GICSP Book 410.5 ICS Security
Governance.
What OS is common in ICS Workstations?
Windows
What OS is common among ICS Servers?
Linux/Unix
What was the design philosophy for Windows?
Single user platform grown into a server OS
What was the design philosophy for Unix?
Multi-process and multi-user that grew into a desktop platform
What was the design philosophy for Linux?
Grew out of unix, with a different kernel but similar user interface & SW
What are the three key elements of Linux/Unix OSs
Hardware - Collection of components that house our data and provide means to communicate
Kernel - Memory resident part of the OS
Shell - Portion of OS that users and processes interact directly
Why is the kernel of importance to attackers?
It is first thing loaded into memory at bootup
What does the /dev directory contain?
Special device files used to communicate with the physical hardware devices controlled by the OS
What does the /usr directory contain?
Critical components of the OS live, such as sys binaries, programming libs and tools, and online
documentation
What does the /var directory contain?
Home of frequently-changing data, such as log files/temp queues for sys services
What are three benefits to partitioning disk space?
1. Disk space exhaustion can be prevented
2. Makes backups easier
3. allows security admin to set different security options on different parts of the Filesystem
What is the df command and what does it show?
, disk free command that helps admins find partitions who were running out of disk space.
What is the chroot() command?
App isolation feature that must be enabled on an app by app basis and basically doesnt let the app
"see: any of the filesystems outside of the directory that chroot() was invoked on
What is the security advantage to chroot()?
If a vuln is discovered and exploited in the app, then the attacker can only access the parts of the
filesystem where the app chroot()ed itself.
What are the steps to hardening linux>
Disable unused services
follow distro sec guidance
Run Lynis and address findings
Consider other free/paid 3rd party sec sw
configure iptables/iftables
Automate extra needed configs
What are "services" in linux & Unix typically called?
Daemons
What does the linux system look for immediately after boot?
init daemons that provides the most fundamental layer of goodness that goes between the kernel
and the user
What are the two types of inits
SysV
BSD
How does System V's init start daemons?
based on runlevel:
0 - shutdown/halt
1 - Single user/recovery mode
2-5 - varies by distro
6 - reboot
How does systemd start daemons?
Based on system state's "target" such as:
poweroff.target
emergency.target
rescue.target
What is Lynis?
A way to harden linux OS's by auditing a system, identifying weak settings with links to descriptions
on their website, and potentially a central mgmt sys
What is Bastille Linux?
Governance.
What OS is common in ICS Workstations?
Windows
What OS is common among ICS Servers?
Linux/Unix
What was the design philosophy for Windows?
Single user platform grown into a server OS
What was the design philosophy for Unix?
Multi-process and multi-user that grew into a desktop platform
What was the design philosophy for Linux?
Grew out of unix, with a different kernel but similar user interface & SW
What are the three key elements of Linux/Unix OSs
Hardware - Collection of components that house our data and provide means to communicate
Kernel - Memory resident part of the OS
Shell - Portion of OS that users and processes interact directly
Why is the kernel of importance to attackers?
It is first thing loaded into memory at bootup
What does the /dev directory contain?
Special device files used to communicate with the physical hardware devices controlled by the OS
What does the /usr directory contain?
Critical components of the OS live, such as sys binaries, programming libs and tools, and online
documentation
What does the /var directory contain?
Home of frequently-changing data, such as log files/temp queues for sys services
What are three benefits to partitioning disk space?
1. Disk space exhaustion can be prevented
2. Makes backups easier
3. allows security admin to set different security options on different parts of the Filesystem
What is the df command and what does it show?
, disk free command that helps admins find partitions who were running out of disk space.
What is the chroot() command?
App isolation feature that must be enabled on an app by app basis and basically doesnt let the app
"see: any of the filesystems outside of the directory that chroot() was invoked on
What is the security advantage to chroot()?
If a vuln is discovered and exploited in the app, then the attacker can only access the parts of the
filesystem where the app chroot()ed itself.
What are the steps to hardening linux>
Disable unused services
follow distro sec guidance
Run Lynis and address findings
Consider other free/paid 3rd party sec sw
configure iptables/iftables
Automate extra needed configs
What are "services" in linux & Unix typically called?
Daemons
What does the linux system look for immediately after boot?
init daemons that provides the most fundamental layer of goodness that goes between the kernel
and the user
What are the two types of inits
SysV
BSD
How does System V's init start daemons?
based on runlevel:
0 - shutdown/halt
1 - Single user/recovery mode
2-5 - varies by distro
6 - reboot
How does systemd start daemons?
Based on system state's "target" such as:
poweroff.target
emergency.target
rescue.target
What is Lynis?
A way to harden linux OS's by auditing a system, identifying weak settings with links to descriptions
on their website, and potentially a central mgmt sys
What is Bastille Linux?
