-: We have spent a lot of time discussing
the cloud in this section.
But the cloud is made up
of a lot of different types of servers.
In this lesson, we're going to discuss
a few specific types of servers
that may be hosted in the cloud,
and how you can best secure them.
First, we have file servers.
File servers are used to store,
transfer, migrate, synchronize,
and archive your files.
Any computer can act as a file server
in the real world.
The server might be running Windows, Linux,
or Mac OS X as its operating system.
And it really doesn't matter which.
Either way, you want to make sure
the file server is using proper data encryption
for its files when they're at rest,
that the server has monitoring and logging
being performed on it,
and a good host-based intrusion detection system.
You might also want to use data loss prevention applications
to ensure the data isn't stolen
and all of the normal configuration hardening and patching
that we've already discussed in the past during this course.
Second, we have email servers.
These servers are a frequent target of attacks
because they contain a lot of valuable data
from within your organization.
In a Windows environment, the most common email server
is Microsoft Exchange.
Microsoft Exchange and its Unix and Linux counterparts
all support the POP3 IMAP and SMTP protocols
for receiving and sending email.
This means that at a minimum,
we have at least three open ports and services running,
but usually, there are many, many more.
Because email servers are frequently a target of attacks,
it's important that you ensure
that they are securely configured
using the hardening techniques
discussed earlier in this course,
that you have spam filtering applications installed,
and antivirus, not just for the server itself,
but also to scan and quarantine all of the attachments
being sent or received by your users.
Next, we have a web server.
In the Windows environment, this is usually hosted
by Internet Information Services
or IIS server.
For Linux or Mac,
this is usually going to be an Apache web server.
Either way, web servers are, by default,
open to the Internet to perform their job.
So, it's important for us to properly secure them.
They should always be placed in your organization's DMZ.
They should be properly firewalled,
monitored, logged, audited, and patched
to ensure their security.
Always ensure that your web server
is up-to-date with the latest patches.
If you aren't sure what patches need to be applied,
you can always visit the common vulnerability
and exposure website or CVE
that's hosted by the Mitre corporation.
This site maintains an up-to-date list
of every known vulnerability
for every type of software that's on the market.
Our fourth type of server is an FTP server.
An FTP server is a specialized type of file server
that's used to host files for distribution across the web.
These servers can be set up
to allow anonymous login and receipt of files
or they can be secured with a username, password,
or other credentials.
You might want an anonymous FTP setup,
if you're distributing your software, for example,
or you may want a secure FTP server setup
so that your remote offices
can upload and download large files
over the Internet to your network.
If you're setting up an FTP server,
remember to always force an encrypted connection
using the transport layer security or TLS.
Because if you're going to require a username or password,
you want to make sure it's protected during transmission.
By default, FTP runs over ports 20 and 21,
and it passes its information
across the web in an unencrypted format.
If you, instead, require that TLS to be utilized,
this will ensure that the login process
and all of the data being sent back and forth
remains confidential and safe from prying eyes.
The final type of server we're going to discuss in this lesson
is called a domain controller.
For a Windows environment,
this is known as Active Directory.
In a Linux environment,
you're likely going to use an LDAP server, instead.
Either way, this server acts as the central repository
of all of your user accounts, your computer accounts,
and their associated passwords for the network.
Because of this, hackers often target
the Active Directory server
as a method of privileged escalation,
or at the very least, lateral movement,
by gaining another administrator or user's
account credentials and exploiting the server.
Active Directory relies on Kerberos
and its ticket granting system
to conduct its user authentication functions.
And so one common attack against
Active Directory servers is known as the golden ticket.
This attack uses a program known as Mimikatz
to exploit a vulnerability in the Kerberos
ticket-granting system, to generate a ticket
that acts as a skeleton key
for all of the devices in the domain.
Hence the name, a golden ticket.
It is basically a free pass for the attacker
to do a lot of damage in your network.
You want to make sure you prevent this,
and to do this, you want to ensure
that the Active Directory controller
is up-to-date on its patches,
its configurations are hardened,
and that it's secure and in place in your network.