Defence Signals Directorate Reveal their secrets....Protect our own

Library

Further Technical Information for Mitigating Targeted Cyber Intrusions

 

Whitelisting versus Blacklisting

The concept of whitelisting is a key theme, whereby activity (such as network communication or program execution) is denied by default, and only the activity explicitly permitted by the system administrator is allowed to occur.

The traditional blacklisting approach only blocks a small amount of activity explicitly defined by the system administrator known to be undesirable. This approach is reactive, time consuming to maintain and provides weak security.

Mitigation Strategies

Some mitigations designed to prevent an intrusion have suitable logging functionality with minimal false positives and can therefore also be used to detect an intrusion.

The following table provides notes and further reading for several of the mitigations. References to web pages or products not on the DSD web site should not be construed as an endorsement of their accuracy or quality.

Mitigation Effectiveness Ranking

Notes and Further Reading
1 - Patch the operating system

DSD ISM (Sep 2009)
para 2.1.152: Information Technology Security Officers,
para 2.2.89: Standard Operating Procedures,
para 6.3.13: Standard Operating Environments, and
paras 6.1.98-108: Product Patching and Updating.

Official web page for Microsoft Windows Server Update Services (WSUS)

Wikipedia overview of WSUS
2 - Patch third party applications

DSD ISM (Sep 2009)
para 2.2.152: Information Technology Security Officers,
para 2.2.89: Standard Operating Procedures,
para 6.3.13: Standard Operating Environments, and
paras 6.1.98-108: Product Patching and Updating.

Deploying Adobe PDF patches

Deploying Adobe PDF patches

Deploying Adobe PDF patches
3 - Minimise use of administrative privileges

An unprivileged account should be used for all work (including email and web browsing) that does not require administrative privileges.

DSD ISM (Sep 2009)
para 2.1.187: System Users,
paras 6.4.92-96: Privileged Access, and
para 6.4.118-119: Remote Access.
4 - Application whitelisting

DSD ISM (Sep 2009)
paras 6.3.48-71: Application Whitelisting.

Review of several application whitelisting products

Using Software Restriction Policies to Protect Against Unauthorized Software

Overview of Microsoft AppLocker
5 - Host-based Intrusion Detection/Prevention System

Antivirus products are evolving to incorporate HIPS/HIDS functionality into converged endpoint security products.

DSD ISM (Sep 2009)
paras 6.6.211-212 & 6.6.222: Intrusion Detection and Prevention.

Example intrusion techniques detected and prevented by HIDS/HIPS products

HIPS information

HIPS information
6 - Workstation conversion/sanitisation of Microsoft Office files

DSD ISM (Sep 2009)
para 6.7.139 & 6.7.143: Data Import and Export.

Microsoft Office Isolated Conversion Environment (MOICE)

MOICE

MOICE
7 - Whitelisted email content filtering

Disallow content that cannot be inspected e.g. password protected .zip attachments. Disallow incoming external emails that have your organisation's domain as the email sender.

DSD ISM (Sep 2009)
para 6.6.163: Email Infrastructure.

Email content filtering
8 - Gateway

Configure workstations with a non-routing network capture device as the default route, to facilitate detection of malware attempting to directly communicate with the Internet.

DSD ISM (Sep 2009)
paras 6.3.77-78: Web Applications,
para 6.6.172: Email Infrastructure, and
para 6.7.187: Firewalls.

DSD evaluated firewall products
9 - Data Execution Prevention (DEP)

Enabling and configuring DEP
10 - Antivirus software

DSD ISM (Sep 2009)
para 6.6.221: Intrusion Detection and Prevention.
11 - Sender Policy Framework

DSD ISM (Sep 2009)
para 6.6.177: Email Infrastructure.

Wikipedia overview of SPF and Sender ID

Sender ID

SPF
12 - Audit reconnaissance tool usage  
13 - Restrict access to NetBIOS  
14 - Application based workstation firewall (incoming traffic)

DSD ISM (Sep 2009)
para 6.3.11: Standard Operating Environments.
15 - Network segmentation and segregation

Segregation should be based on connectivity required, user job role, trust boundaries (e.g. constrain remote access and wireless connections) and sensitivity of information stored instead of just based on geographic location.
16 - Centralised logging and regular log analysis

Log blocked and successful activity e.g. web proxy, DNS, sensitive services and privileged users. Analyse logs for anomalies e.g. outgoing traffic out of business hours, long lived connections, periodicity and incoming/outgoing traffic ratio.

