Cyberdefense Strategies Extended

Downfall Intel CPU Vulnerability

• https://downfall.page/
  • Skylake and Kaby Lakes are also now tested as vulnerable
  • Computing devices based on Intel Core processors from the 6th Skylake to (including) the 11th Tiger Lake generation are affected.
  • Vulnerability Checker
  • Mitigation: Intel Microcode Update Expected

---

---

Automatic Instance, VM, Jail Lockdown & Management Strategies

1. Set the correct paths to jailed confs in harden-freebsd.py lines 32-38 and run for each jail.
2. Copy software to /root and have jail start this script at reboot and all settings will be updated upon next reboot. To update all jails simply copy settings.ini with your own copy script to all appropriate locations for uptake.

crontab -e

@reboot /path/to/harden-freebsd.py

3. Have all jails pointing to the same rc script via exec.start and set paths in the script pointing to the same location modified by the script paths.
4. Add new jail specific entires to settings.ini [SYSTEM] section for sysctl.conf update
   • security.jail.* = 0
5. Use multiple copies of the script and settings.ini for each jail
6. Put it in your template