BAB 11 - PERANGKAT DIGITAL

Endpoint adalah perangkat fisik yang terhubung ke jaringan dan berkomunikasi dengan sistem pusat. Setiap endpoint adalah potensi pintu masuk bagi attacker ke jaringan Anda. Memahami konsep endpoint security adalah fondasi untuk melindungi seluruh infrastruktur digital.

Definisi

Apa Saja yang Termasuk Endpoint?

Evolusi Endpoint Security

Komponen Endpoint Security

Komputer dan laptop adalah endpoint paling kritis untuk sebagian besar pengguna. Mereka menyimpan data sensitif, mengakses akun penting, dan menjadi target utama attacker. Mengamankan PC/laptop adalah prioritas utama.

Layer Keamanan PC/Laptop

Checklist Keamanan PC/Laptop

Praktik: Windows Security Hardening

PowerShell - Windows Security Hardening
# Jalankan sebagai Administrator

# 1. Cek status Windows Update
PS> Get-HotFix | Select-Object -Last 5

# 2. Aktifkan Windows Firewall untuk semua profil
PS> Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# 3. Cek status BitLocker
PS> Get-BitLockerVolume

# 4. Aktifkan BitLocker (jika belum)
PS> Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -TpmProtector

# 5. Cek user accounts
PS> Get-LocalUser | Select-Object Name,Enabled,LastLogon

# 6. Disable guest account
PS> Disable-LocalUser -Name "Guest"

# 7. Cek status antivirus (Windows Defender)
PS> Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,AntivirusSignatureLastUpdated

# 8. Force update signature
PS> Update-MpSignature

# 9. Cek program startup
PS> Get-CimInstance Win32_StartupCommand | Select-Object Name,Command,Location

# 10. Cek network connections aktif
PS> Get-NetTCPConnection | Where-Object State -eq "Listen" | Select-Object LocalAddress,LocalPort,OwningProcess

Praktik: Linux Security Hardening

Bash - Linux Security Hardening
# 1. Update sistem
$ sudo apt update && sudo apt upgrade -y

# 2. Aktifkan firewall (UFW)
$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing
$ sudo ufw allow ssh
$ sudo ufw enable

# 3. Cek status firewall
$ sudo ufw status verbose

# 4. Cek user dengan sudo access
$ getent group sudo | cut -d: -f4

# 5. Disable root SSH login
$ sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
$ sudo systemctl restart sshd

# 6. Cek service yang berjalan
$ systemctl list-units --type=service --state=running

# 7. Cek port yang terbuka
$ sudo ss -tulpn

# 8. Cek file dengan SUID bit (potensi privilege escalation)
$ sudo find / -perm -4000 -type f 2>/dev/null

# 9. Cek password policy
$ cat /etc/login.defs | grep PASS

# 10. Cek last logins
$ last -10
$ lastb -10  # failed logins

Smartphone adalah perangkat paling personal yang kita miliki - selalu dibawa, menyimpan data sensitif, dan terhubung ke banyak layanan. Menurut Statista 2024, 6.9 miliar orang di dunia menggunakan smartphone, menjadikannya target serangan yang sangat menarik.

Statistik Mobile Threat

Android vs iOS Security

Checklist Keamanan Smartphone

Android Security Tips

iOS Security Tips

Mobile Threats Umum

Praktik: Cek Aplikasi Berbahaya di Android

Bash - ADB Android Security Check
# Perlu USB debugging aktif & ADB terinstall

# 1. List semua aplikasi terinstall
$ adb shell pm list packages

# 2. Cek aplikasi dengan permission berbahaya
$ adb shell dumpsys package | grep -A 5 "android.permission.READ_SMS"

# 3. Cek aplikasi dengan akses device admin
$ adb shell dumpsys device_policy

# 4. Cek aplikasi yang install dari unknown source
$ adb shell settings get secure install_non_market_apps

# 5. Cek status enkripsi
$ adb shell getprop ro.crypto.state
encrypted

# 6. Cek USB debugging status
$ adb shell settings get global adb_enabled

# 7. Cek aplikasi dengan overlay permission (potensi clickjacking)
$ adb shell dumpsys appops | grep SYSTEM_ALERT_WINDOW

# 8. Uninstall aplikasi mencurigakan
$ adb uninstall com.suspicious.app

# 9. Cek status Play Protect
$ adb shell settings get global package_verifier_enable
1  # 1 = enabled

# 10. Factory reset (jika device dicurigai compromised)
# PERINGATAN: Ini akan hapus semua data!
$ adb shell recovery --wipe_data

