CDM-CYBER-DEFENSE-eMAGAZINE-March-2019

questions such as, “Who added a workstation to a domain?” or “When did this user receive
administrative privileges?”
These questions pose many potential answers. Configurations may change due to user
modifications, settings being misconfigured initially, or machines being turned off when group
policies are entered. When configuration changes go unnoticed, organizations are left facing
easily exploitable vulnerabilities. These vulnerabilities are one of the main reasons security
frameworks recommend that security teams utilize a form of configuration management
automation that provides consistent security metrics, as opposed to a manual process.
Setting a Standard
A majority of today’s security frameworks, such as NIST 800-53, include configuration
management requirements that reflect the results of Operation Eligible Receiver 97. Guidelines
within NIST 800-53 suggest practices such as setting a configuration baseline and limiting
systems to only provide essential capabilities in a control known as “least functionality.” 1
Frameworks provide a basis for general requirements but do not provide details on how
configuration should be set.
Security teams utilize validated standards, such as Security Technical Implementation Guides
(STIGs) from the Defense Information Systems Agency (DISA), for specifics of how configurations
should be set. These STIGs are required configuration standards for all Department of Defense
devices and systems and have provided a guideline to secure areas of risk within networks since
1998. 2 Following these established standards provides security teams with clear direction in their
configuration management process, while ensuring compliance with frameworks and improving
the security posture of their organization.
Monitoring Configuration Drift
Even when organizations follow a configuration guideline like STIGs, without a proper monitoring
solution, the risk for configuration drift remains. Drift occurs as devices, software, or users are
added to a network and can be almost impossible to track manually. An example of drift affecting
an organization’s security posture can be seen when looking at user rights assignments,
specifically the ability to debug a program. Debug rights are typically only granted to administrative
accounts, but misconfigurations and drift lead to regular users receiving them unnecessarily.
Another common case is insecure software requiring SeDebugPrivilege to be turned on. When
partnered with an inability to properly set permissions, organizations are put in danger of
Ransomware. Attackers often use these debug rights assignments to run hash tools against files
and collect passwords.
1
https://csrc.nist.gov/csrc/media/publications/sp/800-53/rev-5/draft/documents/sp800-53r5-draft.pdf
2
https://iase.disa.mil/stigs/Pages/index.aspx