Free Privileged Account Discovery Tool: Identify & secure credentials to stop lateral movement. Download Free

BeyondTrust
  • Products
    Privileged Password Management
    Discover, manage, audit, and monitor privileged accounts
    Password Safe DevOps Secrets Safe
    Endpoint Privilege Management
    Manage privileges on Windows, Mac, Linux, and Unix endpoints
    Windows and Mac Unix and Linux Active Directory Bridge
    Secure Remote Access
    Centrally manage and secure remote access for service desks and vendors
    Remote Support Privileged Remote Access
    BeyondInsight Analytics
    See All Solutions
  • Resources

    Universal Privilege Management

    Our innovative Universal Privilege Management approach secures every user, asset, and session across your entire enterprise.

    Watch Video

    Learn

    Case Studies
    Competitor Comparisons
    Datasheets
    Glossary
    Product Demos
    Whitepapers

    Attend

    Events
    Go Beyond
    Training
    Webinars

    Support

    Changelog
    Professional Services
    Technical Documentation
  • Blog
  • Partners
  • Contact
  • Support
  • Services
  • Training
  • Events
  • Company

How to Attack and Defend a Linux System

June 28, 2017

  • Blog
  • Archive

Attack and Defend Linux Systems


According to research published by both Verizon and FireEye, most companies don't detect that they’ve suffered a security breach until many months later. When the company finally does learn of the compromise—often from a third-party—the investigators must invest a tremendous amount of time and resources to identify which systems the attacker has compromised.

To avoid, or at least mitigate the impact of, such a scenario, I recommend the following courses of action:

  1. Prevent the compromise through proactive measures
  2. Contain the compromise to reduce the probability of lateral movement
  3. Detect and respond to the compromise quickly
Want to learn more? Join me in this BeyondTrust-sponsored webinar, How to Attack a Linux System + Ways to Detect and Respond Swiftly. Register now

In this blog I will review how to address each of these courses of action in the context of a Linux attack.

Preventing a Linux Attack

Most companies don't put nearly enough effort into prevention. As in medicine and software engineering, prevention ultimately requires far fewer resources than dealing with a problem. Prevention in a cybersecurity context entails eliminating known vulnerabilities in software via patches, while implementing a security development lifecycle to avoid, find and eliminate vulnerabilities in code that is created in-house. Preventive measures also include technologies such as firewalls and intrusion prevention systems (IPS), as well as tactics such as system hardening. Of course, when you use third party services (like SaaS), you implement those primarily with contracts and risk assessment activities.

Unfortunately, preventive measures won’t eliminate all risk — they just lessen the likelihood of compromise. But, they’re a critical start.

Containing a Linux Attack

Despite our best efforts at prevention, a potential for compromise remains, so we need to also put adequate effort into threat detection and containment.

Containing an attacker's lateral movement involves preventing him moving from his initial beachhead, like a single compromised system, to his end goal, say the credit card transaction database. For example, on a red team exercise, the attacker will always gain access to one system, whether through phishing, breaking into a building, or simply leaving USB thumb drives scattered in a parking lot. If you strongly segment your network, you may stop him from ever reaching the intellectual property, protected health care information, or customer credit card information he sought.

Containment also operates at the host level, especially with host-based tools, ranging from SELinux, AppArmor, and seccomp to sudo, host-based egress firewall rules and Set-UID lockdowns. These tools and measures reduce a compromised program's ability to even initiate connections to another computer. With that said, your attacker may find a successful path through your containment measure. And as we all have seen recently, SELinux and sudo have their own vulnerabilities.

Detecting & Responding to a Linux Attack

At this point, we put our effort into detection. With an average detection time spanning months, there's substantial room for improvement. My favorite measures here detect an attack or a compromise, take action to repel or contain it, and shout "incoming" to the blue team so they can start the human part of the defense. OSSEC is one such tool that can help you here.

OSSEC is a host-based intrusion detection tool that can execute programs or scripts that you set up. For example, it can automatically configure a temporary firewall block against an attacker who has unsuccessfully tried to connect to twenty of your systems within a short time window. Or, it can shut down an account that has tried to open a "honeypot" data file on the system, say one that claims to be a database backup. Of course, free tools will only take you so far, which is why it might be necessary to investigate a more complete commercial solution for Linux security, like a server privilege management solution.

Want to learn more? Join me in this BeyondTrust-sponsored webinar, How to Attack a Linux System + Ways to Detect and Respond Swiftly, where I'll attack a Linux system, achieve initial access, escalate privilege, and then take the first step to move laterally. I'll then demonstrate how to detect the attack and automatically respond to it. I will then hand off to BeyondTrust Product Manager, Paul Harper, who will discuss how with the right enterprise solution, such as PowerBroker, you can scale your detection and containment to hundreds of machines.

This is going to be an intensive and demo-centric webinar you won't want to miss. How to Attack a Linux System + Ways to Detect and Respond Swiftly.
Register now

Jay Beale

co-founder, COO and CTO, InGuardians

Jay Beale has created several defensive security tools, including Bastille Linux/UNIX and the CIS Linux Scoring Tool, both of which were used widely throughout industry and government. He has served as an invited speaker at many industry and government conferences, a columnist for Information Security Magazine, SecurityPortal and SecurityFocus, and a contributor to nine books, including those in his Open Source Security Series and the “Stealing the Network” series. He has led training classes on Linux Hardening and other topics at Black Hat, CanSecWest, RSA, and IDG conferences, as well as in private corporate training. Jay is a co-founder, Chief Operating Officer and CTO of the information security consulting company InGuardians.

Stay Up To Date

Get the latest news, ideas, and tactics from BeyondTrust. You may unsubscribe at any time.

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

You May Also Be Interested In:

Webcasts | February 09, 2021

Customer Webinar: Remote Support 21.1 Released!

Webcasts | February 24, 2021

Your PAM 2021 Blueprint: Securing Privileged Accounts for On-Premises and Cloud Assets

Whitepapers

Evolving Privileged Identity Management (PIM) In The 'Next Normal'

BeyondTrust Logo
  • Facebook
  • Twitter
  • LinkedIn

Keep up with BeyondTrust

I agree to receive product related communications from BeyondTrust as detailed in the Privacy Policy, and I may manage my preferences or withdraw my consent at any time.

Customer Support
Contact Sales

Products

  • Endpoint Privilege Management
  • Password Management
  • Privileged Remote Access
  • DevOps Secrets Safe
  • Remote Support

Resources

  • Blog
  • Case Studies
  • Competitor Comparisons
  • Datasheets
  • Glossary
  • Videos
  • Webcasts
  • Whitepapers

About

  • Company
  • Careers
  • Contact
  • Events
  • Leadership Team
  • Partner Program
  • Press

Languages

  • English
  • German
  • French
  • Spanish
  • Korean
  • Portuguese
  • Japanese
  • Privacy
  • Security
  • Manage Cookies
  • WEEE Compliance

Copyright © 1999 — 2020 BeyondTrust Corporation. All rights reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust Corporation is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.