Patch management adalah proses mengidentifikasi, memperoleh, menguji, dan menginstall patch (update) untuk software. Ini adalah kontrol keamanan paling dasar namun sering diabaikan. Menurut Verizon DBIR 2024, 21% breach melibatkan eksploitasi vulnerability yang sudah ada patch-nya.

Statistik Patch

Jenis Patch

Best Practices Patch Management

Praktik: Cek Vulnerability dengan Tools

Bash - Vulnerability Scanning
# 1. Cek vulnerability di Linux (Ubuntu/Debian)
$ sudo apt install apt-show-versions
$ sudo apt-show-versions -i | grep -i security

# 2. Cek package outdated
$ apt list --upgradable

# 3. Cek CVE di sistem dengan Lynis (security auditing tool)
$ sudo apt install lynis
$ sudo lynis audit system

# 4. Cek Windows updates dengan PowerShell
PS> Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

# 5. Cek vulnerability di Windows dengan Microsoft Baseline Security Analyzer
# Download: microsoft.com/en-us/download/details.aspx?id=7558

# 6. Cek online - CVE database
# https://nvd.nist.gov/vuln/search
# https://cve.mitre.org/cve/search_cve_list.html

# 7. Cek dengan Nmap (untuk network devices)
$ nmap -sV --script vuln 192.168.1.1

# 8. Cek dengan OpenVAS (open source vulnerability scanner)
$ sudo apt install openvas
$ sudo gvm-setup
$ sudo gvm-start
# Akses via browser: https://localhost:9392

# 9. Cek browser extensions outdated
# Chrome: chrome://extensions/
# Firefox: about:addons

# 10. Subscribe ke security mailing list
# - Microsoft Security Response Center
# - Apple Security Updates
# - Linux distro security lists

Sumber Informasi Vulnerability

Antivirus dan solusi endpoint protection adalah lini pertahanan utama melawan malware. Memahami evolusi dan cara kerjanya penting untuk memilih solusi yang tepat.

Evolusi Antivirus

Perbandingan Solusi Populer

Cara Kerja Antivirus Modern

Praktik: Windows Defender Commands

PowerShell - Windows Defender Management
# 1. Cek status Windows Defender
PS> Get-MpComputerStatus

# 2. Cek signature version
PS> Get-MpComputerStatus | Select-Object AntivirusSignatureVersion,AntivirusSignatureLastUpdated

# 3. Update signature
PS> Update-MpSignature

# 4. Full scan
PS> Start-MpScan -ScanType FullScan

# 5. Quick scan
PS> Start-MpScan -ScanType QuickScan

# 6. Custom scan (folder tertentu)
PS> Start-MpScan -ScanType CustomScan -ScanPath "C:\Users"

# 7. Cek threat history
PS> Get-MpThreatDetection

# 8. Cek quarantine
PS> Get-MpThreat

# 9. Remove threat
PS> Remove-MpThreat -ThreatID 2147735503

# 10. Exclude folder dari scan (hati-hati!)
PS> Add-MpPreference -ExclusionPath "C:\TrustedFolder"

# 11. Cek real-time protection status
PS> Get-MpPreference | Select-Object DisableRealtimeMonitoring

# 12. Enable real-time protection
PS> Set-MpPreference -DisableRealtimeMonitoring $false

Praktik: Linux Antivirus (ClamAV)

Bash - ClamAV Linux Antivirus
# 1. Install ClamAV
$ sudo apt install clamav clamav-daemon

