Device Hardening Sample Clauses

Device Hardening. ‌ Device hardening also refers partly to hands-on threats, which are also covert in section 7.2. In order to secure Linux hosts, it should be considered to enable SELinux [8]. The Windows server system should run an up-to-date version of Windows Server 2019. Both systems have to be continuously provided with the latest security patches. In addition, unneeded interfaces (network ports, USB ports, serial ports, etc.) have to be deactivated to mitigate physical security threats. For systems in operation, the principle of least privileges should be enforced. Thus, multiple system accounts should be established: • Admin/Root - full system access, only used for administration; • Operator – manages related set-up; • Service accounts – a different service account should be established for each service running on the system. This service accounts should have very restricted access to the file system. On the device, only necessary applications and needed administrative monitoring services should be installed to minimise possible attack vectors. To ensure this, unprivileged users must not be able to install or uninstall software. For the user accounts, strict accounting policies have to be enabled. Thus, • enable account locking after three failed attempts; • use strong, non-default, state-of-the-art passwords (e.g. following the latest version of the recommendations of the NIST [9]); • any human actions as well as actions from other services have to be logged carefully. All log files have to be stored securely and must not be modifiable. All log files need to be part of backups, which also need to be strictly accessible by administrators only. In addition, only privileged users have the permission to read them. As logging sensitive information is dangerous even if only privileged users are able to read them, only basic information must be logged. Therefore, it must be ensured that • the application does not log any sensitive information (credentials, personal data, session token, …); • the application logs security relevant events including successful and failed authentication events, access control failures, deserialization failures and input validation failures; • reminders of development and debugging information is not logged when running in a productive environment; • log events include necessary that would allow for a detailed investigation of the timeline when an event happens. Lastly, iptables [10] for the Linux system and the Windows Firewall for the Window...

Device Hardening. Anti-virus and intrusion detection software will be employed on appropriate devices and maintained with current updates to ensure current industry standards in Darwin’s industry are employed against security threats.

Device Hardening. For all devices (specifically the operating system and the operational services for the device itself), the principle of least privilege (or whitelisting) should be applied. This includes, but is not limited to the following: • Deactivating unneeded interfaces (network, i.e. ports, and hardware); • Deactivating unneeded system accounts and changing the default credentials for needed ones; • Minimal possible privileges and file permissions for user and system accounts in general; • Anti-DoS and brute force measures such as rate limiting and account locking after a number of failed attempts; • The use of secure passwords; • Using basic network defence concepts such as firewalling also on device level; • Application Whitelisting per host-based IPS, file system permissions and/or other concepts such as AppArmor or utilizing the SELinux kernel extensions; • Using a specialized, hardened kernel;

Device Hardening. If the Manufacturer installs the equipment in the Amazon Fulfilment Centers, services and software components which are not required for operations or maintenance of the devices must be disabled or removed by the Manufacturer. Documentation related to what is disabled or removed must be provided to Amazon.