What tools are available to compare a 'before' and 'after' security baseline of a Windows machine?

Question

A vendor deals in software that provides secure-messaging software to medical practices, which integrates with popular clinical systems. To install it, they're requesting an hour of unattended remote administrative access using 'Team Viewer' to the server which holds the SQL database where all the sensitive patient data is held. As the collector of the data, our practice is legally responsible for its use and disclosure to 3rd parties

Supposing I were to permit this (which is currently not likely), what tools are at my disposal to enumerate how the system state changed after the tech has left the machine, so that I KNOW what the did, and what they didn't do? (As regards the final state of the machine).

To make things slightly easier, the machine is a Hyper-V VM.

Such tooling would consider changes to at least:

• file hashes
• file-system permissions
• user accounts & permissions
• network shares shared
• firewall rules
• network ports listened on
• services
• registry keys & permissions

Answer 1

As Serge's answer mentions, you may want to consider some contractual controls for this situation, in addition to your technical approach. I am going to assume for this discussion that this action has already been approved through your company's Compliance Program and complies with your Policies. Don't grant low-level systems access to a third-party like this without first confirming the origin of the request and authorization, etc.

But since you asked for tools... ReverseDSC might be an option. It uses PowerShell capabilities to produce an inventory of the system's current settings. It's not going to catch absolutely everything, but it should give you a decent baseline for comparison.

Check out Nik Charlebois' Blog for an introduction to the tool. Or if you prefer some good audio content, RunAsRadio Episode #566 is an interview with Nik and covers some of the same concepts.

In full disclosure, I don't even work in a Windows environment, so I've never used this. But in theory, it sounds like what you're looking for.

Answer 2

This is a completely unreasonable request.

Why does it need to be unmonitored(TeamViewer is not 'unattended')? 'Unattended' means automated e.g. unattended imaging/zti... they're just asking you not to participate.

If it's some proprietary change, that's better dealt with by an NDA; after all, you could reverse-engineer any changes afterwards, like you're asking to do.

The problem is that what you're asking is not simply about comparing a state change, it's about how to do forensic analysis for a system; "how was it changed(i.e. by what process)", "what effect did that change have at the time it occurred", and "what interactions did it have with other devices" are not just questions of state.

Understand that you would be essentially handing them a copy of that database. Even if they don't copy it out wholesale, they can take screenshots(which is not logged since it happens on their computer), copy-paste, or even just read it themselves to find whatever specific data they want to.

Answer 3

Since the system is a VM, create a clone of the system for use as a sandbox. Allow the vendor to make the necessary changes to this sandbox system and request they produce a change document. This will accomplish the following:

1. Production systems will not be impacted. This protects you and also protects the vendor should they misconfigure something or fat-finger something.
2. You'll have a change document detailing the commands and/or configuration changes that need to be made to production allowing your staff to sign-off and implement them.
3. No need to install additional software for change monitoring or allow remote access to production systems. Not to mention the parsing those logs to identify the applicable changes.

In regards to accessing sensitive patient data, that should be covered in your vendor contract. They operate in the medical space so its a topic that should have been discussed. If unsure, consult your manager and/or legal counsel.

Answer 4

Two security principles must be applied:

• Need to Know
• Least Privilege

The vendor must always state the "Why" need to access to the required resources/assets. They must be also provided (from your side) with the least (access controls / permissions / rights) to do the required job. The reason for this is to reduce any threats caused from doing the job and to restrict the vendor from accessing unwanted resources.

All of this must be agreed upon and signed by the vendor through a written NDA and a contract agreement.

You can use different file integrity tools on the files that the vendor will be accessing such as "Microsoft File Checksum Integrity Verifier" or any trusted file integrity tools.

https://www.microsoft.com/en-us/download/details.aspx?id=11533

But In order to have a full monitoring process to the vendor activity, for sure you will need to have a proper log management where you will have to implement auditing and logging of applications, system OS, network, firewall and all the entities that the vendor will use and access.

Logs can prove and can held the vendor accountable for any (system / resources / assets) impact during incident investigation.

Microsoft offers different built-in security features for auditing and logging capabilities on cloud, windows server and through their different applications.

For more information: https://www.microsoft.com/en-us/trustcenter/security/auditingandlogging

Answer 5

As soon as you have given administrative access for one hour, you cannot rely on anything on that machine if you cannot trust the third party. The theory says that you could take a snapshot before and a snapshot after and manually control the differences but the last system on which I could have tried such an operation is MS/DOS!

If you really need to do that, the protection cannot be technical but legal. That means that the third party should endorse full responsability. In particular:

• the third party must be allowed to see and process any data on your system
• you must be allowed to validate access for that third party

The dark side IMHO will be how to prove who was the culprit if things go wrong later (sensitive information disclosure, loss of data, application errors, etc.).

Because of that, my opinion is that it can only make sense if that third party will be a partner and will share responsability with you. In any other case, you should only allow a supervised administrative access in your office with a member of your team constantly with the third party employee.