Meet our CEO at GSX, Atlanta, 14–16 Sept → Let’s Connect

Ask Our Experts

Neova Tech Solutions Logo
Meet our CEO at GSX, Atlanta, 14–16 Sept → Let’s Connect

Ask Our Experts

Neova Tech Solutions Logo

Category: Cyber Security

AWS CloudTrail Security Checklist: Improve AWS Cloud Security
April 13, 2020

AWS CloudTrail Security Checklist: Improve AWS Cloud Security

What Is AWS CloudTrail?

AWS CloudTrail is an AWS service that lets you identify activities across your AWS account. It records actions taken by a user, role, or an AWS service as events. These events include actions in the AWS Management Console, AWS CLI, SDKs and APIs.  

CloudTrail is by default enabled on your AWS account when you create it and store data for 90 days. In addition, you can create a CloudTrail trail to analyze, archive and respond to changes in AWS resources. A trail is a configuration that stores and delivers events to Amazon S3 bucket.

Checklist to secure AWS CloudTrail:

  1. Enable CloudTrail across all AWS regions: This will enable CloudTrail logging across all regions of your AWS environment, thus monitoring every configured activity.
  2. Enable MFA for CloudTrail S3 bucket access: With MFA turned on for accessing  CloudTrail designated S3 buckets, chances of infiltrators deleting logs are almost zero.
  3. Enable S3 bucket logging: Enabling S3 logging ensures all the S3 actions are tracked, thus helping in forensic and audits.
  4. Create an S3 Lifecycle: You can define an S3 lifecycle rules to archive CloudTrail log files automatically. 
  5. Access Controls for CloudTrail S3 buckets: Create a bucket policy that allows only required resources to have access to these logs.
  6. Encrypt logs at rest: CloudTrail event log files are encrypted using Amazon S3 server-side encryption (SSE). One can choose to encrypt using AWS KMS as well.
  7. Cloudwatch Alarm for CloudTrail: Create a metric and an alarm, for events like CloudTrail S3 logs deleted. 
AWS CloudTrail Security Checklist: Improve AWS Cloud Security

We have a competent and excellent team of QA experts, who can help you with more details on it. 

Drop your queries at sales@neovatechsolutions.com to schedule a meeting with our experts.

April 13, 2020
0
CIS Benchmark for Apple iOS 12
April 10, 2020

CIS Benchmark for Apple iOS 12

Introduction

Security configuration benchmarks are provided in this document which guides for establishing secure configuration posture for the Apple iOS 12. This benchmark will be useful for all the devices on which this OS is supported.

Recommendations

1. Configuration Profile Recommendations for End-User Owned Devices

This provides recommendations for devices in an unsupervised state. The term “unsupervised ” is a specific technical designation in regards to the state of an iOSdevice.

1.1 General

  • E.g  Ensure a ‘consent message’ has been ‘configured’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the general tab
  4. In the right windowpane, verify under the heading consent message, there is an appropriate consent message configured.

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the general tab
  4. In the right windowpane, verify under the heading consent message, insert an appropriate consent message
  5. Deploy the configuration profile.

1.2 Restrictions

  • E.g  Ensure ‘Allow voice dialing while the device is locked’ is set to ‘Disabled’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Restrictions tab
  4. In the right windowpane, verify under the tab Functionality, the checkbox for Allow voice dialing while device is locked is unchecked

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Restrictions tab
  4. In the right windowpane,under the tab Functionality, uncheck the checkbox for Allow voice dialing while device is locked is unchecked
  5. Deploy the configuration profile.

1.3 Domains

  • E.g  Ensure ‘Managed safari web Domain’ is ‘Configured’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Domain tab
  4. In the right windowpane, verify that under managed safari web domains each appropriate URL pattern is configured.

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Domain tab
  4. In the right windowpane, under manage safari web domains enter the appropriate URL pattern(s)
  5. Deploy the configuration profile.

 1.4 Passcode

  • E.g  Ensure ‘Allow simple value’ is set to ‘Disabled’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Passcode tab
  4. In the right windowpane, verify that the checkbox for Allow simple value is unchecked.

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Passcode tab
  4. In the right windowpane, uncheck the checkbox for Allow Simple Value
  5. Deploy the configuration profile.

 1.5 Mail

  • E.g  Ensure ‘Allow user to move messages from this account’ is set to ‘Disabled’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Mail tab
  4. In the right windowpane, verify that the checkbox for Allow user to move messages from this account is unchecked.

