Com puc minimitzar les vulnerabilitats?

A continuació mostrem una relació de guies que us poden donar suport a la securització dels vostres entorns

Sistemes operatius de Servidor

• Entorn Linux

• Ubuntu

• https://wiki.ubuntu.com/Security/Features

• Redhat

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/security_hardening/index

• Debian

• https://wiki.debian.org/Hardening

• Entorn Windows

• Windows Server 2016

• https://download.microsoft.com/download/5/8/5/585DF9E9-D3D6-410A-8B51-81C7FC9A727C/Windows_Server_2016_Security_Guide_EN_US.pdf

• Windows Server 2019

• https://techcommunity.microsoft.com/t5/Microsoft-Security-Baselines/Security-baseline-FINAL-for-Windows-10-v1909-and-Windows-Server/ba-p/1023093

Sistemes operatius d’Estacions de treball

• Windows 10

• https://techcommunity.microsoft.com/t5/Microsoft-Security-Baselines/Security-baseline-FINAL-for-Windows-10-v1909-and-Windows-Server/ba-p/1023093

• MacOS

• https://csrc.nist.gov/CSRC/media/Publications/sp/800-179/rev-1/draft/documents/sp800-179r1-draft.pdf

Entorns virtualitzats

https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-125B.pdf

• VMWARE

• https://www.vmware.com/security/hardening-guides.html

• HyperV

• https://csrc.nist.gov/publications/detail/sp/800-125a/rev-1/final

• https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/plan/plan-hyper-v-security-in-windows-server

Entorns de contenidors

• Docker

• https://docs.docker.com/engine/security/security/

• Kubernetes

• https://cloud.google.com/kubernetes-engine/docs/concepts/security-overview

Equips de comunicacions

• Cisco

• https://www.ccn-cert.cni.es/comunicacion-eventos/comunicados-ccn-cert/2278-nueva-guia-ccn-stic-de-seguridad-en-cortafuegos-cisco.html

• https://blogs.cisco.com/security/best-practices-device-hardening-and-recommendations

Aplicatius:

• Apache

• https://httpd.apache.org/docs/2.4/misc/security_tips.html

• https://www.acunetix.com/websitesecurity/apache-security/

• Tomcat

• https://tomcat.apache.org/tomcat-9.0-doc/security-howto.html

• Wordpress

• https://wordpress.org/support/article/hardening-wordpress/

• Joomla

• https://docs.joomla.org/Security/es

• Nginx

• https://docs.nginx.com/nginx/admin-guide/security-controls/

• SSH

• https://nvlpubs.nist.gov/nistpubs/ir/2015/NIST.IR.7966.pdf

• https://info.ssh.com/a-secure-shell-guide-for-pci-dss-version-3-white-paper

• https://www.ssh.com/compliance/nist-800-53#nist-800-53-controls-and-ssh

• FTP/SFTP

• https://www.helpsystems.com/blog/10-essential-tips-securing-ftp-and-sftp-servers

• (Windows) https://docs.microsoft.com/en-us/biztalk/core/best-practices-and-recommendations-for-the-ftp-adapter

• Microsoft IIS

• https://techcommunity.microsoft.com/t5/ITOps-Talk-Blog/Windows-Server-101-Hardening-IIS-via-Security-Control/ba-p/329979

• https://www.owasp.org/index.php/Hardening_IIS

Altres 

• Windows Server / Windows 10

• https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines

• Entorns de contenidors

• https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-190.pdf

• Linux Application Container Deployments

• https://nvlpubs.nist.gov/nistpubs/ir/2017/NIST.IR.8176.pdf

• Aplicatius

• https://www.ccn-cert.cni.es/series-ccn-stic/800-guia-esquema-nacional-de-seguridad/522-ccn-stic-812-seguridad-en-entornos-y-app-web.html

• Entorns de WIFI

• https://www.ccn-cert.cni.es/seguridad-al-dia/comunicados-ccn-cert/5758-nueva-guia-ccn-stic-647b-configuracion-segura-de-equipos-de-red-aruba-para-entornos-wifi.html

Referències:

https://www.ccn-cert.cni.es/pdf/guias/1297-indice-series-ccn-stic/file.html

https://nvd.nist.gov/ncp/repository

https://www.cisecurity.org/cis-benchmarks/