NIST SPECIAL PUBLICATION 1800-25

---

Data Integrity:

Data Integrity:

Identifying and Protecting Assets Against Ransomware and Other Destructive Events

---

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra

Michael Ekstrom

Lauren Lusty

Julian Sexton

John Sweetnam

FINAL

This publication is available free of charge from https://www.nccoe.nist.gov/projects/building-blocks/data-integrity/identify-protect.

NIST SPECIAL PUBLICATION 1800-25

Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events

Includes Executive Summary (A); Approach, Architecture, and Security Characteristics (B); and How-To Guides (C)

Jennifer Cawthra

National Cybersecurity Center of Excellence

NIST

Michael Ekstrom

Lauren Lusty

Julian Sexton

John Sweetnam

The MITRE Corporation

McLean, Virginia

FINAL

December 2020

U.S. Department of Commerce

Wilbur Ross, Secretary

National Institute of Standards and Technology

Walter G. Copan, Undersecretary of Commerce for Standards and Technology and Director

Volume A

• Executive Summary
  • Challenge
  • Solution
  • Benefits
  • Share Your Feedback
  • Technology Partners/Collaborators

Volume B

• 1 Summary
  • 1.1 Challenge
  • 1.2 Solution
  • 1.3 Benefits
• 2 How to Use This Guide
  • 2.1 Typographic Conventions
• 3 Approach
  • 3.1 Audience
  • 3.2 Scope
  • 3.3 Assumptions
  • 3.4 Risk Assessment
    • 3.4.1 Risk
    • 3.4.2 Security Control Map
  • 3.5 Technologies
• 4 Architecture
  • 4.1 Architecture Description
    • 4.1.1 High-Level Architecture
    • 4.1.2 Architecture Components
      • 4.1.2.1 Inventory
      • 4.1.2.2 Vulnerability Management
      • 4.1.2.3 Policy Enforcement
      • 4.1.2.4 Integrity Monitoring
      • 4.1.2.5 Logging
      • 4.1.2.6 Backups
      • 4.1.2.7 Secure Storage
      • 4.1.2.8 Network Protection
      • 4.1.2.9 Denylisting
• 5 Security Characteristic Analysis
  • 5.1 Assumptions and Limitations
  • 5.2 Build Testing
  • 5.3 Scenarios and Findings
    • 5.3.1 Ransomware via Web Vector and Self-Propagation
      • 5.3.1.1 Scenario
      • 5.3.1.2 Resolution
      • 5.3.1.3 Other Considerations
    • 5.3.2 Destructive Malware via USB Vector
      • 5.3.2.1 Scenario
      • 5.3.2.2 Resolution
      • 5.3.2.3 Other Considerations
    • 5.3.3 Accidental VM Deletion via Maintenance Script
      • 5.3.3.1 Scenario
      • 5.3.3.2 Resolution
      • 5.3.3.3 Other Considerations
    • 5.3.4 Backdoor Creation via Email Vector
      • 5.3.4.1 Scenario
      • 5.3.4.2 Resolution
      • 5.3.4.3 Other Considerations
    • 5.3.5 Database Modification via Malicious Insider
      • 5.3.5.1 Scenario
      • 5.3.5.2 Resolution
      • 5.3.5.3 Other Considerations
    • 5.3.6 File Modification via Malicious Insider
      • 5.3.6.1 Scenario
      • 5.3.6.2 Resolution
      • 5.3.6.3 Other Considerations
    • 5.3.7 Backdoor Creation via Compromised Update Server
      • 5.3.7.1 Scenario
      • 5.3.7.2 Resolution
      • 5.3.7.3 Other Considerations
    • 5.3.8 New Employee
      • 5.3.8.1 Scenario
      • 5.3.8.2 Resolution
      • 5.3.8.3 Other Considerations
• 6 Future Build Considerations
• Appendix A List of Acronyms
• Appendix B Glossary
• Appendix C References
• Appendix D Functional Evaluation
  • D.1 Data Integrity Functional Test Plan
  • D.2 Data Integrity Use Case Requirements
  • D.3 Test Case: Data Integrity IP-1
  • D.4 Test Case: Data Integrity IP-2
  • D.5 Test Case: Data Integrity IP-3
  • D.6 Test Case: Data Integrity IP-4
  • D.7 Test Case: Data Integrity IP-5
  • D.8 Test Case: Data Integrity IP-6
  • D.9 Test Case: Data Integrity IP-7
  • D.10 Test Case: Data Integrity IP-8

