Scaling Your SSH Strategy

In our last post, we discussed some of the challenges that are inherent to management of SSH keys across your infrastructure as you scale the number of team members and servers. In this post, we will dig into some of your options and the trade-offs that they provide. Review Before we get going, let’s recap the main criteria that we are concerned with for any solution that we implement. Briefly, we want to ensure that you are able to control authentication and authorization for each user on each server. You will also want to be able to generate and analyze an audit trail in the event of a compromise, however this may not be an immediate requirement depending on your regulatory environment. Solutions Each User Has Their Own Key When you first start building your systems it is common to either share credentials with anyone who needs access, or to

Read more

How To Prepare For Your First SOC 2 Audit A 30-90-120 Day Plan

Despite thousands of articles, there's shockingly little actionable advice to help startups complete SOC 2. When you don't have dedicated compliance teams or six figure budgets, we set out to answer: When to pull the trigger on SOC 2. Who needs to be involved in prep work & what tasks can/can not be delegated. How to narrow the scope and save as much time as possible. What are achievable best practices for each policy. How to gather evidence for auditors. One area that usually requires some remediation is access controls. Most teams don't have answers when auditors ask "who has access to a specific database or server and what queries did they execute?" That's why we started strongDM- to manage and monitor access to every database, server, & environment. Click here to see for yourself.

Read more

The Key To Your SSH Strategy

If you work with systems that run any variety of Linux or BSD then the probability is high that you have dealt with SSH. Invented in 1995 and established as an internet standard by the IETF in 2006, Secure SHell has become the default mechanism for remote access to servers by individuals and teams everywhere. SSH Authentication Authenticating yourself to *nix servers can take a variety of forms, but the most common among them are simple pairings of username and password, or a public and private cryptographic key. Key based authentication is widely regarded as the preferred method due to the greater security that it provides. Passwords Using a password as the means of establishing your identity is subject to a variety of weaknesses. If you monitor the system logs of any server that has an SSH server accessible to the internet, you will see a nearly constant barrage of

Read more

How to create a Linux bastion host and log SSH commands Part 2 | A step-by-step tutorial

Want to secure remote access to a private network? In this series of technical posts, we will share step-by-step instructions to create a Linux bastion host and create an audit trail by logging SSH commands.   This article is split into three parts: Part 1: Creating your bastion hosts This post shows you how to create Linux virtual machines in Amazon Web Services, setup virtual networking, and create initial firewall rules to access the hosts.   Part 2: Managing SSH keys  In this post, we will show you how to create an SSH key, which will allow only the systems who have that key to access your bastion host.  We will also look at ways you can streamline the bastion host login process without compromising the security of the key. Part 3: Configuring hosts for logging In the final post of this series, we will configure our bastion hosts to gather

Read more

How to create a Linux bastion host and log SSH commands Part One | A step-by-step tutorial

Want to secure remote access to a private network? In this series of technical posts, we will share step-by-step instructions to create a Linux bastion host and create an audit trail by logging SSH commands.   This article is split into three parts: Part 1: Creating your bastion hosts This post shows you how to create Linux virtual machines in Amazon Web Services, setup virtual networking, and create initial firewall rules to access the hosts.   Part 2: Managing SSH keys  In this post, we will show you how to create an SSH key, which will allow only the systems who have that key to access your bastion host.  We will also look at ways you can streamline the bastion host login process without compromising the security of the key. Part 3: Configuring hosts for logging In the final post of this series, we will configure our bastion hosts to gather

Read more

How to Write Your Software Development Lifecycle Policy

With headline-grabbing software vulnerabilities becoming more and more prevalent, now is the time to tighten up your development practices into a well-written SDLC policy. This particular information security policy will help your development teams standardize on coding tools and practices, as well as get everybody on the same page from a security standpoint. And come the time when you do have a incident, you will be able to demonstrate to your customers that you do indeed take their security seriously - it’s not just lip service.

Read more

System Changes Policy 101

In the world of SOC 2, the general rule is to write a policy, procedure or log entry for just about everything that happens in your environment. This is especially important when it comes to system changes, as auditors want to see that you have detailed logs of what’s happening in your environment, that the changes are properly documented and communicated across your organization, and that you can effectively debug problems after a change is made. All of these requirements and expectations are defined in your system changes policy.

Read more

How to Write a Disaster Recovery Policy

As you prepare your company to endure and recover from a disaster, two primary information technology policies should be in place: business continuity and disaster recovery. These two policies help you plan for – and recover from – adverse events, but the difference lies in the goals of each policy: business continuity focuses on returning your business to normalcy, while disaster recovery details the minimum necessary functions for your business to survive.

Read more

Log Management and Review Best Practices

When an information security incident occurs, you need to be able to gather as much information about it as quickly as possible. There’s also a very real possibility that you will have to involve outside parties - such as an incident response team - to help you as well. That means you can’t approach log management and retention as a simple checkbox. Instead, you need to have rich data that captures audit logs from all critical information systems. Otherwise, if your logs are incomplete, inaccurate or missing altogether, they won’t be of much help when you really need them. Here are five questions to ask when writing your log management and review security policy:

Read more