# 2. Update virus database
$ sudo freshclam

# 3. Scan directory
$ sudo clamscan -r /home/user

# 4. Scan dengan auto-remove
$ sudo clamscan -r --remove /home/user

# 5. Scan dengan move to quarantine
$ sudo mkdir /quarantine
$ sudo clamscan -r --move=/quarantine /home/user

# 6. Scan specific file
$ clamscan suspicious-file.exe

# 7. Scan dengan log
$ sudo clamscan -r --log=/var/log/clamav.log /home

# 8. Setup daemon untuk on-access scanning
$ sudo systemctl start clamav-daemon
$ sudo systemctl enable clamav-daemon

# 9. Cek status daemon
$ sudo systemctl status clamav-daemon

# 10. Scan dengan multiple threads (lebih cepat)
$ sudo clamscan -r -m 4 /home  # 4 threads

Firewall perangkat (host-based firewall) adalah software yang memfilter trafik jaringan di level sistem operasi. Berbeda dengan firewall jaringan (di router), firewall perangkat melindungi setiap endpoint secara individual.

Jenis Firewall

Praktik: Windows Firewall

PowerShell - Windows Firewall Management
# 1. Cek status firewall
PS> Get-NetFirewallProfile | Select-Object Name,Enabled

# 2. Aktifkan firewall untuk semua profil
PS> Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# 3. Set default action
PS> Set-NetFirewallProfile -DefaultInboundAction Block -DefaultOutboundAction Allow

# 4. List semua rules
PS> Get-NetFirewallRule | Select-Object DisplayName,Enabled,Direction,Action

# 5. Block incoming RDP (port 3389)
PS> New-NetFirewallRule -DisplayName "Block RDP" -Direction Inbound -LocalPort 3389 -Protocol TCP -Action Block

# 6. Allow specific IP to access RDP
PS> New-NetFirewallRule -DisplayName "Allow RDP from Office" -Direction Inbound -LocalPort 3389 -Protocol TCP -Action Allow -RemoteAddress 192.168.1.0/24

# 7. Block all outgoing except specific apps
PS> Set-NetFirewallProfile -DefaultOutboundAction Block
PS> New-NetFirewallRule -DisplayName "Allow Chrome" -Direction Outbound -Program "C:\Program Files\Google\Chrome\Application\chrome.exe" -Action Allow

# 8. Disable rule
PS> Disable-NetFirewallRule -DisplayName "Block RDP"

# 9. Remove rule
PS> Remove-NetFirewallRule -DisplayName "Block RDP"

# 10. Cek logging
PS> Set-NetFirewallProfile -LogFileName "C:\windows\system32\LogFiles\Firewall\pfirewall.log"
PS> Get-Content "C:\windows\system32\LogFiles\Firewall\pfirewall.log" -Tail 20

Praktik: Linux Firewall (UFW/iptables)

Bash - UFW (Uncomplicated Firewall)
# 1. Install UFW
$ sudo apt install ufw

# 2. Set default policies
$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing

# 3. Allow SSH (PENTING! sebelum enable)
$ sudo ufw allow ssh
# atau
$ sudo ufw allow 22/tcp

# 4. Enable firewall
$ sudo ufw enable

# 5. Cek status
$ sudo ufw status verbose

# 6. Allow HTTP/HTTPS
$ sudo ufw allow http
$ sudo ufw allow https

# 7. Allow specific port
$ sudo ufw allow 8080/tcp

# 8. Allow from specific IP
$ sudo ufw allow from 192.168.1.100

# 9. Allow from subnet to specific port
$ sudo ufw allow from 192.168.1.0/24 to any port 22

# 10. Deny specific IP
$ sudo ufw deny from 10.0.0.5

# 11. Delete rule
$ sudo ufw status numbered
$ sudo ufw delete 3

# 12. Reset firewall
$ sudo ufw reset

# 13. Logging
$ sudo ufw logging on
$ sudo tail -f /var/log/ufw.log

Bash - iptables (Advanced)
# 1. List rules
$ sudo iptables -L -n -v

# 2. Flush all rules
$ sudo iptables -F

# 3. Set default policies
$ sudo iptables -P INPUT DROP
$ sudo iptables -P FORWARD DROP
$ sudo iptables -P OUTPUT ACCEPT

# 4. Allow loopback
$ sudo iptables -A INPUT -i lo -j ACCEPT

# 5. Allow established connections
$ sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# 6. Allow SSH
$ sudo iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# 7. Allow HTTP/HTTPS
$ sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
$ sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