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Mail tab
  4. In the right windowpane, uncheck the checkbox for Allow user to move messages from this account.

 1.6 Notifications

  • E.g  Ensure ‘Notification settings’ are configured for all ‘managed apps’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Notifications tab
  4. In the right windowpane, verify that each managed app includes a configuration entry.

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the Notifications tab
  4. In the right windowpane, click Configure and/or click + to add notification settings for each application
  5. Deploy the configuration profile.

2. Configuration Profile Recommendations for Institutionally Owned Devices

This provides recommendations for devices in the supervised state. The term “supervised” is a specific technical designation in regards to the state of an iOS device and generally applied to institutionally owned devices.

2.1 General

  • E.g  Ensure a ‘Controls when the profile can be removed’ is set to ‘never’

Audit:

From the configuration profile:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the general tab
  4. In the right windowpane, verify that under the heading Security, the menu Controls when the profile can be removed is set to Never.

Remediation:

  1. Open Apple Configurator
  2. Open the configuration profile
  3. In the left windowpane, click on the general tab
  4. In the right windowpane, verify under the heading Security, set the menu Controls when the profile can be removed  to Never.
  5. Deploy the configuration profile.

Similarly, you can follow the recommendation for mail, notifications, restrictions, domains etc sections. 

3. Additional Recommendations

These recommendations are not configurable via a Configuration Profile. They are accessible on the device locally.

  • E.g  Ensure ‘Software Update’ returns ‘Your software is up to date’

Audit:

From the device:

  1. Tap settings 
  2. Tap General 
  3. Tap Software Update
  4. Verify that Your software is up to date is returned

Remediation:

  1. Tap settings 
  2. Tap General 
  3. Tap Software Update
  4. Tap Install or Download and Install and then allow the device to complete the installation.

Also we can configure for other options by using this additional  recommendation.

Conclusion

Mobile devices with Apple iOS can be secured by following CIS benchmarks. This will help to protect device from different threats and also reduces the exploitation of devices by an attacker.

April 10, 2020
0
CIS Benchmarks for Google Chrome
April 9, 2020

CIS Benchmarks for Google Chrome

Introduction

This document gives information with examples to establish a secure configuration for Google Chrome. By following these recommendations we can make browsers secure and prevent them from threats.

Recommendations

1. Enforced Defaults

Recommendations here are configured by default when you install google chrome. Enforcing this setting can prevent it from changing to a less secure option

  • Remote Access
  •   E.g   Ensure ‘Enable curtaining of remote access hosts’ is set to ‘Disable

Description: 

Chrome allows controls to prevent someone physically present at the host machine from seeing what a user is doing while a remote connection is in progress.

Audit:

Navigate to the UI path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:RemoteAccessHostRequireCurtain

Remediation:

To establish the recommended configuration via group policy, set the following path to ‘Disabled’:

Computer Configuration\Administrative Templates\Google\Google Chrome\Configure remote access options\Enable curtaining of remote access host

  • E.g   Ensure ‘Continue running background apps when Google Chrome is closed’ is set to ‘Disabled’

Description: 

Chrome allows for processes started while the browser is open to remain running once the browser has been closed.

Audit:

Navigate to the UI path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:BackgroundModeEnabled

Remediation:

To establish the recommended configuration via group policy, set the following UI path to ‘Disabled’:

Computer Configuration\Administrative Templates\Google\Google Chrome\Continue running background apps when Google Chrome is closed 

2. Attack Surface Reduction

Using this recommendation we can reduce the overall surface attack.

  • E.g   Ensure ‘Default flash setting’ is set to ‘Enabled’ 

Description: 

Malicious plugins can cause browser instability and erratic behaviour so setting the value to ‘click to play’ will allow a user to only run necessary plugins.

Audit:

Navigate to the UI path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:DefaultPluginsSetting

Remediation:

To establish the recommended configuration via group policy, set the following UI path to ‘Enabled’ with ‘Click to play’ selected from the dropdown:

Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\Default Flash Setting

In a similar way, we can ensure other options i.e enabled or disabled based on recommendations.

3. Services

User privacy can be improved using these recommendations.

  • E.g   Confirm ‘Default cookies setting’ is set to ‘Enabled’ 

Description: 

Permanently stored cookies may be used for malicious intent. 

