Isolation of Legacy Systems a View on Security Concerns for Non-Isolated Legacy Systems
Total Page：16
File Type：pdf, Size：1020Kb
Isolation of Legacy Systems A View on Security Concerns for Non-Isolated Legacy Systems Autors Christoph Falta and Christoph Mahrl Version 1.0 Date 05. November 2015 1. Introduction Legacy systems, a term for out-of-date methods, technologies, computer systems or applications, are considered problematic as continued use of such systems often imply security relevant issues and might therefore impact enterprise operations. Nevertheless there are possibly compelling reasons for keeping a legacy system that have to be taken into account. These include: Costs of migration and redesign of new system High availability requirements of legacy systems Lack of understanding and documentation of the old system to redesign a new one Lack of vendor support to migrate the legacy system to a new platform Stability concerns of a new system The legacy system already runs satisfactorily Generally the use of legacy systems is potentially dangerous. Older operating systems or applications may contain vulnerabilities, since the lack of proper security patches being available or applied is putting these systems at risk of being compromised. Enterprises should always take this riskiness into account as cyber-crime is an increasingly and ongoing topic confirmed by the following surveys and reports: In 2014 T-Systems1 reported that about 92% of enterprises in Austria expected cyber- crime incidents, 14% reported about daily attacks. According to PWC2 about 90% of large organizations had suffered a security breach in 2015, while nearly three quarters of small organizations reported a security breach. A survey of BITKOM 3 stated, that over 50% of German companies fell victim to espionage, sabotage or data theft attacks in 2015. Kaspersky4 reported in 2014 that 94% of companies encountered an external security incident over the last 12 months and 87% had to deal with an internal security issue. This whitepaper therefore discusses proactive and reactive security measures that can be implemented in order to mitigate risks exposed by legacy systems. It is intended for organizations where immediate migration is not an option 1 Cyber-Security Report 2014, T-Systems, 2014 2 Information Security Breaches Survey, PWC, 2015 3 Digitale Wirtschaftsspionage, Sabotage und Datendiebstahl 2015, BITKOM, 2015 4 IT Security Risks Survey 2014, Kaspersky, 2014 2 2. Management Summary This whitepaper discusses proactive and reactive security measures that can be implemented in order to mitigate risks exposed by legacy systems. It is intended for organizations where immediate migration is not an option, therefore, the discussed techniques aim at providing secure and cost-efficient countermeasures. In general, two kinds of countermeasures are discussed in this whitepaper: proactive and reactive. Proactive security measures are designed to harden a legacy system against attacks in order to either reduce the impact of a successful attack or prevent the attack at all. Reactive security measures provide the necessary tools to correctly detect, respond and recover from an attack in an efficient and coordinated way. Figure 1 – Proactive and reactive countermeasures The protection of legacy systems is a challenging process and it is inevitable to address it as a continuous process and not as a task or a project that has a fixed end date. Therefore it is of essence to not only implement technical countermeasures but also to put in place a vulnerability management process that tightly integrates with existing risk assessment strategies and allows to continuously monitor existing legacy systems and quickly adapt in case of new threats. When designing countermeasures and overall security strategies for legacy systems, new vulnerabilities continuously arise. Preparation for change, is a key component to success. 3 3. Proactive Security The value of a proactive approach to prevent malware and other types of attacks before actual expensive damage will occur is indispensable for organizations. Security does not begin with the detection of an attacker inside the network, which does not mean that reactive measures are unnecessary. But in order to avoid compromising in advance, a proactive scheme will play a critical role for good organization’s cyber defense. 3.1 Secure Network Engineering Minimizing opportunities for attackers begins with properly securing the network environment. A key component in secure network engineering is the physical and / or logical separation of IT-systems in different network zones, each with its certain kind of purpose. On this basis, network traffic is filtered between these segments and boundary defense solutions like firewalls and proxies ensure a controlled network flow through network borders and segments, only allowing specific traffic based on the “Least- Privilege” principle. 3.1.1 Network Segmentation An elaborate design and implementation of a network where the network environment is separated in different zones, each meeting certain security requirements, is very important. A minimum of a three-tier architecture is recommended (DMZ, middleware and private network), to have a more granular control of system access and additional boundary defenses. The general purpose of network segmentation using dedicated zones, each may consisting of one or more network segments, is to control what systems and services should be reachable depending on the segment you are in. This ensures that if a system is compromised an attacker is restricted to the policy that is applied to the part of network the system belongs to. Examples of zones usually deployed are: Public domain and guest zone External server zone / Demilitarized zone (DMZ) Internal server zone Internal client zone Internal system management zone In order to sustain network security an adequate segmentation on all relevant layers of the OSI model is necessary. Network security measures are applied on OSI layers 1 to 4, since security of layers 5 to 7 is application-dependent. On different OSI layers, different kind of segmentation techniques are applied: Physical Layer On layer 1 network access is physically separated by using dedicated hardware such as switches, access points, etc. and it is recommended if possible and economically feasible to isolate critical services from each other. 4 Data Link Layer On layer 2 logical separation of a physical network in different VLANs takes place. Each network segment will be assigned a dedicated VLAN to ensure proper separation of responsibilities. Network Layer and Transport Layer On layer 3 and 4 network traffic is filtered between zones and different networks by using various types of boundary defense appliances (see 3.1.2 Boundary Defense). 3.1.2 Boundary Defense Systems that are reachable across the Internet are at risk, as attackers use these systems as primary targets to get initial access into an organization. This includes DMZ systems, workstations, laptop computers etc. that interact with other systems in the Internet through network boundaries. Weaknesses in configuration and / or architectural implementation of perimeter appliances and network devices are the most common reason how attackers gain access into an organization. Once attackers has these systems at their command, they often manage to extend their access inside the target network. Eventually attackers will steal or change information and / or prepare a persistent presence for later attacks, in the worst case without anyone knowing for months or years. To reduce the chance of a successful attack the flow of traffic through network boundaries has to be controlled thoroughly looking for restricted and suspicious traffic, such as botnet communication, internal attacks or evidence of compromised machines. It is recommended to implement boundary defense at multiple layers within the network, relying on firewalls, proxies and network-based IDS/IPS to filter inbound and outbound traffic: Boundary defense o Boundary defense appliances should not only defend an organization’s perimeter but all network segments including internal boundaries like . external / internal server zones . client zones Firewall o Firewalls ensure that only explicitly allowed traffic (according to the “Least-Privilege”-Principle) to systems, services or ports are allowed. o Not explicitly allowed traffic should be denied per default. o Network flow is further minimized by using blacklists containing malicious IP addresses that are filtered throughout the corporate network. Application Firewall o In front of every critical server a dedicated application firewall is recommended as it additionally validates and verifies traffic from and to the server filtering non-authorized traffic. Proxy o The communication between DMZ systems and private networks should occur over application proxies to prevent direct access to internal networks and mitigate security risks. 5 IDS/IPS o Malicious activities and intrusive network behavior is detected and filtered by network-based IDS/IPS and is highly recommended in order to contain potential damage. o Breach Detection Systems (BDS), incorporating IDS/IPS technology, could be used instead to not only check if traffic but also if transported files and executables are malicious (see chapter 3.3 Breach Detection and Prevention). 3.2 System Hardening Hardening is one of the most important aspects of system security, since it offers a very flexible approach that can help to prevent or slow down various attack vectors. However, due to its complex and time-consuming nature, hardening