Linux operatsioonisüsteemi turvalisuse tugevdamise standardi loomine, implementeerimine ja auditeerimine turvavastavuseks
Files
Date
2017
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Regulatsioonid loovad väljakutseid ettevõtetele, sest nad peavad igal aastal turvavastavuseks täitma turvastandardeid. Turvastandardite mitte järgimine teeb ettevõtted küberohtudele haavatavaks. Antud magistritöö pakub lahenduse, et täita ettevõtte operatsioonisüsteemi tugevdamise nõudeid luues, implementeerides ja auditeerides Linux (Debian) operatsioonisüsteemi tugevdamise turvastandardit. Magistritöö käsitleb tugevdatud virtuaalmasina tõmmise ehitamist Microsoft Azure pilveplatvormile, mis vastab operatsioonisüsteemi tugevdamise standardile. Kuna lihtsalt ettevõtte turvavastavuse nõuete täitmine ei ole piisav, siis tuleb tagada selle auditeeritavus, et turvavastavuse täitmist audiitoritele tõestada. Antud magistritöös on koostatud lahendus, mis automaatselt auditeerib operatsioonisüsteemi tugevdamise standardit ja võimaldab kinnitada erinevusi standardi ja tegelike virtuaalmasinate konfiguratsioonide vahel. Autor on analüüsinud virtuaalmasinate turvavastavust enne ja pärast uue operatsioonisüsteemi tugevdamise standardi rakendamist.
Regulations create challenges to the companies as they must meet tough security standards for security compliance every year. Not following security standards are making companies more vulnerable to cyber threats. This paper provides a proof-of-concept solution for being compliant with operating system hardening requirements of the company by establishing, implementing and auditing Linux (Debian) operating system hardening standard. This work will focus on building a hardened virtual machine image for Microsoft Azure platform that is compliant with the hardening standard that is established in this thesis. As it is not enough to just meet the company security compliance requirements, then there is a need to ensure auditability of it, therefore a proof-of-concept solution is built for automatically auditing the operating system hardening standard that continuously allows to validate the gap between the standard and actual configurations on virtual machines. To demonstrate the result, the author analysed virtual machines compliance state before and after implementing the new operating system hardening standard.
Regulations create challenges to the companies as they must meet tough security standards for security compliance every year. Not following security standards are making companies more vulnerable to cyber threats. This paper provides a proof-of-concept solution for being compliant with operating system hardening requirements of the company by establishing, implementing and auditing Linux (Debian) operating system hardening standard. This work will focus on building a hardened virtual machine image for Microsoft Azure platform that is compliant with the hardening standard that is established in this thesis. As it is not enough to just meet the company security compliance requirements, then there is a need to ensure auditability of it, therefore a proof-of-concept solution is built for automatically auditing the operating system hardening standard that continuously allows to validate the gap between the standard and actual configurations on virtual machines. To demonstrate the result, the author analysed virtual machines compliance state before and after implementing the new operating system hardening standard.