2017-029-CIS benchmarks, Windows Update reverts changes used to detect malware

This week was one heck of a show. If you are a blueteamer and make use of the "Windows Logging Cheat Sheet", you are no doubt aware of how important it is to log certain events, and to set hostile conditions to make malware/Trojans/virus have a harder time avoiding detection. What if I told you the same updates we suggested last week to NEVER delay actually undoes all your hardening on your system and leaves your logfiles set to defaults, all file associations for suspect files like pif, bat, scr, bin, are set back to defaults, allow your users to be victims again, even after you've assured them they are safe to update? After a sequence of tweets from Michael Gough about just this exact thing, we laid out all the information, how and what get reverted that will open you back up to possible infections, as well as how some hardening standards actually make it harder to be secure. Finally, we discuss the CIS benchmarks, and how many of the settings in them are largely outdated and why they need to be updated.   Direct Download: http://traffic.libsyn.com/brakeingsecurity/2017-029-windows_updates_clobbers_security__settings_CIS_hardening_needs_an_update.mp3 RSS: http://www.brakeingsecurity.com/rss Youtube Channel:  https://www.youtube.com/channel/UCZFjAqFb4A60M1TMa0t1KXw #iTunes Store Link:  https://itunes.apple.com/us/podcast/brakeing-down-security-podcast/id799131292?mt=2  #Google Play Store: https://play.google.com/music/m/Ifp5boyverbo4yywxnbydtzljcy?t=Brakeing_Down_Security_podcast     Join our #Slack Channel! Sign up at https://brakesec.signup.team #iHeartRadio App:  https://www.iheart.com/show/263-Brakeing-Down-Securi/ #SoundCloud: https://www.soundcloud.com/bryan-brake Comments, Questions, Feedback: [email protected] Support Brakeing Down Security Podcast on #Patreon: https://www.patreon.com/bds_podcast #Twitter: @brakesec @boettcherpwned @bryanbrake @infosystir #Player.FM : https://player.fm/series/brakeing-down-security-podcast #Stitcher Network: http://www.stitcher.com/s?fid=80546&refid=stpr #TuneIn Radio App: http://tunein.com/radio/Brakeing-Down-Security-Podcast-p801582/   --SHOW NOTES--   Gough says 'something is bad about CIS'   CIS benchmarks need revamping -- BrBr /var, /var/log in separate partitions? Password to access grub? Disable root login to serial pty? Many cloud instances and VMs don't have serial ports (not in a traditional sense)   What's the use case for using them? What problem will they solve? Misconfiguration? Proper logging? NTP sources?   So many, dilution possible SCAP OVAL STIG (complex as well) CIS   Infosec: how do we get IT past the "that's good enough", as many customers and compliance frameworks want to see 'hardening' done. What is a good baseline? Write your own?   How do we tell them that it's not going to stop 'bad guys' ( or anyone really)? It's not 'security', and it's technically not even 'best practices' anymore (not all of it, anyway) On windows, they are needlessly complicated and cause more problems Roles have to be created "backup admin" Can cause unintended issues   https://twitter.com/HackerHurricane/status/898629567056797696   https://twitter.com/HackerHurricane/status/892838553528479745   Category            Sub Category                                      7/2008  8.1     2012    Win-7   Win-8.1 WLCS    ThisPC  Notes   Detailed Tracking   Process Termination                       NA      NA      NA      NA      NA      S/F     S Object Access       File Share                                           NA      NA      NA      NA      NA      S/F     S/F     Object Access       File System                                         NA      NA      NA      F       NA         S       S/F     Object Access       Filtering Platform Connection           NA      NA      NA      NA      NA      S       S       Object Access       Filtering Platform Packet Drop          NA      NA      NA      NA      NA      NA      NA   Log Sizes: ------------- Security - 1 GB Application – 256MB System – 256MB PowerShell/Operational – 512MB – 1 GB v5 Windows PowerShell – 256MB TaskScheduler – 256MB   Log Process Command Line                                             (5)     (5)     (5)     (5)     (5)     Yes     Yes ------------------------------------------------------------------------------------------------------------------------- PowerShell Logging v5                                                    (5)     (5)     (5)     (5)     (5)     Yes     Yes ------------------------------------------------------------------------------------------------------------------------- TaskScheduler Log                                                          (5)     (5)     (5)     (5)     (5)     (1)     Yes -----------------------------------------------------------------------------------------------------------------   (5) - CIS Benchmarks, USGCB, and AU ACSC do not cover this critical auditing item