AUD507: Auditing Systems, Applications, and the Cloud

Overview

This section provides the "on-ramp" for the highly technical audit tools and techniques used later in the course. After laying the foundation for the role and function of an auditor in the information security field, this section's material provides practical, repeatable and useful risk assessment methods that are particularly effective for measuring the security of enterprise systems, identifying control gaps and risks, and enabling us to recommend additional controls to address the risk. We finish off the section with an introduction to the risks and audit techniques that are important in cloud environments.

The first part of this section is dedicated to defining the terms used in the class and setting the stage for performing highly effective technology security audits. We follow this with demonstrations of practical risk assessments using consequence/cause analysis and time-based security. We discuss what defense-in-depth really means and how to apply the results of our risk assessments to providing a well-reasoned deep defense of our enterprise systems and business processes. We apply these risk assessment and defense concepts to realistic case studies involving the controls commonly used by enterprises.

We present a proven audit process and the qualities required of a technical auditor. We discuss how to plan for and manage audit engagements, how to gather useful audit evidence, and how to best present findings to management in both written reports and in-person presentations.

During the audit planning discussion, we focus on the importance of audit planning and inventory gathering for both private and public clouds. and how shared responsibility models affect our work as auditors for cloud customers. We also cover some of the tools that will make your life much easier as an IT auditor. The first is NMAP, which can be used for host and service discovery, service and OS version identification, and even configuration checking. We present the "auditor's view" of NMAP, including the settings to use for more reliable audit results and the scripts which might speed up your evidence gathering. Then we move on to a discussion of vulnerability scanners and their use in audit, assurance and operations in the enterprise.

We finish the section with coverage of audit fieldwork and reporting, giving tips that you will use during the class exercises and in your job.

Exercises

• Audit Tool Setup
• Network Discovery and Inventory
• Cloud Service Provider Tools
• Cloud Service Provider Inventory

Topics

Auditor's Role as it Relates to:

• Policy Creation
• Policy Conformance
• Incident Handling

Basic Auditing and Assessing Strategies

• Baselines
• Time-Based Security
• Thinking Like an Auditor
• Developing Auditing Checklists from Policies and Procedures
• Performing Effective Risk Assessments

Risk Assessment

• Identifying Existing Controls
• Determining Root Failure Causes
• Using Risk Assessment to Specify New Controls

The Audit Process

• How the Steps Interrelate
• How to Effectively Conduct an Audit
• How to Effectively Report the Findings

Local Network Population Monitoring

• Robust Process for Node Identification
• Service and Version Detection
• Network Population Change Management and Monitoring

Gaining Visibility in the Cloud

• Using Cloud Provider Tools
• Gathering Cloud Inventory
• Understanding Shared Responsibility

Vulnerability Scanning

• Effective Scanning
• Effective, Business Aligned, Reporting

Overview

The majority of systems encountered on most enterprise audits are running Microsoft Windows in some version or another. The centralized management available to administrators has made Windows a popular enterprise operating system. The sheer volume of settings and configurable controls, coupled with the large number of systems often in use, makes auditing Windows servers and workstations a huge undertaking.

In this section, we teach students how to audit Windows systems and Active Directory domains at scale. We begin with an introduction to Windows PowerShell, covering how to use the shell and moving on to writing and editing scripts which allow the auditor to perform repetitive tasks quickly and reliably.

Most of this course section is spent examining operating system security in general, and Windows security in particular. We demonstrate how to use PowerShell, Windows Management Instrumentation (WMI), command-line and graphical tools to obtain audit evidence from Windows systems. We move from there to auditing Microsoft Active Directory using PowerShell and command-line tools which access the Lightweight Directory Access Protocol (LDAP).