# 8. Rate limit SSH (anti brute force)
$ sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
$ sudo iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

# 9. Save rules (Ubuntu/Debian)
$ sudo apt install iptables-persistent
$ sudo netfilter-persistent save

# 10. Save rules (CentOS/RHEL)
$ sudo iptables-save > /etc/sysconfig/iptables

Screen lock dan device encryption adalah dua kontrol keamanan fundamental yang melindungi perangkat saat hilang atau dicuri. Tanpa keduanya, data sensitif di perangkat Anda bisa diakses siapa saja dalam hitungan menit.

Statistik Perangkat Hilang/Dicuri

Screen Lock Methods

Encryption Solutions

Praktik: Enable BitLocker (Windows)

PowerShell - BitLocker Management
# 1. Cek status BitLocker
PS> Get-BitLockerVolume

# 2. Cek TPM status
PS> Get-WmiObject -Namespace "Root\cimv2\Tpm" -Class Win32_Tpm | Select-Object IsActivated_InitialValue,IsEnabled_InitialValue,IsOwned_InitialValue

# 3. Enable BitLocker dengan TPM
PS> Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -TpmProtector

# 4. Enable dengan PIN tambahan
PS> Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -TpmPinProtector

# 5. Enable dengan recovery password
PS> Enable-BitLocker -MountPoint "C:" -RecoveryPasswordProtector

# 6. Backup recovery key ke AD (domain-joined)
PS> Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId (Get-BitLockerVolume -MountPoint "C:").KeyProtector[0].KeyProtectorId

# 7. Backup recovery key ke file
PS> $BLV = Get-BitLockerVolume -MountPoint "C:"
PS> Backup-BitLockerKeyProtector -MountPoint "C:" -KeyProtectorId $BLV.KeyProtector[1].KeyProtectorId -Path "C:\Backup"

# 8. Suspend BitLocker (untuk update BIOS)
PS> Suspend-BitLocker -MountPoint "C:" -RebootCount 1

# 9. Resume BitLocker
PS> Resume-BitLocker -MountPoint "C:"

# 10. Disable BitLocker
# PERINGATAN: Ini akan dekripsi drive!
PS> Disable-BitLocker -MountPoint "C:"

Praktik: Enable FileVault (macOS)

Bash - FileVault Management
# 1. Cek status FileVault
$ fdesetup status

# 2. Enable FileVault
$ sudo fdesetup enable

# 3. Enable dengan recovery key (bukan iCloud)
$ sudo fdesetup enable -output RecoveryKey.txt

# 4. Cek recovery key
$ sudo fdesetup changerecovery -personal

# 5. Add user to FileVault
$ sudo fdesetup add -usertoadd username

# 6. Remove user from FileVault
$ sudo fdesetup remove -user username

# 7. Disable FileVault
# PERINGATAN: Ini akan dekripsi drive!
$ sudo fdesetup disable

# 8. Cek encryption progress
$ diskutil apfs list

# 9. List FileVault enabled users
$ sudo fdesetup list

# 10. Defer FileVault enable until next logout
$ sudo fdesetup enable -defer /path/to/recovery.key

Praktik: Enable LUKS (Linux)

Bash - LUKS Full Disk Encryption
# Cara termudah: install dengan encryption dari awal
# Ubuntu: pilih "Encrypt the new installation" saat install

# Untuk encrypt drive tambahan:

# 1. Install cryptsetup
$ sudo apt install cryptsetup

# 2. Format partition dengan LUKS
# PERINGATAN: Ini akan hapus semua data di partition!
$ sudo cryptsetup luksFormat /dev/sdb1

