Host-based Security Issues

• Basic Principles

  • Complexity is the enemy of security

  • Don't trust anything more than you must

  • What they don't know won't hurt you

  • You're not paranoid if they really are out to get you

  • You can't be invincible...

  • ...but you can be less vincible than the other guy

• Minimize functions

  • The more services, the more potential holes

  • If one is cracked, all are vulnerable

  • Ideally, one function per box

  • No compilers, tools on a server

  • Ideally, even logging is done elsewhere

• Minimize privileges

  • Run services as unprivileged users

  • Run chroot

  • Mount read-only, noexec

  • DMZ!

• Data Hiding: Don't give away more than necessary

  • Software versions

  • OS & Hardware

  • For the really paranoid: lie

  • Many worms, kiddies try anyway

• Diversity

  • E.g., a dynamic server with one httpd, static with another

  • Helps to minimize spread if you are cracked

  • Must strike balance with maintenance, minimizing functions

• Obscurity

  • Attackers tend to go for the most common platforms first

  • Consider alternate server software

  • Consider alternate operating systems

  • Consider alternate hardware platforms

  • Gives you some breathing room, doesn't solve problem!

This Presentation

You can find the full text of this presentation, along with links and full explanations of the bullet points, at:

http://ingles.homeunix.org/presos/websec/

The full presentation may be downloaded at:

http://ingles.homeunix.org/presos/websec.tgz

Last updated 2004-Apr-16