Security

Access to cloud production environments should require security clearance vetting. Production systems hold live data and applications, and the consequences of compromise are direct. UK clearance levels Level What it covers Checks included BPSS Pre-employment screening for government asset access Identity, employment history, immigration status, unspent criminal record AC Unescorted access to UK airport security areas Identity, employment history, criminal record, government agency records CTC / Level 1B UK OFFICIAL assets, occasional SECRET access Identity, employment, criminal record, financial situation, personal circumstances SC Substantial unsupervised SECRET access Everything in CTC plus credit reference and MI5 record checks DV Substantial unsupervised TOP SECRET access Everything in SC plus detailed interview and referee enquiries The process You need a sponsor — usually HR or a company security controller. They confirm your role requires vetting and that BPSS checks are complete (unless you’re doing AC). You then fill out a security questionnaire online covering personal details, employment history, finances, criminal record, foreign travel, and contacts. ...

There are moments when you need to inspect the certificate a remote server is presenting – maybe it’s expired and you’re trying to work out why things are breaking, or maybe you need the raw certificate data for some other reason and don’t have access to the server’s configuration. The quickest way is with openssl s_client: openssl s_client -connect {HOSTNAME}:{PORT} -showcerts Replace {HOSTNAME} with the server address and {PORT} with the port (usually 443 for HTTPS). The -showcerts flag dumps the full certificate chain rather than just the leaf certificate. ...

I put together this document as a reference for system hardening. It covers the basics – what hardening actually means, the formula for building a hardened system, and how virtualisation changes the picture. You can download the full guide as a Word document. What is System Hardening? Hardening is just the practice of making a system more resistant to attack. The guiding idea is least privilege: only what’s needed runs, only what’s needed is exposed. ...

DOWNLOAD - Juniper device hardening Introduction Rationale An out-of-box firewall implementation is not fully secure and needs to be hardened. This document details the various aspects of Juniper firewall security and standards implemented for securing Juniper firewalls. Purpose This document is to define a baseline security standard for the Juniper Firewall implementations by firewall administrators. Scope These security standards cover the Juniper Firewall Screen OS implementation. However, for some setups, this minimum requirement and some features of these standards may not be practical for implementation. For exceptions, the system administrators must document the reasons for not complying fully with these standards and request an exemption from the Security department. ...

Hardening Solaris Systems in Production When you’re running enterprise workloads on Solaris — databases, application servers, web fronts — the gap between “it works” and “it’s secure” is a lot wider than most people expect. I spent a good chunk of time working through hardening procedures for a fleet of Solaris boxes, and what follows is the procedure we landed on. The scope covered four server types: database, web, application, and utility. Every one of them got the same four security layers, regardless of role. ...

Vendor Assessment Type: Vendor Assessment Project Information Field Description Value Name Enter the name TPA: Project Name Whirlpool project name requesting third party or service provider connection TPA: Project Owner Whirlpool project owner requesting third party or service provider connection TPA: Business Area Whirlpool business area or process supported by the third party or service provider TPA: Service Provider Name Service provider company name TPA: Service Provider Contact Service provider or third party contact TPA: Target Implementation Date Target implementation date TPA: CISO Vendor Chief Information Security Officer (CISO) or equivalent TPA: User Directory Choose the user directory used to manage security and provisioning of access on your internal network TPA: OS and database List the operating system and database used to manage Whirlpool data TPA: Datacenter location List the location of the datacenter that hosts Whirlpool data OS/Database options: Mainframe, Unix, AS400, Windows, Oracle, DB2/UDB, MS SQL, Other ...

The goal of encryption isn’t to create something uncrackable. The only truly unhackable computer is one that’s turned off, unplugged, and locked in a vault – and even then, someone could just carry the vault away. Encryption is about making it difficult enough that attackers give up and move on to easier targets. It’s a cost calculation, not a guarantee.

After building and maintaining CMS sites for a while, here are the things I’ve learned the hard way. Don’t run your site from the root directory. Put the CMS in a subdirectory and forward requests there with .htaccess or whatever your server supports. It keeps the CMS files out of the way and makes it harder for someone to guess where things are. A small thing, but it helps. Be careful about advertising what CMS you’re running. ...