# 3. Open encrypted partition
$ sudo cryptsetup open /dev/sdb1 encrypted_drive

# 4. Format dengan filesystem
$ sudo mkfs.ext4 /dev/mapper/encrypted_drive

# 5. Mount
$ sudo mount /dev/mapper/encrypted_drive /mnt/secure

# 6. Close encrypted partition
$ sudo umount /mnt/secure
$ sudo cryptsetup close encrypted_drive

# 7. Cek status
$ sudo cryptsetup status encrypted_drive

# 8. Add key file (untuk auto-mount)
$ sudo dd if=/dev/urandom of=/root/keyfile bs=1024 count=4
$ sudo chmod 0400 /root/keyfile
$ sudo cryptsetup luksAddKey /dev/sdb1 /root/keyfile

# 9. Auto-mount di /etc/fstab
# /dev/sdb1 /mnt/secure ext4 defaults 0 2
# /dev/mapper/encrypted_drive /mnt/secure ext4 defaults 0 2

# 10. Cek LUKS header
$ sudo cryptsetup luksDump /dev/sdb1

USB dan removable media (flash drive, external HDD, SD card) adalah vektor serangan yang sering diabaikan. Mereka bisa membawa malware, mencuri data, atau bahkan mengeksekusi serangan fisik pada perangkat.

Statistik USB Attacks

Jenis USB Attacks

USB Rubber Ducky Example

DuckyScript - USB Rubber Ducky Payload
# Contoh payload (EDUKASI SAJA!)
# Payload ini membuka cmd dan menampilkan pesan

DELAY 1000
GUI r
DELAY 500
STRING cmd
ENTER
DELAY 500
STRING echo "Your computer has been compromised!"
ENTER
DELAY 500
STRING color 0C
ENTER
DELAY 500
STRING title SYSTEM COMPROMISED
ENTER

# Payload lebih berbahaya bisa:
# - Download & execute malware
# - Create backdoor user
# - Exfiltrate data
# - Install keylogger
# - Disable security tools

Kebijakan USB di Organisasi

Praktik: Disable USB di Windows

PowerShell - USB Control
# 1. Disable USB storage via registry
PS> Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Value 4

# 2. Enable USB storage
PS> Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\USBSTOR" -Name "Start" -Value 3

# 3. Disable auto-run for all drives
PS> Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255

# 4. Check USB devices connected
PS> Get-PnpDevice -Class USB | Select-Object FriendlyName,Status

# 5. Get USB storage devices
PS> Get-WmiObject Win32_DiskDrive | Where-Object InterfaceType -eq "USB"

# 6. Disable specific USB device
PS> Disable-PnpDevice -InstanceId "USB\VID_XXXX&PID_XXXX\..."

# 7. Group Policy untuk USB control (enterprise)
# Computer Configuration -> Administrative Templates -> System -> Removable Storage Access

# 8. Audit USB insertion events
PS> Get-WinEvent -LogName "Microsoft-Windows-DriverFrameworks-UserMode/Operational" | Where-Object Id -eq 2003

# 9. Create USB whitelist (Device Control)
# Gunakan solution komersial seperti Symantec DLP, McAfee DLP

# 10. Check BitLocker To Go (USB encryption)
PS> Get-BitLockerVolume -MountPoint "E:"

Praktik: USB Security di Linux

Bash - USB Security Linux
# 1. List USB devices
$ lsusb

# 2. List mounted USB drives
$ lsblk

# 3. Disable USB storage (kernel module)
$ sudo modprobe -r usb-storage
$ echo "blacklist usb-storage" | sudo tee /etc/modprobe.d/disable-usb-storage.conf

# 4. Re-enable USB storage
$ sudo rm /etc/modprobe.d/disable-usb-storage.conf
$ sudo modprobe usb-storage

# 5. Disable autorun (usbmount)
$ sudo apt remove usbmount

# 6. Mount USB manually dengan noexec (no execute)
$ sudo mount -o ro,noexec /dev/sdb1 /mnt/usb

# 7. Scan USB dengan ClamAV
$ sudo clamscan -r /mnt/usb

# 8. Check USB device details
$ sudo hdparm -I /dev/sdb

# 9. Encrypt USB with LUKS
$ sudo cryptsetup luksFormat /dev/sdb1
$ sudo cryptsetup open /dev/sdb1 usb_encrypted
$ sudo mkfs.ext4 /dev/mapper/usb_encrypted
$ sudo mount /dev/mapper/usb_encrypted /mnt/secure_usb