Volume C

• 1 Introduction
  • 1.1 How to Use this Guide
  • 1.2 Build Overview
  • 1.3 Typographic Conventions
• 2 Product Installation Guides
  • 2.1 Active Directory and Domain Name System (DNS Server)
    • 2.1.1 Installing Features
    • 2.1.2 Creating a Certificate Authority
    • 2.1.3 Configure Account to Add Computers to Domain
    • 2.1.4 Adding Machines to the Domain
    • 2.1.5 Configure Active Directory to Audit Account Activity
    • 2.1.6 Configure Reverse Lookup Zones
  • 2.2 Microsoft Exchange Server
    • 2.2.1 Install Microsoft Exchange
  • 2.3 Windows Server Hyper-V Role
    • 2.3.1 Production Installation
  • 2.4 MS SQL Server
    • 2.4.1 Install and Configure MS SQL
    • 2.4.2 Open Port on Firewall
    • 2.4.3 Add a New Login to the Database
  • 2.5 Microsoft IIS Server
    • 2.5.1 Install IIS
    • 2.5.2 IIS Configuration
  • 2.6 GreenTec WORMdisks
    • 2.6.1 Format GreenTec WORMdisks
    • 2.6.2 Obtain Status Information About GreenTec WORMdisks
    • 2.6.3 Map GreenTec WORMdisks to Drive Letters
    • 2.6.4 Activate Write Protection in GreenTec WORMdisks
  • 2.7 CryptoniteNXT
    • 2.7.1 Configure Cryptonite NXT
      • 2.7.1.1 Verify a New Device
      • 2.7.1.2 Create a New User
      • 2.7.1.3 Create a New Policy
    • 2.7.2 Integrate CryptoniteNXT with Active Directory
      • 2.7.2.1 Generate a Keytab File
      • 2.7.2.2 Import Keytab File to ACC
  • 2.8 Backups
    • 2.8.1 FileZilla FTPS Server Setup
    • 2.8.2 FileZilla Configuration
    • 2.8.3 Add a User to FileZilla
    • 2.8.4 Duplicati Client Installation (Windows)
    • 2.8.5 Duplicati Client Installation (Ubuntu)
    • 2.8.6 Configure Duplicati
  • 2.9 Semperis Active Directory Forest Recovery
    • 2.9.1 Install Semperis ADFR
    • 2.9.2 Create a Backup Schedule for the Domain Controller
    • 2.9.3 Recover the Active Directory Forest from a Backup
  • 2.10 Semperis Directory Services Protector
    • 2.10.1 Configure Active Directory for Semperis DSP
    • 2.10.2 Install Semperis DSP
  • 2.11 Micro Focus ArcSight Enterprise Security Manager
    • 2.11.1 Install the ArcSight Console
    • 2.11.2 Install Individual ArcSight Windows Connectors
    • 2.11.3 Install Individual ArcSight Ubuntu Connectors
    • 2.11.4 Install a Connector Server for ESM on Windows 2012 R2
    • 2.11.5 Install Preconfigured Filters for ArcSight
      • 2.11.5.1 Install Activate Base
      • 2.11.5.2 Install Packages
    • 2.11.6 Apply Filters to a Channel
  • 2.12 Tripwire Enterprise
    • 2.12.1 Install Tripwire Enterprise
    • 2.12.2 Install the Axon Bridge
    • 2.12.3 Install the Axon Agent (Windows)
    • 2.12.4 Install the Axon Agent (Linux)
    • 2.12.5 Configure Tripwire Enterprise
      • 2.12.5.1 Terminology
      • 2.12.5.2 Tags
      • 2.12.5.3 Rules
      • 2.12.5.4 Tasks
  • 2.13 Tripwire Log Center
    • 2.13.1 Install Tripwire Log Center Manager
    • 2.13.2 Configure Tripwire Log Center Manager
    • 2.13.3 Install Tripwire Log Center Console
  • 2.14 Cisco Web Security Appliance
    • 2.14.1 Network Configuration
    • 2.14.2 System Setup
    • 2.14.3 Using WSA to Proxy Traffic
      • 2.14.3.1 Creating a PAC File
      • 2.14.3.2 Setting Up Web Proxy Auto Discovery (WPAD)
      • 2.14.3.3 Configure Group Policy to Use Explicit Proxy
    • 2.14.4 Denylisting
  • 2.15 Symantec Data Loss Prevention
    • 2.15.1 Install Oracle 12c Enterprise
