So, I'm trying to make a very, very basic document to help my analysts document where our new servers differ from a VERY secure (Read as, completely broken) baseline. Concept being that I'd like to hand this document over to vendors and have them let me know which things they will need to change in order to make their product work. My org was completely without any structure on this so it is a completely from scratch situation.
I'm trying to get to as close to 'zero trust/functionality' as possible and have them work backwards from there and only enable things that they need in order for stuff to function. Is this an okay approach or am I being unrealistic? If so, suggestions? Otherwise, am I missing anything?
Disable Unnecessary Services
(Windows)
1) Remote Registry
2) Windows Error Reporting
3) Fax Service
4) Print Spooler
5) Bluetooth Support
6) Server
7) NetBIOS over TCP/IP
8) Internet Information Services (IIS)
9) Windows Media Player Network Sharing
(Linux)
10) Avahi-daemon
11) CUPS (Common Unix Print System)
12) Bluetooth Services (Bluetooth, hciuart)
13) RPCbind
14) Samba (SMB)
15) NFS
16) Sendmail/Postfix
17) X Window System (X11)
18) DHCP Client
19) TFTP (Trivial File Transfer Protocol)
20) SNMP (Simple Network Management Protocol)
21) Zeroconf/Multicast DNS (mDNS)
22) NIS (Network Information Service)
____
Disable Unnecessary Ports
(Windows)
File Sharing and Printer
1) Port 137-139 (NetBIOS over TCP/IP)
2) Port 445 (SMB)
Remote Desktop and Management (See Remote access Hardening)
3) Port 3389 (RDP)
4) Port 22 (SSH)
Database
5) 1433 (MSSQL)
6) 3306 (MySQL)
7) 5432 (PostgreSQL)
Email and Messaging
8) Port 25 (SMTP)
9) Port 110 (POP3)
10) Port 143 (IMAP)
Web and Application
11) Port 80 (HTTP)
12) Port 443 (HTTPS)
13) Port 8080 (alt HTTP)
File Transfer
14) Port 21 (FTP)
15) Port 69 (TFTP)
Old or Insecure
16) Port 23 (Telnet)
17) Port 161-162 (SNMP)
Multimedia and Streaming
18) Port 554 (RTSP)
19) Port 1755 (MMS)
Misc
20) Port 6660-6669 (IRC)
_______
Secure System Accounts
1) Rename or disable default accounts not in use.
2) Dedicated service accounts with least privilege.
- Disable all other logins
______
Secure Boot
1) BIOS/UEFI passwords.
- Secure Boot.
_____
Remote Access Hardening
(Windows)
1) Use Network Level Authentication (NLA).
2) Limit RDP access to internal IP ranges.
(Linux)
3) Disable root login over SSH.
4) Change the default SSH port (22) to non-standard port
______
Security Features
(Windows)
1) Enable DEP (Data Execution Prevention)
2) Enable ASLR (Address Space Layout Randomization)
(Linux)
- Enable SELinux or AppArmor
______
Network Configuration
1) Disable IPv6
2) DNSSEC
_____
Server Protocols
Disable
1) Multi-Protocol Unified Hello
2) PCT 1.0
3) SSL 2.0
4) SSL 3.0
5) TLS 1.0
6) TLS 1.1
Enable
7) TLS 1.2 (and above)
____
Cyphers
Disable
1) NULL
2) DES 55/56
3) RC2 40/128
4) RC2 56/128
5) RC2128/128
6) RC4 40/128
7) RC4 56/128
8) RC4 64/128
9) RC4 128/128
Enable
10) Triple DES 168
11) AES 128/128
- AES 256/256
______
Hashes
Enable
1) MD5
2) SHA
3) SHA 256
4) SHA 384
5) SHA 512
______
Key Exchanges
Enable
1) Diffie-Hellman
2) PKCS
3) ECDH
_____
Client Protocols
Disable
1) PCT 1.0
2) SSL 2.0
3) SSL 3.0
4) TLS 1.0
5) TLS 1.1
Enable
1) TLS 1.2
_____
Cypher Suites
Enable
1) TLS_AES_256_GCM_SHA384
2) TLS_AES_128_GCM_SHA256
3) TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
4) TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
5) TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
6) TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Disable
1) TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
2) TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
3) TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
4) TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
5) TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
6) TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
7) TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
8) TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
9) TLS_RSA_WITH_AES_256_GCM_SHA384
10) TLS_RSA_WITH_AES_128_GCM_SHA256
11) TLS_RSA_WITH_AES_256_CBC_SHA256
12) TLS_RSA_WITH_AES_128_CBC_SHA256
13) TLS_RSA_WITH_AES_256_CBC_SHA
14) TLS_RSA_WITH_3DES_EDE_CBC_SHA
15) TLS_RSA_WITH_NULL_SHA256
16) TLS_RSA_WITH_NULL_SHA
17) TLS_PSK_WITH_AES_256_GCM_SHA384
18) TLS_PSK_WITH_AES_128_GCM_SHA256
19) TLS_PSK_WITH_AES_256_CBC_SHA384
20) TLS_PSK_WITH_AES_128_CBC_SHA256
21) TLS_PSK_WITH_NULL_SHA384
TLS_PSK_WITH_NULL_SHA256
___
Encryption
Enable
Windows
1) Bitlocker
Linux
- LUKS
____
Anti-Malware
Install
- CStrike
____
Database Hardening (Where Applicable)
Oracle
1) Disable External Procedures
- extproc
2) Disable Unused Database Links
3) Disable Unused File Handling
- UTL_HTTP
- UTL_FILE
Microsoft SQL
1) Disable xp_cmdshell
2) Disable OLE Automation Procedures
3) Disable Ad Hoc Distributed Queries
____
Application Control
1) Application Whitelisting
- Applocker (Windows Server)
- SELinux/AppArmor (Linux)
- Restrict Execution of Scripts