# 10. Audit USB events
$ sudo dmesg | grep -i usb
$ sudo cat /var/log/syslog | grep -i usb

Backup dan recovery adalah lini pertahanan terakhir terhadap ransomware, data corruption, hardware failure, dan bencana. Tanpa backup yang baik, Anda bisa kehilangan semua data secara permanen.

Statistik Backup

Prinsip 3-2-1 Backup

Jenis Backup

Backup Strategy

Praktik: Backup di Windows

PowerShell - Windows Backup
# 1. File History (built-in)
PS> Add-Type -AssemblyName System.Windows.Forms
# Settings -> Update & Security -> Backup -> More options

# 2. Robocopy (command-line backup)
PS> robocopy "C:\Users\Documents" "E:\Backup\Documents" /MIR /R:3 /W:5 /LOG:backup.log

# 3. Windows Server Backup
PS> Install-WindowsFeature Windows-Server-Backup
PS> wbadmin start backup -backupTarget:E: -include:C: -allCritical -quiet

# 4. Check backup status
PS> wbadmin get versions

# 5. Restore file
PS> wbadmin start recovery -version:09/09/2026-14:00 -itemType:File -items:C:\Users\Documents\file.txt -recoveryTarget:C:\Restore

# 6. System Image Backup
PS> wbadmin start systemimagebackup -backupTarget:E:

# 7. Third-party tools:
# - Veeam Backup & Replication (free for personal)
# - Macrium Reflect
# - Acronis True Image

# 8. Cloud backup:
# - OneDrive (built-in Windows)
# - Google Drive
# - Backblaze
# - Carbonite

# 9. Scheduled backup task
PS> $action = New-ScheduledTaskAction -Execute "PowerShell.exe" -Argument "-File C:\Scripts\backup.ps1"
PS> $trigger = New-ScheduledTaskTrigger -Daily -At 2am
PS> Register-ScheduledTask -TaskName "DailyBackup" -Action $action -Trigger $trigger

# 10. Verify backup integrity
PS> Get-ChildItem E:\Backup | Select-Object Name,Length,LastWriteTime

Praktik: Backup di Linux

Bash - Linux Backup Tools
# 1. rsync (paling umum)
$ rsync -avh --progress /home/user/ /backup/home/

# 2. rsync dengan delete (mirror)
$ rsync -avh --delete /home/user/ /backup/home/

# 3. rsync incremental
$ rsync -avh --link-dest=/backup/previous /home/user/ /backup/current/

# 4. tar (archive)
$ tar -czvf backup-$(date +%Y%m%d).tar.gz /home/user

# 5. tar dengan encryption
$ tar -czvf - /home/user | gpg -c > backup-$(date +%Y%m%d).tar.gz.gpg

# 6. dd (disk image)
# PERINGATAN: Ini akan copy seluruh disk
$ sudo dd if=/dev/sda of=/backup/disk-image.img bs=4M status=progress

# 7. Clonezilla (disk cloning)
# Download: clonezilla.org

# 8. BorgBackup (deduplication)
$ sudo apt install borgbackup
$ borg init -e repokey /backup/borg-repo
$ borg create /backup/borg-repo::backup-$(date +%Y%m%d) /home/user

# 9. Restic (modern backup)
$ restic init --repo s3:s3.amazonaws.com/my-bucket/
$ restic backup /home/user

# 10. Automated backup dengan cron
$ crontab -e
# Tambahkan: 0 2 * * * /usr/local/bin/backup.sh

# Contoh backup.sh:
# #!/bin/bash
# rsync -avh --delete /home/user/ /backup/home/
# echo "Backup completed: $(date)" >> /var/log/backup.log

