Following a security incident where an attacker leveraged compromised developer credentials to establish unauthorized persistence on Linux bastion hosts, an organization is revising its host hardening standards. The forensic investigation revealed two key persistence mechanisms: authorized keys file tampering to insert persistent public keys and rogue systemd service installation to launch unauthorized background processes. Which TWO of the following mitigation controls should the security team implement to directly prevent and detect these technical persistence techniques?
- Disable interactive SSH password authentication and enforce central SSH certificate lookup via AuthorizedKeysCommand with strictly scoped principal limits.Answer
- Configure mandatory access controls (SELinux/AppArmor) in enforcing mode and deploy File Integrity Monitoring (FIM) targeting system daemon configuration directories.Answer
- CDeploy an inline SSH deception honeypot listener on port 2222 to intercept and terminate unauthorized remote access sessions across the subnet.
- DImplement a stateful perimeter firewalled VPN gateway to perform packet inspection on SSH traffic entering the management network.
Answer
The correct mitigations are configuring central SSH certificate lookups to invalidate static key backdoors and implementing mandatory access control (SELinux/AppArmor) alongside File Integrity Monitoring (FIM) for system daemon directories.
Centralizing SSH access through short-lived certificates and restricting local key files directly mitigates static key persistence. Furthermore, deploying File Integrity Monitoring alongside mandatory access control frameworks ensures prompt detection of unauthorized systemd unit files and prevents unapproved process execution.
Step-by-Step Solution
Key Concept
Host Hardening and Integrity Monitoring Controls