Chapter 26 — Systems, endpoints and hardware security: methods II
Lesson map
Lesson 26 published. Map, example, EX076.
flowchart TD
N0["Learning outcomes"]
N1["26.1 Server role"]
N2["26.2 SP 800-123"]
N3["26.3 Patching servers"]
N4["26.4 Admin access"]
N5["26.5 Logging"]
N6["Role documents"]
N7["Contractor access"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX076"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["26.1 Server role"]
N2["26.2 SP 800-123"]
N3["26.3 Patching servers"]
N4["26.4 Admin access"]
N5["26.5 Logging"]
N6["Role documents"]
N7["Contractor access"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX076"]
[Learning outcomes]
|
v
[26.1 Server role]
|
v
[26.2 SP 800-123]
|
v
[26.3 Patching servers]
|
v
[26.4 Admin access]
|
v
[26.5 Logging]
|
v
[Role documents]
|
v
[Contractor access]
|
v
[Worked example] --> [Exercise EX076]
Learning outcomes
You will (1) harden servers; (2) remove unneeded services; (3) plan server patching.
26.1 Server role
Each server's documented role defines needed services.
Each role document lists purpose, owner, users, needed services, data held, backup method and patch window. The services list is what the server lab compares against. For the file server, the role is shared folders and printing, but printers now connect directly, so the print spooler is no longer a needed service. The old application server's role is the least clear, so Aisha and Gareth talk to its users before writing which services it needs.
26.2 SP 800-123
NIST's server security guide recommends removing unneeded services and applications and patching regularly.
Aisha applies the guide's advice to all four servers, not only to the two that hold the most data. Unneeded services are found by comparing what runs with each role document, and patching follows the monthly window. The guide also explains why: each service is more code to patch and configure, and the old telnet service on the file server is an example nobody uses. Gareth and the contractor apply the CIS Benchmark level one items for each server's operating system, recording a reason for each item they skip.
26.3 Patching servers
Servers are patched in a monthly window after backups are verified.
Before each monthly server patch, Gareth confirms the latest backup completed and that a restore test was done in the last quarter. The finance server is patched on the second Sunday after month-end, so finance staff are not disrupted. Server updates are therefore judged against this window, not the 14-day laptop rule. If the backup check fails, the patch is postponed and the delay recorded with a new date, as for any other exception.
26.4 Admin access
Named admin accounts only.
Gareth and the contractor use it-gareth and it-contractor, each with multi-factor authentication. The contractor's account reaches only the servers they support and is enabled only for agreed maintenance windows. The shared admin account is disabled, so every server change can be traced to a named person. The access register lists both accounts and the servers each can reach, and the monthly review compares it with the admin groups on each server. Admin sign-ins to servers are then reviewed weekly in the logon lab.
26.5 Logging
Server logs go to a central store.
Server sign-in records, install records and service errors are collected by the management server, so they survive if a server's own log fills up. NIST SP 800-92 describes this kind of central collection as the first step in log management. Gareth reviews the server sign-ins weekly, and the records are kept for 90 days. Collecting logs centrally also means the old application server's records are kept even while it runs on an unsupported operating system.
Role documents
Each server's role document lists purpose, owner, users, needed services, data held, backup method and patch window. For the finance server, the role is the finance application and database, used by three staff, backed up nightly and patched on the second Sunday. For the file server, the role is shared folders and printing for the office.
Writing the role documents takes Aisha and Gareth an afternoon but immediately raises questions: does the file server still need printing, now that printers connect directly? The answer is no, which feeds chapter 30.
Role documents are stored with the server inventory and reviewed yearly.
Contractor access
The contractor's access is limited to the servers they support.
Patch windows
Servers are patched in a fixed monthly window after the backup check. The finance server is patched after month-end, so staff are not disrupted during busy periods. The window is agreed with staff and published on the calendar, so everyone knows when brief outages may happen.
Project log entry
Hardening the servers follows the CIS Benchmark for each operating system, applied selectively. Gareth and the contractor go through the benchmark's level one items, mark which apply to each role, and record why any are skipped. Skipped items are few and each has a named reason, such as an application dependency.
Worked example
Aisha drafts role documents for each server with Gareth; the old application server's role is unclear, prompting a talk with its users.
Synthetic case. Synthetic.
Errors and limits
Without role documents, nobody knows which services are needed.
Exercises
- EX076 — Role doc. What defines needed services? Rubric: 3 = documented role; 2 = partial; 1 = vague; 0 = none.
- EX077 — Patch window. When are servers patched? Rubric: 3 = monthly after backup verification; 2 = partial; 1 = vague; 0 = none.
- EX078 — Unclear role. What did the old server's unclear role prompt? Rubric: 3 = talk with users; 2 = partial; 1 = vague; 0 = none.
Synthesis
Document roles to harden servers.
Continue studying — chapter 26 of 40
← Chapter 25 (draft) · Course chapter index · Chapter 27 (draft) →