perimeter security:
It is natural barriers or artificially built fortifications that have the goal of keeping intruders out of the area . The strategies can be listed as:
- Use rack-mount servers
- Keep intruders from opening the case
- Disable the drives
- Lock up the server room
- Set up surveillance
A complete article is available by clicking here
3- The third point is Network segmentation:
It is the division of an organization network into smaller and, consequently, a more manageable grouping of interfaces called zones. These zones consist of IP ranges, subnets, or security groups designed typically to boost performance and security.
In the event of a cyberattack, effective network segmentation will confine the attack to a specific network zone and contain its impact by blocking lateral movement across the network via logical isolation through access controls.
Designating zones allows organizations to consistently track the location of sensitive data and assess the relevance of an access request based on the nature of that data. Designating where sensitive data reside permits network and security operations to assign resources for more aggressive patch management and proactive system hardening.
A complete article is available by clicking here
4- Hardening your Backup Repositories
The next good rules involve your backup architecture and in specific the Backup Repositories:
Windows:
a. Use the built-in local administrator account
b. Set permissions on the repository directory
c. Modify the Firewall
d. Disable remote RDP services
Linux:
e. Create a Dedicated Repository Account
f. Set Permissions on the Repository Directory
g. Configure the Linux Repository in VeeamModify the Firewall
h. Use Veeam Encryption
Do you want to know more about security? If so the Veeam Best Practices are for sure the answer.
The next article will cover monitoring and automatic actions using Veeam-ONE.
5- Prevent injection of shady boot code
Code injection, also called Remote Code Execution (RCE), occurs when an attacker exploits an input validation flaw in software to introduce and execute malicious code.
To prevent the attack please follow the following rules:
a. Run with UEFI Native Mode
b. Use UEFI with Secure Boot Standard Mode
c. Combine Secure Boot with TPM
d. Equip critical servers with a TPM 2.0
Stay tuned and see you soon
Figura 1
Figura 2
Figura 3
Figura 4
Figura 5
Figura 6