DSD ISM (Sep 2009)
para 2.1.161: Information Technology Security Officers,
para 2.2.89: Standard Operating Procedures,
para 6.3.11: Standard Operating Environments,
para 6.3.78: Web Applications, and
paras 6.4.131-153: Event Logging and Auditing.
17 - Disable unrequired operating system functionality

DSD ISM (Sep 2009)
para 6.3.11: Standard Operating Environments.
18 - Application security configuration hardening

User application configuration hardening examples include disabling script/macro features in Microsoft Office and PDF viewer, as well as disabling web browser ActiveX, Java and Flash except for whitelisted web sites. For web server applications, OWASP has guidelines for code review, data validation/sanitisation, user/session management, protection of data in transit and storage, error and exception handling, logging and auditing and authentication/authorisation.

DSD ISM (Sep 2009)
paras 6.1.65-68: Product Installation and Configuration,
paras 6.3.76-95: Web Applications,
para 6.3.154: Software Application Development, and
para 6.3.180: Web Application Development.

Securing web browsers

OWASP
19 - Application based workstation firewall (outgoing traffic)

DSD ISM (Sep 2009)
para 6.3.11: Standard Operating Environments.
20 - Web domain whitelisting (HTTPS/SSL)

DSD ISM (Sep 2009)
para 6.3.80: Web Applications.

Whitetrash dynamic web whitelisting plugin for the squid web proxy
21 - Web content filtering

DSD ISM (Sep 2009)
para 6.3.86: Web Applications.
22 - Two factor authentication

DSD ISM (Sep 2009)
para 6.7.84: Gateway/Cross Domain Solutions.
23 - Removable media control

DSD ISM (Sep 2009)
paras 6.2.11-29: Media Handling,
paras 6.2.45-67: Media Usage,
paras 6.2.83-106: Media Sanitisation,
paras 6.2.140-152: Media Destruction, and
paras 6.2.164-168: Media Disposal.

DSD evaluated media sanitisation products

DSD evaluated Sanctuary media control product

DSD evaluated SanDisk encrypted USB flash drive
24 - Web domain whitelisting (all domains)

DSD ISM (Sep 2009)
paras 6.3.80-81: Web Applications.

Whitetrash dynamic web whitelisting plugin for the squid web proxy
25 - Disable LanMan  
26 - Block attempts to access web sites by their IP address  
27 - TLS encryption between email servers

DSD ISM (Sep 2009)
para 6.6.175: Email Infrastructure.
28 - Randomised local administrator passwords

These local administrator accounts should not be used. Instead, domain group privileges should be used for computer management.
29 - Gateway blacklisting

DSD ISM (Sep 2009)
paras 6.3.82-83: Web Applications.
30 - Network-based Intrusion Detection System (internal traffic)

DSD ISM (Sep 2009)
paras 6.6.211-212 & 6.6.217: Intrusion Detection and Prevention.
31 - User education

DSD ISM (Sep 2009)
para 2.1.55: Chief Information Security Officer,
para 2.1.123: Information Technology Security Managers,
para 2.1.164: Information Technology Security Officers,
para 2.2.52: Information Security Policies,
para 2.2.94: Standard Operating Procedures,
para 3.1.44: Servers and Network Devices,
paras 4.1.10-17: Information Security Awareness and Training,
paras 6.6.211-212: Intrusion Detection and Prevention, and
paras 6.7.69-70: Gateway/Cross Domain Solutions.
32 - Network-based Intrusion Prevention System (internal traffic)  
33 - Rolling network capture  
34 - Network-based Intrusion Detection System (external traffic)

DSD ISM (Sep 2009)
paras 6.6.211-213 & 6.6.216: Intrusion Detection and Prevention.
35 - Network-based Intrusion Prevention System (external traffic)