Web-based Security Hardening

From Mindworks
Jump to navigation Jump to search

A web-based document platform for managing and distributing security documents and hardening information dynamically.

Mentor Daniel Conte de Leon
Team Name Alice
Duration Fall 2015 - Spring 2016
Students Casey Blair

Keith Drew

Christopher Goes

Antonious Stalick



Project Overview[edit | edit source]

Problem Statement[edit | edit source]

  • Hardening/Security information is available, but spread out and not centralized
  • Pre-requisite information is often not included in a hardening guide, leaving the reader to wonder “Why am I doing this?”
  • Trying to find prerequisite information can lead the seeker on a “Six degrees of Kevin Bacon” Wikipedia goose chase

Design Goals[edit | edit source]

  • To build a web-based application that allows the addition of new content and dynamically generated hardening guides with pre-requisite information included
  • To provide a source of hardening information for any platform, provided the content has been added to the database
  • Make content easy to understand for a non-technical user, in a format that is easy to follow

Project Deliverables[edit | edit source]

  • Github repository of the completed project, containing the source code and project documentation

Requirements and Specifications[edit | edit source]


Design[edit | edit source]

System and Software Design Description (SSDD)[edit | edit source]


Class Diagrams[edit | edit source]

Draft class diagram for a "Guide"
'Node' class Tree diagram

Use Cases[edit | edit source]

Use case diagram
Example of a use case to search for a hardening guide

Implementation[edit | edit source]

Github Repository[edit | edit source]

Source code and team documents are available on the project Github

Project is designed to be self-contained: anyone can easily create their own instance of the system by simply cloning the Github repository and running Vagrant Up.


Tools and Technologies[edit | edit source]

Development Tools[edit | edit source]

  • Vagrant
  • VirtualBox
  • Puppet
  • Git


Operating System: CentOS[edit | edit source]

2015 webhdg CentOS-logo.png

Our requirements for the server's operating system (OS):

  • Stable, high reliability and uptime so users can access guides at any time
  • Secure, malicious attacks could be catastrophic, and could result in downtime or compromised guide integrity
  • Free, we don't have a budget to pay for expensive software
  • Customizable, so it can suit our precise needs and allow for easy development

Based on these requirements, we selected the Linux-based distribution CentOS 7, for the following reasons:

  • Strong record of being stable and reliable, currently in use at many major enterprises and organizations
  • Good security, receives regular updates from RedHat, inherent Linux security
  • Open-source and free, same software as RHEL (RedHat Enterprise Linux) without RedHat's proprietary components
  • Inherent Linux customizability and flexibility


Languages[edit | edit source]

  • Ruby
  • CSS
  • HTML
  • Bash


Database: Neo4j[edit | edit source]

2015 webhdg Neo4j-logo.png

Our requirements for the backend database

  • Fast queries, since the primary use case is reading a guide
  • Scalability, to prevent future growing pains when the total guide body gets massive
Example usage of the Neo4j graph database

We elected to use a graph database for the backend, instead of the traditional relational database, for the following reasons

  • They are faster than relational databases in data lookup functions, especially with larger tables and datasets
  • They are more scaleable than relational databases
  • The downside, slower data additions, is negligible as guide additions make up a insignificant portion of overall site activity

We evaluated numerous graph databases, including Neo4j, GraphDB, Apache Giraph, and HyperGraphDB.

We chose Neo4j for the following reasons

  • The free version has the most functionality compared to the other systems’ free versions
  • It runs on-disk, so is reliable in case of power failure
  • It is well-documented
  • It is the most popular graph database, with a large developer community and many tutorials available
  • It's query language syntax is similar to SQL, which is familiar to our developers, and easy for future developers working on the project to learn

Below is an example of a guide definition in Cypher Query Language (The language used by Neo4j)

CREATE (resource:Resource {title:"More info", url:"http://microsoft.com"} ),
(quiz:Quiz {title:"How to configure basic settings"} ), 
(media:Media {title:"Basic settings", type:"video"}),
(guidebody:Guidebody {title:"Configuring basic settings", body:"Four score, and seven years ago, ..."} ),
(body:Body {title:"Body"}),
(atom:Atom {title:"Atom"}),
(definition:Definition {title:"Windows Definition"}),
(task:Task {title:"Reducing vulnerabilities in Windows"}),
(content:Content {title:"Hardening Windows"}),
(guide:Guide {title:"Windows"}),
(guide)-[a:hasContains]->(content), (content)-[b:hasTask]->(task), 
(content)-[c:hasDef]->(definition), (guide)-[d:hasAtom]->(atom), 
(atom)-[e:hasBody]->(body), (body)-[f:hasGuideBody]->(guidebody), 
(atom)-[g:hasQuiz]->(quiz), (atom)-[h:hasMedia]->(media), 
(atom)-[i:hasResource]->(resource)



Team Alice[edit | edit source]

The Alice team logo


Casey B.jpg

Casey Blair[edit | edit source]

Computer Science

Boise, Idaho

Casey Blair is a senior at the University of Idaho where he is studying Computer Science. He specializes in databases and artificial intelligence.

blai1919@vandals.uidaho.edu


2014 Ethtool Drew.jpg

Keith Drew[edit | edit source]

Computer Science

Olympia, Washington

Keith is a senior undergraduate student in Computer Science at the University of Idaho. He is also a NSF Scholarship for Service (SFS) CyberCorps Student. He is interested cyber security, specifically secure programming.

keithd@vandals.uidaho.edu

2015 WebHDG chris-goes-profile.jpg

Christopher Goes[edit | edit source]

Computer Science

Boise, Idaho

Senior undergrad at UI, focusing in Cybersecurity as part of the NSF Scholarship for Service (SFS) CyberCorps program. Interested in virtualization, education, and everything networking.

goes8945@vandals.uidaho.edu

2015 webhdg anton-stalick.jpg

Antonius Stalick[edit | edit source]

Computer Science

Washington

stal6565@vandals.uidaho.edu

Links and References[edit | edit source]