Audit:

Navigate to the UI path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:DefaultCookiesSetting

Remediation:

To establish the recommended configuration via group policy, set the following UI path to ‘Enabled’ with ‘Cookies from the duration of the session’ selected from the dropdown:

Computer Configuration\Administrative Templates\Google\Google Chrome\Content Settings\Default Cookies Setting

Similarly,  we can Ensure other options i.e enabled or disabled based on recommendations.

4. Management/Visibility/Performance

This Recommends for management, visibility and performance of Google Chrome.

  • Remote Access

These recommendations are related to Remote Access

  • E.g   Ensure ‘Enable firewall traversal from remote access host’ is set to ‘Disabled’ 

Description: 

By disabling this feature, the machine will only allow connections from machines within the local network.

Audit:

Navigate to the UI path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:RemoteAccessHostFirewallTraversal

Remediation:

To establish the recommended configuration via group policy, set the following UI path to ‘Disabled’

Computer Configuration\Administrative Templates\Google\Google Chrome\Configure remote access options\Enable firewall traversal from remote access host

In a similar way we can Ensure for other options i.e enabled or disabled based on recommendations.

5. Data Loss Prevention

Using these recommendations we can prevent and protect against unwanted loss of data.

  • E.g   Ensure ‘Enable submission of documents to Google Cloud print’ is set to ‘Disabled’ 

Description: 

This setting enables Google Chrome to submit documents to google cloud print for printing.

Audit:

Navigate to the UI path articulated in the Remediation section and confirm it is set as prescribed. This group policy setting is backed by the following registry location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Google\Chrome:CloudPrintSubmitEnabled

Remediation:

To establish the recommended configuration via group policy, set the following UI path to ‘Disabled’

Computer Configuration\Administrative Templates\Google\Google Chrome\Printing\Enable submission of documents to Google Cloud print

In a similar way we can Ensure for other options i.e enabled or disabled based on recommendations.

Conclusion

We can secure web browsers like Google Chrome and prevent it from threats like cyberattacks by following CIS Benchmarks. 

April 9, 2020
0
security testing
July 20, 2018

Why continuous security testing should be on your to-do list?

Continuous security testing is an absolute approach towards an effective security strategy. In this era of shifting attacks, we should be more vigilant.

WHY IS SECURITY TESTING A CONTINUOUS PROCESS?

Your application is vulnerable to an attack where the exploit is developed after you deployed the last security patch. The malicious attackers are getting smarter, they analyze the new patch and change their strategy according to the latest security patch.

The application requires a significant amount of collaboration of multiple module to function rightly. There is an application code, business logic, back-end network, client side, database, APIs, machines, its operating system and the users. Every component plays a vital role in the security of an application.

Any web application or mobile application should upgrade its components as and when there is an update and test them against new vulnerabilities.

COMPONENTS OF AN APPLICATION:

If there is any vulnerability in one of the components, the application is vulnerable to attacks. To keep the application secure, one needs to keep updating their approach towards security.

COMPONENTS OF AN APPLICATION

1. APPLICATION CODE AND BUSINESS LOGIC:

To keep them vulnerability free you should perform security testing. Review the code and logic when there are new changes.

2. THE BACK-END NETWORK AND MACHINE:

You should frequently perform a security audit of your network and machine, where the application is hosted.

3. THE CLIENT-SIDE, API, AND DATABASE:

This place is exploited by hackers. They mainly use the vulnerability of this section to bring the application down or for stealing your data. To keep the application secure one should perform vulnerability assessment and penetration testing against the latest threat discovered.

4. THE HUMAN INVOLVEMENT IN THE PROCESS

Human is the most vulnerable part of the security chain. According to a study, more than 90% of data breaches are due to human negligence. Any application is built by the people, for the people. So vulnerability can be introduced by the product development team and the user. Security testing alertness programs will create awareness about how they are helping malicious attackers unknowingly and to avoid such unwanted situations. There should be clear and effective communication with users so that they can avoid security threats related to the product.

WINDING UP WITH A SMALL NOTE.

Start implementing security testing as a tradition. If you have any questions regarding end-to-end application security testing contact us.

July 20, 2018
0

Headquarters

4701 Patrick Henry Drive, Bldg.16, Suite 106, Santa Clara, California 95054

+1 781-640-0588sales@neovatechsolutions.com

Development Center

P3-603, Pentagon Tower, Magarpatta City, Hadapsar, Pune, MH 411028

+91 960-702-3233jobs@neovasolutions.com

COPYRIGHT 2026 © NEOVA TECH SOLUTIONS INC.

Privacy Policy