We continue with discussions of user management, user rights management, file, registry, and share permissions. Finally, we wrap up the section by exploring Windows logging options and how to use the tools and scripts developed during the day to perform meaningful continuous monitoring of the Windows domain and systems. One of the primary goals of the material presented is to allow the auditor to move from checking registry settings to helping administrators to create a comprehensive management process that automatically verifies settings. With this type of system in place, the auditor can step back and begin auditing the management processes which generally help us to be far more effective.

Exercises

• Intro to PowerShell
• Windows System Measurements
• Users, Permissions and Logging
• Compliance and Testing at Scale

Topics

Windows Support and End of Life

PowerShell Command Essentials

PowerShell Scripting

Windows Management Instrumentation (WMI)

Windows System Measurements

• Operating System Information
• Hardware Information
• Patches Installed
• Software Installed
• Services

Users and Groups

• Local Users and Groups
• Active Directory
• Password Security

Rights and Permissions

Group Policy and Logging

Auditing at Scale

Overview

While many enterprises today use Microsoft Windows for their endpoint systems, Linux and other Unix variants are well-established as servers, security appliances and in many other roles. Given the nature of the work these Unix variants do, it is critical to ensure their security. Add to that the fact that mass centralized administration is less likely to occur with these systems, and auditing at scale becomes even more important.

This section uses Ubuntu (Debian-based) and Alma (Redhat-based) Linux as the example operating systems. We assume that students may have little or no Linux experience and build skill during the day accordingly. We begin with a discussion of system accreditation in a field where many servers are "snowflakes" - uniquely designed and different from our other enterprise systems. Then, we move on to discuss the fundamentals of Linux/Unix operating systems and the tools available to auditors for system testing and for developing audit scripts.

The bulk of the section concentrates on understanding Linix/Unix operating systems and using native tools and scripts to gather system information, enumerate running services, determine software patch levels, audit user access and privilege management, examine system logs and examine configuration and hardening. Emphasis is placed throughout the day on developing reusable tools and scripts which can be used to gather audit evidence on a variety of Linux/Unix systems.

Neither Unix nor scripting experience is required for this section. The course book and hands-on exercises present an easy-to-follow method, and the instructor is prepared to help with any difficulty students have in this sometimes unfamiliar environment.

Exercises

• Linux System Information and Permissions
• File Integrity, Kernel Settings and Services
• Linux Logging
• Linux System Audits

Topics

Accreditation and Snowflakes

Linux Audit Introduction

• System Accreditation
• Bash and Linux Tools
• System Information
• Filesystems

Bash Scripting

System Hardening

• Hardening Settings
• File Integrity Assessment

Services, Network Configuration and Logging

• Services
• Patching
• Network Settings
• Linux Logging

User and Privilege Management

• Local Passwords
• Pluggable Authentication Modules
• SSH and Sudo Configuration

Full System Audits

Overview

This section focuses on securing the enterprise network. The days are gone when a good firewall at the edge of the network is all we really need. In fact, in many enterprises, the network has no real "edge". Auditors should encourage their organizations to focus on security within the network with the same diligence as they use at the perimeter.

We begin the section with a discussion of private cloud technologies used in the modern enterprise. First, we look at the security issues related to virtualization hosts and present a list of controls which auditors should examine for the most commonly used hypervisors, with an emphasis on VMware products.

The next part of the section is dedicated to understanding containers and container orchestration tools and how they should be deployed and configured. Using the Center for Internet Securitys (CIS) Benchmarks as guides, we take a look at how our container deployments should be secured and the important items to audit in those deployments. We wrap up this section with a discussion of serverless functions and their use in the enterprise.

Then, we examine how enterprises integrate cloud technologies into their portfolios and look at how cloud providers and their customers should share security responsibilities. We examine guidance from the Cloud Security Alliance and major cloud vendors to develop a list of items to review when auditing an organizations use of cloud services. We cover audit and security concerns with identity and access management, logging and monitoring, networking, infrastructure, compute resources, infrastructure as code, storage and databases. We examine the CIS benchmarks for the three largest cloud providers and review data gathering techniques to audit all three.

