Translated from 日本語 • View original Face unknown threats with 6 rules!
Hello. This is Iwakiri for the security project. This is the third time. As a recap of the previous article, anti-malware alone cannot prevent unknown threats. To do this, you need to check the server from various perspectives.
Security is similar to health care.
Again, if we compare a server to a person, ensuring security is similar to health management. If you are a normal person, the judgment of whether you are sick or not is whether you have a fever. Do you cough or sneeze? In addition to that, doctors will check the inside of the eyes and mouth, apply a stethoscope, and measure blood pressure. This is because it is easier to detect diseases if you check as many points as possible from as many perspectives as possible.
Security is the same. Deep Security not only protects against malware, but also checks servers from the following six perspectives:
- Web reputation
- Intrusion Prevention
- Fraud Countermeasures
- Change monitoring
- Security log monitoring
- Firewall
Last time, I explained intrusion prevention, so this time I will start with malware countermeasures.
Anti-Malware
Anti-malware. It is an anti-virus function as it is called on PC. I think there are very few servers that have Deep Security and don't have this setting enabled. It detects in real-time or can be scanned on a scheduled basis. In principle, the malware found is set to be deleted, so I would like to say that this rule is a "rule to defend (eliminate)", but it can also be set to leave the discovered malware unattended, so it can be strictly called a "rule that allows you to choose whether to detect or defend".
Change Monitoring
In my opinion, this rule is the biggest trick of Deep Security. It's an exaggeration to say that it's a demon gate, but I used it to mean "I don't want to touch it if I can, because it's difficult to start checking this place seriously." This is a rule that "observes files, folders, registries, etc. at a fixed point and checks for changes". For example, in the case of files, it not only creates, updates, or deletes files, but also detects changes in ownership and permissions.
The timing of monitoring changes is different for Linux and Windows. Linux servers can only monitor on time on a schedule, but Windows servers also monitor in real time.
Also, since this rule only notifies you of changes, it is classified as a "detection-only rule".
Now, the reason why this is a demon gate is because if you activate this rule, a huge number of alerts will be raised. For example, on Linux servers, the default setting of this rule is to monitor changes under "/var/log/", so it detects a large number of changes and raises an alert. It is a difficult task to check these one by one. That's why I think there are many users who have disabled this rule or ignore it even if an alert is raised.
**However, this conversion monitoring rule is quite important! **
Maybe it's a rule that allows you to discover the most unknown threats. In fact, as a result of change monitoring, a PHP program was detected as "newly created". I thought it was probably a new program created by the developer, but when I reported it, I found out that it was a program that no one knew, and when I analyzed the source of the program, I found the logic to communicate with the C&C server. It was backdoor malware. Of course, I had enabled anti-fraud programs, but it was not detected...
If you hear this story, you will understand the importance of change monitoring, but you may still think, "Dozens of alerts are posted every day...". Don't worry (old). There is a workaround.
**You just need to make an exclusion rule. **
In Deep Security, you can set an exclusion rule that says "This folder does not need to be checked for change monitoring". It is a matter of concern which folders to exclude, but we have no choice but to make a decision in our daily operations. Proper exclusion rules will scrutinize change monitoring and provide sensitive (lean) alerts. It may be a little difficult to set up exclusion rules, but I would like you to take advantage of this change monitoring rule.
Security Log Monitoring
It looks at Linux and Windows security logs and alerts you if there is any disturbing movement. For example, if a Linux or Windows user fails to log in three or more times, an alert will be raised. Thresholds such as the number of failures can be changed. This rule only raises an alert, so it is classified as a "rule that only does detection".
Firewall
Windows has a similar function, but it is a rule that controls what ports and IP addresses are allowed on the software side. It is not much different from a typical hardware firewall. In environments with a lot of firewall configuration changes, you may want to disable this rule, as it will be a dual management of hardware and Deep Security. This rule is classified as a "rule for defense (extermination)".
That's an overview of Deep Security. I hope you understand somehow. From the next time, I would like to talk a little more deeply about how to set each rule. To be continued...
If you want to set up and operate Deep Security, you can do it!