Network Security "10 Steps to Cyber security"

[sloughman]

Hello, A member of SLT has approached me with a document from the National Cyber Security Centre titled "10 Steps to Cyber security" in One of the steps it includes the following

 

"Protect your networks from attack. Defend the network perimeter. Filter out unauthorised access and malicious content. Monitor and test security controls.

Analyse logs that could indicate an attack."

 

He has then said how does this apply to our network ? I am really not sure how to answer this. We have our Internet connectivity provided by our County Suppliers, this will include Firewall. I am currently awaiting details of exactly what is involved at County before stuff hits the school network. However we have no ability ourselves to monitor and test security controls and log files. Should we have this in place ourselves or is that more for the County suppliers to do ? I would be grateful if anyone can help me with this.

[pete]

"Protect your networks from attack. Defend the network perimeter. Filter out unauthorised access and malicious content. Monitor and test security controls.

Analyse logs that could indicate an attack."

 

He has then said how does this apply to our network ? I am really not sure how to answer this. We have our Internet connectivity provided by our County Suppliers, this will include Firewall. I am currently awaiting details of exactly what is involved at County before stuff hits the school network. However we have no ability ourselves to monitor and test security controls and log files. Should we have this in place ourselves or is that more for the County suppliers to do ? I would be grateful if anyone can help me with this.

 

Defend the network perimeter

 

As you've already guessed, if the county/RBC is your service provider, they should be able to describe (in technical detail) how they secure your router and the firewalling between you and the Internet. This (for a value of Lincolnshire/EMBC/KCOM at least) is readily available once you find a technical person or have a login to the correct portal. Ask to speak to the security team at the RBC.

 

But equally, if you provide BYOD access to students/guests/teachers, you need to ensure that's appropriately secured and fenced off from the rest of the network.

 

It's also worth pointing out that while defending the network perimeter is great, if the inside is soft and mushy then anything that gets past the perimeter will have an easy time of it. Internally you should have controls such as VLANs to segregate traffic.

 

Monitor and test Security Controls

 

You make sure patches are installed? That firewall configs work in the way you intend and are appropriate? That mail filtering works properly? That permissions are appropriate and access is set up in a way (using permission groups rather than assigning individual users to folder structures, for example) that makes it simple to audit this? etc.

 

TLDR: What do you do you ensure your network is secure and access is appropriate? How do you test/review this? What proof do you have?

 

Filter out unauthorised and malicious content

 

You already do this. Antivirus, mail filters, web filtering, esafety software (if you use it). You review security permissions to ensure they're appropriate and if someone changes roles you adjust their access accordingly. You (presumably) restrict executable content running from temporary locations, you've got file server filters to give early warnings of cryptolocker-type malware.

 

Log analysis

 

I'll preface this by saying it takes time to set up and tune the signal-to-noise ratio. Pick one low-traffic server to begin with.

 

Internally, you should be monitoring logs on your servers, network devices, etc for anomalies and have some way of presenting those anomalies to yourselves in order of important. Windows natively lets you forward particular events of your choosing to (for example) another Windows server acting as a logserver.

 

You should be flagging up things like invalid login attempts, invalid login attempts followed by a success, changes made to AD, odd webserver requests, changed files on servers etc (list not anywhere near exhaustive). Most log analysis software will already have filters to flag these events up.

 

For log analysis we use a combination of Wazuh (wazuh.com), which is a fork of OSSEC integrated with Elasticsearch, Logstash and Kibana. We supplement that with Observium for network traffic and device monitoring and we also use Icinga for up/down alerting. Icinga automatically creates tickets for our attention if certain things happen and Wazuh automatically filters alerts by priority.

[sloughman]

Many thanks to Pete above,

Basically our network covers the first three points, do other NMs do much Log Analysis as described above...We are only a small special school of 100+ so users, with just me running things network-wise, my knowledge of Log Analysis software (other than Windows server events etc) (as described above) is zero....