Skip to content

Defence Checklist.md

Latest commit

 

History

History
49 lines (45 loc) · 2.48 KB

Defence Checklist.md

File metadata and controls

49 lines (45 loc) · 2.48 KB
Raw

Cyber Defence Checklist

The Big Idea

external attack surface is key

  1. Determine which services should be accessible.
  2. Block (firewall) or stop services that shouldn't be.
  3. Secure services that should be.
    1. Update to latest version
    2. Check Attack Vectors
  4. Remove things that run on a "schedule" or "when a specific event occurs".
  5. Prepare for active defence. (Wireshark and/or auditing)
  6. Check for privilege escalation or persistence attack vectors.

Note: If server is really outdated, don't worry about 6 because there's nothing you can do unless there's potential to escalate through a service.

The Complete Checklist

  • Change root and user passwords
  • Remove unneeded users
  • Check group membership and sudo permissions
  • Upgrade outdated packages
  • Check cron and anacron (if applicable) jobs
    • /etc/crontab, /etc/cron.allow, /etc/cron.* directories and /var/spool/cron
    • same files/folders as above but replace cron with anacron
    • For competitions, easiest is to disable the cron service with systemctl disable cron or crond
  • Check systemd timers
  • Check running processes
  • Apply host firewall
    • I'd use ufw, firewalld, iptables, nftables in that order
  • Configure and secure externally-accessible services (depends on service)
  • Backup required directories both locally and remotely
    • Easiest way is to tar zip the directory then access remote backup server through sftp
  • Set up command line auditing
  • Start Wireshark capture

If in a competition, I would make services accessible at this point because your external attack surface is minimised. The rest can be done on the fly.

  • Check open ports - consult the port closing flowchart
  • Check enabled (startup) services
  • Check running services
  • Check additional privilege escalation attack vectors
    • world readable/writable dirs/files
    • writable files for each user
    • SUID/SGID binaries

Free Defence Solutions

probably too advanced for limited-time competitions like NCAE Cyber Games, but if you're feeling adventurous, here are some ideas