    • 2.15.2 Create an Oracle Database for Symantec DLP
    • 2.15.3 Configuring the Oracle Listener
    • 2.15.4 Install Symantec DLP
    • 2.15.5 Configure Symantec DLP
  • 2.16 Cisco Identity Services Engine
    • 2.16.1 Initial Setup
    • 2.16.2 Inventory: Configure SNMP on Routers/Network Devices
    • 2.16.3 Inventory: Configure Device Detection
    • 2.16.4 Policy Enforcement: Configure Active Directory Integration
    • 2.16.5 Policy Enforcement: Enable Passive Identity with AD
    • 2.16.6 Policy Enforcement: Developing Policy Conditions
    • 2.16.7 Policy Enforcement: Developing Policy Results
    • 2.16.8 Policy Enforcement: Enforcing a Requirement in Policy
    • 2.16.9 Policy Enforcement: Configuring a Web Portal
    • 2.16.10 Configuring RADIUS with Your Network Device
    • 2.16.11 Configuring an Authentication Policy
    • 2.16.12 Configuring an Authorization Policy
  • 2.17 Tripwire IP360
    • 2.17.1 Installation
    • 2.17.2 Web Portal
    • 2.17.3 Scanning
  • 2.18 Integration: Tripwire Log Center and Tripwire Enterprise
  • 2.19 Integration: Tripwire Log Center and Tripwire IP360
    • 2.19.1 Configure IP360 and Log Center
    • 2.19.2 Collect Tripwire IP360 Operational Logs
    • 2.19.3 Configure Tripwire IP360 Scan Results Forwarding
  • 2.20 Integration: Tripwire Enterprise and Backups
    • 2.20.1 Export Configuration from Tripwire Enterprise
    • 2.20.2 Back Up the Tripwire Enterprise Configuration
  • 2.21 Integration: Cisco ISE and CryptoniteNXT
    • 2.21.1 Requirements for Integrating Cisco ISE and CryptoniteNXT
    • 2.21.2 Configuring CryptoniteNXT for RADIUS
  • 2.22 Integration: Backups and GreenTec
    • 2.22.1 Locate Backups with FileZilla and Duplicati
    • 2.22.2 Back Up to a GreenTec Disk
    • 2.22.3 Configure Network-Accessible GreenTec Disk
    • 2.22.4 Secure Storage for Semperis ADFR
  • 2.23 Integration: Micro Focus ArcSight and FileZilla
    • 2.23.1 Enable Logs in FileZilla
    • 2.23.2 Install Micro Focus ArcSight
  • 2.24 Integration: Micro Focus ArcSight and Tripwire
    • 2.24.1 Install Micro Focus ArcSight
  • 2.25 Integration: Micro Focus ArcSight and Cisco WSA
    • 2.25.1 Configure Cisco WSA to Forward Logs
  • 2.26 Integration: Micro Focus ArcSight and Cisco ISE
    • 2.26.1 Configure Cisco ISE to Forward Logs
    • 2.26.2 Select Logs for Forwarding
  • 2.27 Integration: Micro Focus ArcSight and Symantec DLP
    • 2.27.1 Install Micro Focus ArcSight
    • 2.27.2 Configure Symantec DLP to Forward Logs
  • 2.28 Integration: Micro Focus ArcSight and CryptoniteNXT
    • 2.28.1 Configure CryptoniteNXT to Forward Logs to ArcSight
  • 2.29 Integration: Micro Focus ArcSight and Semperis DSP
    • 2.29.1 Configure Semperis DSP to Forward Logs
  • 2.30 Integrations: CryptoniteNXT
    • 2.30.1 Active Directory and DNS
    • 2.30.2 Microsoft Exchange
    • 2.30.3 FileZilla
    • 2.30.4 GreenTec
    • 2.30.5 Tripwire Enterprise
    • 2.30.6 ArcSight ESM
    • 2.30.7 Cisco ISE
    • 2.30.8 Semperis DSP
    • 2.30.9 Symantec DLP
    • 2.30.10 Cisco WSA
    • 2.30.11 Tripwire IP360
      • 2.30.11.1 Tripwire Log Center, Tripwire IP360, Tripwire Enterprise, and ArcSight ESM
    • 2.30.12 FileZilla and ArcSight
    • 2.30.13 Cisco ISE and ArcSight
    • 2.30.14 Cisco WSA and ArcSight
    • 2.30.15 Semperis DSP and ArcSight
    • 2.30.16 Symantec DLP and ArcSight
• Appendix A List of Acronyms