2

I have recently been looking into 'cyber essentials questionnaire' and I came across the question "Other than anti-virus software, are access control measures in place to prevent virus code modifying commonly run executable files?", are there any practices that would be put in place to deal with this other than the anti-virus software as mentioned?

2

The question is pretty descriptive: on a secure system, you make sure regular users cannot write to the folder containing your executables. On most OS, that is already done by default.

On some OS, this can be strengthened through several techniques, including requiring the executables to be signed or limiting the locations where executable code can be located.

It's not 100%, mind you: there are several techniques that can be used to work around the limitations but it's a good and (usually) easy to implement step for hardening a system.

  • I'd also add it's not just the folder containing the executables but also ensuring a user's configuration files cannot be modified by other users. There has been a recent trend in people exploiting the KeePass config files to leak the credentials it contains. As a relevant but aside, you might also want to restrict access to sensitive tools such as Wireshark etc. to further reduce your attack surface (assuming you make it difficult for users to download and install the software too). Don't forget not to run with Administrative user privs when you don't need them too (and use UAC on Windows)! – Matthew1471 Feb 8 '17 at 13:43
0

One such method is signed executables. This is a cryptographic signature on executables, that can verify that the code originated from a trusted supplier (e.g. Microsoft) and that it has not been tampered with.

0

There are a lot of different tools in the market that can monitor the integrity of key executables and ensure they are not tampered. The idea is simple, the solution creates a whitelist of the applications and key files (using hashing algorithms) and constantly monitor those files, checking their hashes against the whitelist created.

If you're looking for a "fancy" solution, I could recommend you something like the McAfee Solid Core which does not only the hash monitoring but also several other checks.

Otherwise, you can code yourself a script that constantly take hashes (SHA512) of key files and compare to a whitelist. If a hash is different from your whitelist the script could send an email to you. It's not as good as a full commercial solution, but help to identify if someone changed a file.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.