Exercises

• VMware and Kubernetes
• Cloud Identity and Access Management
• Cloud Infrastructure
• Cloud Benchmarks

Topics

Private Clouds and Hypervisor Security

• Common Hypervisors
• Useful Hypervisor Audit Tools

Public Cloud Audit Toolkit

Auditing the Public Cloud: Part 1

• Shared Responsibility
• Identity and Access Management

Auditing the Public Cloud: Part 2

• Logging and Monitoring
• Networking and Infrastructure
• Compute
• Infrastructure as Code

Auditing the Public Cloud: Part 3

• Storage and Databases
• Benchmarks and Beyond

Overview

Web applications seem to stay at the top of the list of security challenges faced by enterprises today. The organization needs an engaging and cutting-edge web presence, but the very technologies which allow the creation of compelling and data-rich websites also make it very challenging to provide proper security for the enterprise and its customers. Unlike other enterprise systems, our web applications are freely shared with the world and exposed to the potential for constant attack.

We begin this section with a discussion of the suite of technologies which make modern web applications work and the tools which auditors can use to identify, analyze, and manipulate these technologies as part of a well-designed and thorough security audit. We cover the technologies which make the web work: including HTML, HTTP, AJAX, web servers and databases. We also introduce the use of proxies in testing web applications by capturing, examining, and sometimes manipulating the traffic between a web client and the server.

We move on to introduce students to many of the resources available from the Open Web Application Security Project (OWASP), focusing on their Top 10 vulnerabilities list and the Top 10 Proactive Controls for web applications. From this foundation, we build a list of five critically important web development and deployment practices which serve as the basis for performing rigorous testing of web applications in the enterprise.

We dedicate most of the section to teaching the controls which can be used to secure applications and the skills needed to test and validate these controls. We develop and use a checklist for testing the most common and important security vulnerabilities. Throughout the section, students have the opportunity to use these tools to test sample web applications similar to those commonly deployed in today's enterprises. We also offer advice on how engineers, administrators, and developers can better secure the web technologies they design, implement and maintain. And finally, we discuss the best ways to report on findings and make useful recommendations.

Exercises

• Web App Auditing with Burp
• Server Configuration and Static Analysis
• Fuzzing with Burp
• Injection Flaws

Topics

Understanding Web Applications

Server Configuration

• Information Disclosures
• HTTPS Settings

Secure Development Practices

• Use of Security Frameworks
• Dev/Test/Prod
• Multi-Tier Development
• Error Handling
• Code Review
• Static and Dynamic Analysis
• Scanning Caveats

Authentication

• HTTP Basic Authentication
• Forms Authentication
• Client Certificates
• Username Harvesting
• Brute Forcing
• Password Security

Session Tracking

• Tracking Mechanisms
• Session Defenses
• Cross-Site Request Forgery

Data Handling

• GET vs. POST for Sensitive Data
• Input/Output Flaws and Solutions
• Injection Flaws - Cross-Site Scripting
• Injection Flaws - SQL Injection
• Other Injection Flaws
• Sensitive Output

Logging and Monitoring

• Log Everything
• Don't Log Too Much
• Auxiliary Logging Techniques

Overview

Audit Wars is a capstone exercise which allows students to test and refine the skills learned throughout the course. Using an online "capture the flag" (CTF) engine, students are challenged to audit a simulated enterprise environment by answering a series of questions about the enterprise network, working through various technologies explored during the course.

At the conclusion of this section, students are asked to identify the most serious findings within the enterprise environment and to suggest possible root causes and potential mitigations.

Exercises

Full-day Capture the Flag

• Audit Essentials
• Windows Systems
• Windows Domains
• Kubernetes
• OSQuery and Fleet
• Web Applications
• Cloud Services
• Linux

Topics

Technologies included in the capstone exercise include:

• Cloud Services
• Kubernetes
• Windows Active Directory
• Windows Workstations
• Web Applications
• OSQuery
• Fleet DM
• Linux