Backup Solutions

Disaster Recovery Plan

Template - Disaster Recovery Plan
# ============================================
# DISASTER RECOVERY PLAN
# ============================================

1. SCOPE
   - Sistem: Laptop kerja, server file
   - Data kritis: Dokumen proyek, database, email
   - RTO: 4 jam
   - RPO: 24 jam

2. BACKUP STRATEGY
   - Full backup: Setiap Minggu (Minggu 2am)
   - Incremental: Setiap hari (Senin-Sabtu 2am)
   - Media: External HDD + Cloud (Backblaze)
   - Lokasi: Rumah + Cloud (offsite)

3. RECOVERY PROCEDURES
   # Scenario 1: Laptop rusak
   [ ] Ganti laptop dengan spare
   [ ] Install OS dari image
   [ ] Restore data dari backup terakhir
   [ ] Install aplikasi dari package list
   [ ] Test sistem
   Target: 4 jam

   # Scenario 2: Ransomware attack
   [ ] Isolasi sistem (disconnect network)
   [ ] Identifikasi ransomware variant
   [ ] Format disk
   [ ] Reinstall OS
   [ ] Restore dari backup SEBELUM infection
   [ ] Scan backup untuk memastikan bersih
   [ ] Update semua password
   Target: 6 jam

   # Scenario 3: Data corruption
   [ ] Identifikasi file korup
   [ ] Restore dari backup point sebelum corruption
   [ ] Verify data integrity
   Target: 2 jam

4. CONTACT LIST
   - IT Support: +62 812-xxxx-xxxx
   - Backup vendor: support@backblaze.com
   - Management: ceo@company.com

5. TESTING SCHEDULE
   - Test restore: Setiap 3 bulan
   - Full DR test: Setiap tahun
   - Last test: 2026-06-15 (SUCCESS)
   - Next test: 2026-09-15

6. DOCUMENTATION
   - Backup logs: /var/log/backup.log
   - Recovery logs: /var/log/recovery.log
   - DR plan version: 2.1
   - Last updated: 2026-09-01

Device hardening adalah proses mengurangi attack surface perangkat dengan menonaktifkan fitur tidak perlu, mengonfigurasi security settings, dan menerapkan best practices. Ini adalah langkah praktis terakhir untuk mengamankan perangkat Anda.

Definisi

Prinsip Device Hardening

Praktik: Windows Hardening

PowerShell - Windows Hardening Script
# ============================================
# WINDOWS HARDENING SCRIPT
# ============================================

# 1. Update Windows
PS> Install-Module PSWindowsUpdate
PS> Get-WindowsUpdate -Install -AcceptAll -AutoReboot

# 2. Disable unused services
PS> $services = @("RemoteRegistry", "Fax", "XblGameSave", "XblAuthManager")
PS> foreach ($svc in $services) { Stop-Service $svc -Force; Set-Service $svc -StartupType Disabled }

# 3. Enable firewall
PS> Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

# 4. Disable SMBv1
PS> Set-SmbServerConfiguration -EnableSMB1Protocol $false

# 5. Enable BitLocker
PS> Enable-BitLocker -MountPoint "C:" -EncryptionMethod Aes256 -TpmProtector

# 6. Set password policy
PS> net accounts /minpwlen:12 /maxpwage:90 /minpwage:1 /uniquepw:5

# 7. Disable auto-run
PS> Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoDriveTypeAutoRun" -Value 255

# 8. Enable audit logging
PS> auditpol /set /category:"Logon/Logoff" /success:enable /failure:enable
PS> auditpol /set /category:"Object Access" /success:enable /failure:enable

# 9. Disable guest account
PS> Disable-LocalUser -Name "Guest"

# 10. Enable Windows Defender real-time protection
PS> Set-MpPreference -DisableRealtimeMonitoring $false

# 11. Disable PowerShell v2 (legacy)
PS> Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftPowerShellV2

# 12. Enable UAC
PS> Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" -Name "EnableLUA" -Value 1

# 13. Disable remote desktop (if not needed)
PS> Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1

# 14. Enable Windows Defender Exploit Guard
PS> Set-ProcessMitigation -System -Enable CFG,StrictHandle

# 15. Check hardening status
PS> Write-Host "=== HARDENING STATUS ==="
PS> Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled,AntivirusSignatureLastUpdated
PS> Get-NetFirewallProfile | Select-Object Name,Enabled
PS> Get-BitLockerVolume

