n Learn how resiliency strategies reduce risk n Discover automation strategies to reduce risk

Transcription

1 Chapter Objectives Lear how resiliecy strategies reduce risk Discover automatio strategies to reduce risk Chapter #16: Architecture ad Desig Resiliecy ad Automatio Strategies 2 Automatio/Scriptig Resiliet systems are those that ca retur to ormal operatig coditios after a disruptio Goal is to reduce risk associated with failures Cofiguratio ad setup strategies Automatio is used to improve efficiecy ad accuracy whe admiisterig machies usig commads Automatio ad scriptig: usig tools ad methods to perform tasks otherwise performed maually Improvig efficiecy ad accuracy ad reducig risk prewritte ad tested scripts remove the chace of user error scripts ca be chaied together to provide a meas of automatig complex actios automatio via scripts ca save sigificat time Automatio is a major elemet of a eterprise security program with protocols, stadards, methods, ad architectures 3 4 CIS

2 Automated Courses of Actio Cotiuous Moitorig Scripts allow automated courses of actio Ca be tested ad approved before use i the productio They are specified i NIST Special Publicatio which specifies security ad privacy cotrols for the US govermet Automated courses reduce errors ad ca save time Cotiuous moitorig: system that has moitorig built ito it Cotiuous moitorig is a operatioal process by which you ca moitor cotrols ad determie if they are fuctioig i a effective maer Automated dashboards ad alerts that show out-ofstadard coditios Allow operators to focus o the parts that eed attetio 5 6 Cofiguratio Validatio Templates Cofiguratio validatio: validate cofiguratio agaist security stadards with o added fuctioality Extra ports, services, accouts are disabled, removed, or tured off, ACLs are correct ad workig as desiged With chages, software patches, ad as thigs are added to or take away from the system cofiguratio eeds to be re-validated Templates are master recipes for the buildig servers, programs, or eve etire systems Templates make Ifrastructure as a Service possible They eable settig up stadard busiess arragemets ad techology stacks They allow rapid, error-free creatio of cofiguratios, coectio of services, testig, deploymet Automated testig ca scale ad resolve issues 7 8 CIS

3 Master Image No-persistece A master image is a premade, fully patched image of a system A VM ca be cofigured ad deployed i secods They provide the true clea backup of the operatig systems, applicatios, everythig but the data Should a error be foud, you have oe image to fix ad the deploy Master images work well for eterprises with multiple desktops No-persistece is whe a chage to a system is ot permaet Ca be useful whe you wish to prevet certai types of malware attacks A system that caot preserve ad save chages caot have persistet files added ito their operatios A simple reboot wipes out the ew files, malware, etc There are utility programs that ca freeze a machie from chage 9 10 Sapshots Revert to Kow State Sapshots: istataeous savepoits o virtual machies They allow to restore the VM to a previous poit i time Sapshots work because a VM is just a file o a machie: settig the file back to a previous versio reverts the VM Sapshots ca be used to roll a system back, udo operatios, or provide a quick meas of recovery They act as a form of backup, very useful i reducig risk They ca act as a o-persistece mechaism Ay user data that is stored o the system will be lost Revertig to a kow state is a operatig system capability May OSs ow have the capability to create a restore poit - a copy of key files that chage upo updates to the OS You ca roll back the clock o the OS ad restore to a earlier time at which you kow the problem did ot exist This feature oly protects the OS ad associated files, ad a roll back does ot result i loss of a user s files CIS

4 Rollback to Kow Cofiguratio Live Boot Media Rollback to a kow cofiguratio is aother way of sayig revert to a kow state Widows The Last Kow Good Cofiguratio optio durig boot to roll back the registry to the last value that properly completed a boot cycle oly i Widows 7 ad earlier I Widows 8 forward, pressig f8 o bootup is ot a optio uless you chage to Legacy mode The proper method of backig up ad restorig registry settigs i Widows 8 through 10, is through a system restore poit A live boot media is a optical disc or USB device that cotais a complete bootable system This may be used as a recovery mechaism If the iteral drive is ecrypted, you will eed backup keys to access it This is also a coveiet method of bootig to a taskspecific operatig system, foresic tools or icidet respose tools Elasticity Scalability Elasticity: ability of a system to dyamically icrease the workload capacity usig additioal, added-o-demad hardware resources This ca be set to automatically occur Oe of the stregths of cloud eviromets, oly payig for the actual resources you use Scalability is a desig elemet that eables a system to accommodate larger workloads by addig resources either makig hardware stroger (scale up), or addig additioal odes (scale out) Commoly used i server farms ad database clusters Both elasticity ad scalability have a effect o system availability ad throughput, which ca be sigificat security- ad risk-related issues CIS

5 Distributive Allocatio Redudacy Distributive allocatio is the trasparet allocatio of requests across a rage of resources Distributive allocatio hadles the assigmet of jobs Whe the jobs are stateful, the process esures that the subsequet requests are distributed to the same server to maitai trasactioal itegrity Whe the system is stateless, other load-balacig routies are used to spread the work Distributive allocatio addresses the availability aspect of security Redudacy: multiple, idepedet elemets to perform a critical fuctio, so that if oe fails, there is aother that ca take over the work Redudacy iclude the use of redudat servers, redudat coectios, ad redudat ISPs Havig critical hardware (or software) spares for critical fuctios i the orgaizatio ca greatly facilitate maitaiig busiess cotiuity i the evet of software or hardware failures High Availability Fault Tolerace Oe of the objectives of security is the availability of data ad processig power whe a authorized user desires it High availability: to maitai availability of data ad operatioal processig (services) despite a disruptig evet This requires redudat systems (power ad processig) High availability is more tha data redudacy; it requires that both data ad services be available Fault tolerace basically has the same goal as high availability uiterrupted access to data ad services It ca be accomplished by the mirrorig of data ad hardware systems Should a fault occur, the mirrored system provides the requested data with o apparet iterruptio Certai systems are more critical to busiess operatios ad should be the object of fault-tolerat measures CIS

6 RAID RAID To icreasig reliability i disk storage is employig a Redudat Array of Idepedet Disks (RAID) It takes data that is ormally stored o a sigle disk ad spreads it out amog several others If ay sigle disk is lost, the data ca be recovered from the other disks where the data also resides RAID ca also icrease the speed of data recovery as multiple drives ca be busy retrievig requested data RAID 0 (striped disks) sim ply spreads the data across several disks with o redudacy offered RAID 1 (m irrored disks) copies the data from oe disk oto tw o or m ore disks RAID 2 (bit-level error- correctig code) stripes data across the drives at the bit level as opposed to the block level RAID 3 (byte-striped with error check) spreads the data across m ultiple disks at the byte level with oe disk dedicated to parity bits RAID 4 (dedicated parity drive) stripes data across several disks but i larger stripes tha i RAID 3, ad it uses a sigle drive for parity-based error checkig RAID 5 (block-striped with error check) is a com m oly used m ethod that stripes the data at the block level ad spreads the parity data across the drives reliability ad icreased speed performace (miimum of three drives) There is o 100 percet secure system, ad there is othig that is foolproof! Stay Alert! CIS