Protecting the Internal Attack Surface
Inside Job
© Lead Image © peshkov, 123RF.com
Security is more than a firewall. The biggest worry is what happens when an intruder gets inside. We take a look at some common misconfiguration issues that can lead to privilege escalation.
When configuring and deploying a new machine, security is a primary consideration. Most security analyses focus on vulnerabilities in network-facing services. Activities such as updating the kernel to the latest stable version, configuring a perimeter firewall, and implementing Multi-Factor Authentication for SSH access are now standard practices for any system administrator.
Yet, many Linux servers considered "hardened" hide often-overlooked systemic vulnerabilities, including misconfigurations at the filesystem and local services level. Whether you administer a web server, a VPN gateway, or a Linux-based firewall, non-least-privilege permissions, poorly designed tasks, exposed management services, and insufficiently verified trust relationships can create unexpected paths for privilege escalation.
The concept of an attack surface is often defined solely by perimeter defenses, but a perimeter strategy is not enough. Conceptually, it makes much more sense to divide the surface into two areas: the external and the internal. The external includes open ports and exposed services, and the internal is where a user who already has local access can cause truly significant damage. A remote exploit isn't necessarily needed to compromise a system; a user with limited access who manages to gain root privileges through misconfigurations is decidedly more worrying.
[...]
Buy this article as PDF
(incl. VAT)