2019.7.17 Notes theoretical strategy reinforcement

2019.7.17

Strategy reinforcement

• Enable logging of NAT logs.

Log information records user online behavior, UMC receives session log port: 9505

• Configure DOS and DDOS attack protection function

Configure TCP protection, ICMP protection, UDP protection, and fragmented message protection, set protection thresholds for different types of messages, and configure actions to be performed when the protection thresholds are exceeded.

• Firewall access rule configuration

The firewall realizes the division and isolation of network security domains, configures firewall rules between different security domains, and implements access control to data packets based on source IP, destination IP, source port, destination port and protocol. At the same time, it records the logs of firewall rejection and discarded packets.

1. Configure NAT address translation to hide the internal network host address
2. Block ports and access to common vulnerabilities
3. The external network port closes the Ping packet response
4. Firewall access rules deny all traffic on the last day
5. Access rule arrangement
6. Turn off unnecessary services

 

Protocol hardening

• Apr deception reinforcement

1. Check the validity of arp packets: use the ARP packet validity check function to detect the ARP received by the device, discard illegal ARP packets, and process legal ARP packets. For ARP trusted ports, no check is performed. For ARP untrusted ports, packets with illegal MAC addresses and IP addresses need to be filtered.
2. Check the legitimacy of arp users: User legitimacy detection is based on the source IP address and source MAC address in the ARP packet to check whether the user is a legitimate user on the port where the VLAN belongs, including static ARP entry-based check and DHCP Snooping security Check of entries.
3. Arp gateway protection: terminal ip+mac address binding

• Dhcp reinforcement

Dhcp snooping technology: The port connecting the legitimate server and DHCP Snooping is set as a trusted port, and the remaining ports are untrusted ports.

• Security hardening of routing protocol

The dynamic routing protocol password requires MD5 encryption to be configured to prevent unauthorized devices from accessing the network to establish neighbor relationships with existing devices after authentication is enabled, and to prevent the risk of routing table contamination.

• Security Hardening of Spanning Tree Protocol

BPDU protection, point-to-point link configuration, edge port, open ROOT protection, open loop protection, designated root bridge.

 

Equipment reinforcement

• User account assignment

Network equipment should assign accounts to managers in accordance with the principle of minimization, and different managers assign accounts with different permissions, so as to manage user accounts with different permissions to avoid unauthorized operations and risk of misoperation.

Delete useless accounts

1. Password security configuration: avoid weak passwords
2. Password encryption storage: It is recommended that static passwords must be encrypted with an irreversible encryption algorithm and stored in the configuration file
3. Authorized security configuration: It is recommended to configure the minimum required permissions according to the user's business requirements when configuring device permissions.
4. NTP protocol configuration: to ensure the accuracy of the log
5. Close unused ports
6. Exit security configuration over time
7. Console port password protection
8. Device management address configuration: only allow specific addresses to access. Prevent unauthorized network segment users from connecting to network devices through TELNET and SSH to threaten network security.
9. Appropriate port description
10. For routers that do not use ARP proxy, turn off the arp proxy function
11. Snmp protocol security:

The system should close the unused SNMP protocol and the unused RW authority

The system should modify the Community default password of SNMP, and the password should meet the password strength requirements.

The system should be configured as SNMP V2 or above

Set SNMP access security restrictions to allow only specific hosts to access network devices through SNMP.

 

Windows hardening

• Patch management: automatic updates
• User account and password security: password policy, account lock, user permissions, disable guest account, modify administrator account name, delete unused
• Log and audit
• Service optimization
• Security protection: screen protection, file sharing, anti-virus management, enable firewall, delete default sharing, restrict anonymous user access, detect network service suspension time, turn off the automatic operation of the drive, check login timeout settings, detect encryption or digital signature security channels Data settings, detection of session restrictions, and shutdown of unnecessary self-starting items
• Gpedit.msc\eventvwr\services.msc

 

Linux hardening

• Device management: use ssh instead of telnet\ftp
• User account and password security
• Log and audit: chmod 400 /etc/syslog.conf
• Service optimization: chkconfig --list
• Security protection: chown root:root/etc/passwd/etc/shadow/etc/group

Chmod 644 /etc/passwd/etc/group

Chomd 400 /etc/shadow

Edit /etc/profile and modify the value of HISTSIZE to 5

 

SQL injection reinforcement

 

1. Deploy security equipment: network management equipment
2. Parameterized query: asp+sqlserver, etc.
3. Filter special characters: regular expression

 

CSRF hardening

1. Token verification: attach a part of information to each HTTP request (session identifier, independent session random number, dependent session random number, session identifier HMAC)
2. Referer verification: Referer identifies where the request was initiated
3. Custom HTTP header: Use XMLHttpRequest and attach a custom header to reject all requests without custom headers

 

XSS reinforcement

1. Deploy security equipment
2. HTML Entity encoding
3. Filter special characters

 

M ysql database reinforcement

1. Account security: modify root password and account name
2. Delete the default database and database user: delete test
3. Run as an independent user
4. Prohibit remote connection: /etc/my.cnf
5. Limit the number of users
6. Command history protection: .bash_history