Praktik: Linux Hardening

Bash - Linux Hardening Script
# ============================================
# LINUX HARDENING SCRIPT
# ============================================

# 1. Update system
$ sudo apt update && sudo apt upgrade -y

# 2. Disable root SSH login
$ sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
$ sudo systemctl restart sshd

# 3. Disable password authentication (use SSH keys)
$ sudo sed -i 's/^#*PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config

# 4. Enable firewall
$ sudo ufw default deny incoming
$ sudo ufw default allow outgoing
$ sudo ufw allow ssh
$ sudo ufw enable

# 5. Install fail2ban (anti brute force)
$ sudo apt install fail2ban
$ sudo systemctl enable fail2ban

# 6. Disable unused services
$ sudo systemctl disable avahi-daemon cups bluetooth

# 7. Set password policy
$ sudo apt install libpam-pwquality
$ sudo sed -i 's/^#*minlen.*/minlen = 12/' /etc/security/pwquality.conf

# 8. Enable automatic security updates
$ sudo apt install unattended-upgrades
$ sudo dpkg-reconfigure -plow unattended-upgrades

# 9. Disable USB storage
$ echo "blacklist usb-storage" | sudo tee /etc/modprobe.d/disable-usb.conf

# 10. Enable audit logging
$ sudo apt install auditd
$ sudo systemctl enable auditd

# 11. Set file permissions
$ sudo chmod 600 /etc/shadow
$ sudo chmod 644 /etc/passwd

# 12. Disable core dumps
$ echo "* hard core 0" | sudo tee -a /etc/security/limits.conf

# 13. Enable ASLR
$ echo "kernel.randomize_va_space = 2" | sudo tee -a /etc/sysctl.conf
$ sudo sysctl -p

# 14. Install and configure AppArmor/SELinux
$ sudo apt install apparmor apparmor-utils
$ sudo systemctl enable apparmor

# 15. Check hardening with Lynis
$ sudo apt install lynis
$ sudo lynis audit system

CIS Benchmarks

CIS Benchmarks adalah standar industri untuk hardening sistem. Tersedia untuk:

• Windows 10/11, Server 2019/2022
• Ubuntu, CentOS, RHEL, Debian
• macOS
• Docker, Kubernetes
• AWS, Azure, GCP
• Database (MySQL, PostgreSQL, Oracle)

Bash - CIS Benchmark Audit
# Download CIS Benchmark
# https://www.cisecurity.org/benchmark/

# Contoh audit manual untuk Ubuntu 22.04:

# 1. Check password policy
$ grep "^PASS_MAX_DAYS" /etc/login.defs
$ grep "^PASS_MIN_DAYS" /etc/login.defs

# 2. Check SSH config
$ grep "^PermitRootLogin" /etc/ssh/sshd_config
$ grep "^PasswordAuthentication" /etc/ssh/sshd_config

# 3. Check firewall status
$ sudo ufw status

# 4. Check auditd status
$ sudo systemctl status auditd

# 5. Check for SUID binaries
$ sudo find / -perm -4000 -type f 2>/dev/null

# 6. Check world-writable files
$ sudo find / -perm -002 -type f 2>/dev/null

# 7. Check user accounts
$ cat /etc/passwd | grep -v "nologin\|false"

# 8. Check listening ports
$ sudo ss -tulpn

# 9. Check failed login attempts
$ sudo lastb | head -20

# 10. Automated CIS audit with OpenSCAP
$ sudo apt install libopenscap8 ssg-debderived
$ oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_standard \
    --results scan-results.xml \
    /usr/share/xml/scap/ssg/content/ssg-ubuntu2204-ds.xml

Mobile Device Hardening

Uji pemahaman Anda tentang Bab 11! Target minimal: 70% untuk melanjutkan ke Fase 3.