[oagitm] US-CERT Technical Cyber Security Alert TA11-200A -- Security Recommendations to Prevent Cyber Intrusions

From: "MASSE Theresa A * EISPD ESO" <theresa.a.masse@xxxxxxxxxxx>
To: <oagitm@xxxxxxxxxxxxx>
Date: Wed, 20 Jul 2011 08:26:53 -0700
OAGITM Members:

Please review the following message from US-CERT - - it outlines many
good security practices and resources.

Regards,

Theresa A. Masse
State Chief Information Security Officer
Department of Administrative Services
Enterprise Security Office
503-378-4896
Data Classification 2 - Limited

________________________________________________________________________
________________

From: US-CERT Technical Alerts <technical-alerts@xxxxxxxxxxx>
Organization: US-CERT - +1 202-205-5266
Date: Tue, 19 Jul 2011 17:18:31 -0400
To: US-CERT Technical Alerts <technical-alerts@xxxxxxxxxxx>
Subject: US-CERT Technical Cyber Security Alert TA11-200A -- Security
Recommendations to Prevent Cyber Intrusions


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


                    National Cyber Alert System

              Technical Cyber Security Alert TA11-200A


Security Recommendations to Prevent Cyber Intrusions

   Original release date: July 19, 2011
   Last revised: --
   Source: US-CERT


Overview

   US-CERT is providing this Technical Security Alert in response to
   recent, well-publicized intrusions into several government and
   private sector computer networks. Cyber thieves, hacktivists,
   pranksters, nation-states, and malicious coders for hire all pose
   serious threats to the security of both government and private
   sector networks. A comprehensive security program provides the best
   defense against the full spectrum of threats that our computer
   networks face today. Network administrators and technical managers
   should not only follow the recommended security controls
   information systems outlined in NIST 800-53 but also consider the
   following measures. These measures include both tactical and
   strategic mitigations and are intended to enhance existing security
   programs.


Recommendations

   * Deploy a Host Intrusion Detection System (HIDS) to help block and
     identify common attacks.

   * Use an application proxy in front of web servers to filter out
     malicious requests.

   * Ensure that the "allow URL_fopen" is disabled on the web server
     to help limit PHP vulnerabilities from remote file inclusion
     attacks.

   * Limit the use of dynamic SQL code by using prepared statements,
     queries with parameters, or stored procedures whenever possible.
     Information on SQL injections is available at
     <http://www.us-cert.gov/reading_room/sql200901.pdf>.

   * Follow the best practices for secure coding and input validation;
     use the secure coding guidelines available at:
     <https://www.owasp.org/index.php/Top_10_2010> and
     
<https://buildsecurityin.us-cert.gov/bsi/articles/knowledge/coding/305-B
SI.h
tml>.

   * Review US-CERT documentation regarding distributed
     denial-of-service attacks:
     <http://www.us-cert.gov/cas/tips/ST04-015.html> and
     <http://www.us-cert.gov/reading_room/DNS-recursion033006.pdf>.

   * Disable active scripting support in email attachments unless
     required to perform daily duties.

   * Consider adding the following measures to your password and
     account protection plan.* Use a two factor authentication method
     for accessing privileged root level accounts.

   * Use minimum password length of 15 characters for administrator
     accounts.

   * Require the use of alphanumeric passwords and symbols.

   * Enable password history limits to prevent the reuse of previous
     passwords.

   * Prevent the use of personal information as password such as phone
     numbers and dates of birth.

   * Require recurring password changes every 60-90 days.

   * Deploy NTLMv2 as the minimum authentication method and disable
     the use of LAN Managed passwords.

   * Use minimum password length of 8 characters for standard users.

   * Disable local machine credential caching if not required through
     the use of Group Policy Object (GPO). For more information on this
     topic see Microsoft Support articles 306992 and 555631.

   * Deploy a secure password storage policy that provides password
     encryption.

   * If an administrator account is compromised, change the password
     immediately to prevent continued exploitation. Changes to
     administrator account passwords should only be made from systems
     that are verified to be clean and free from malware.

   * Implement guidance and policy to restrict the use of personal
     equipment for processing or accessing official data or systems
     (e.g., working from home or using a personal device while at the
     office).

   * Develop policies to carefully limit the use of all removable
     media devices, except where there is a documented valid business
     case for its use. These business cases should be approved by the
     organization with guidelines for there use.

   * Implement guidance and policies to limit the use of social
     networking services at work, such as personal email, instant
     messaging, Facebook, Twitter, etc., except where there is a valid
     approved business case for its use.

   * Adhere to network security best practices. See
     <http://www.cert.org/governance/> for more information.

   * Implement recurrent training to educate users about the dangers
     involved in opening unsolicited emails and clicking on links or
     attachments from unknown sources. Refer to NIST SP 800-50 for
     additional guidance.

   * Require users to complete the agency&apos;s "acceptable use
     policy" training course (to include social engineering sites and
     non-work related uses) on a recurring basis.

   * Ensure that all systems have up-to-date patches from reliable
     sources. Remember to scan or hash validate for viruses or
     modifications as part of the update process.

 ____________________________________________________________________
-----------------------------------------------------------------------------
Posted to the Oregon Association of Government I.T. Management List (OAGITM)

OAGITM ListServ homepage: //www.freelists.org/list/oagitm

To post to the list, send email to: oagitm@xxxxxxxxxxxxx

To unsubscribe, send email to oagitm-request@xxxxxxxxxxxxx with "unsubscribe" 
in the Subject

To view list archives, visit: //www.freelists.org/archive/oagitm

For general ListServ help, visit: //www.freelists.org/help
-----------------------------------------------------------------------------
[oagitm] US-CERT Technical Cyber Security Alert TA11-200A -- Security Recommendations to Prevent Cyber Intrusions

Other related posts:
