As IT continues to commoditize and organizations drive more efficient operations, IT and security departments continue to implement and rely on automation, management, and orchestration tools. The function of many of these tools is to manage or enhance security but may not be properly protected. Tools like Chef, Puppet, Ansible, Vagrant, vulnerability scanners, Active Directory, and many others can provide one stop shopping for an adversary to compromise an environment due to the functionality and level of access these tools have to an IT environment. Fortunately, we’ve not yet seen widespread exploitation of these tools, but it is happening, and I expect they will become an increasingly important target for adversaries, and likely even automated malware attacks.
The environment these tools operate in need to be resilient against attack. Here are some guidelines for doing so:
- Require multi-factor authentication to the operating system and any applications
- Dedicate the system to the function
- Prevent inbound and outbound Internet access from the servers these systems operate on and limit inbound traffic from only authorized management hosts. Inbound and outbound traffic should be allowed, as necessary, to only those devices the system needs to connect to as part of the application’s functionality and retrieve software updates, and only on the network ports required. I *strongly* recommend such systems NOT be managed by Active Directory.
- Monitor the systems and applications for any evidence of compromise, including file integrity monitoring and/or whitelisting, A/V logs, and firewall logs – particularly looking for unexpected inbound or outbound connection attempts.
- Workstations that administrators use to manage these tools must similarly be secured, including:
- Dedicating the workstation to the purpose of administering these tools – no email access, web access, Office applications, and so on.
- Block inbound and outbound Internet access from these workstations.
- Blocking ALL inbound network traffic
- Limit outbound connections to only the systems being managed and that needed to retrieve software updates
- Monitor the systems and applications for any evidence of compromise, including file integrity monitoring and/or whitelisting, A/V logs, and firewall logs – particularly looking for unexpected inbound or outbound connection attempts.
This all may seem like overkill, but it but consider the level of access these systems have and the destruction an adversary can create by abusing them.