This document summarizes a presentation on securing privileged access and preventing cybersecurity breaches. It discusses how the most common security incidents could have been prevented by patching critical vulnerabilities, removing administrative privileges, and using strong passwords and multi-factor authentication. It then outlines a methodology for securing privileged access, including separating administrative accounts, using unique local passwords, privileged access workstations, just enough administration, and other controls to restrict privileged access and elevate detection of suspicious administrator activity.

1. SESSION ID:SESSION ID:
#RSAC
Critical Hygiene for Preventing Major
Breaches
CXO-F02
Tony Sager
Center for Internet
Security
@CISecurity
Mark Simos
Microsoft Enterprise
Cybersecurity Group
@MarkSimos
Jonathan Trull
Microsoft Enterprise
Cybersecurity Group
@jonathantrull
SESSION ID:

2. #RSAC
The CISO Challenge

3. #RSAC
The Playing Field
23% of recipients
opened phishing
messages
50%of those who open
and click attachments
do so within the first
hour
24 hours from click to
domain compromise
100Ks of detections per
day
16% of new
vulnerabilities rated as
critical
6,449 new
vulnerabilities in 2016

4. #RSAC
Microsoft Threat Landscape – Last 6 Months
68 incidents across 8 different
countries responded to by
Global Incident Response &
Recovery Team
15,000 cases worked by the
Cyber Defense Operations
Center
85 – 90% of Incidents
could have been
prevented by:
1. Patching Critical
Vulnerabilities
2. Removing Administrative
Privileges
3. Using Strong Passwords /
MFA

5. #RSAC
(Return on Investment)
CISO’s Coefficient
CISO’s Coefficient
((Team Efficiency) x
–(Business Disruption))

6. #RSAC
1.
2.
3.
Key Objectives

7. #RSAC
7
The “Fog of More”
standards SDL
supply-chain security
security bulletins
user awareness training
browser isolationtwo-factor authentication
encryption
incident response
security controls
threat intelligence
whitelisting
need-to-know
SIEMvirtualization
sandbox
compliance
maturity model
anti-malware
penetration testing
audit logs
baseline configuration
risk management framework
continuous monitoring
DLP
threat feed
certification
assessment
best practice
governance

8. #RSAC
The Defender’s Challenges
8
What’s the right thing to do, and how much do I need to do?
How do I actually do it?
And then how do I demonstrate to others that I have done the right
thing?

9. #RSAC
A few cybersecurity lessons
9
Cybersecurity is like a movie
“Groundhog Day”, not “Independence Day”
Cyber Defense = Information Management
not Information Sharing, not technology; the most important verb is translate
How do I translate millions of data points into the most effective action, at the right
time?
Defenders have limits: info, choices, budget, time.
Attackers don’t perform magic
They have a plan, a budget, a Boss

10. #RSAC
10
The CIS Community Attack Model

11. #RSAC
Calculating Security ROI
Defender Investment:
Defender Return:
• Ruin Attacker ROI
• Deters opportunistic
attacks
• Slows or stops
determined attacks
Attacker Investment: Cost of Attack
Attacker Return: Successful Attacks
Security Return
on Investment
(SROI)

12. #RSAC
Focus on Raising Attacker Cost
RUIN ATTACKER’S
ECONOMIC MODEL
BREAK THE KNOWN
ATTACK PLAYBOOK
ELIMINATE OTHER ATTACK
VECTORS
RAPID RESPONSE AND
RECOVERY

13. Methodology

14. Tier 2
Workstation
& Device
Admins
Tier 0
Domain &
Enterprise
Admins
Tier 1
Server
Admins
1. Beachhead (Phishing Attack, etc.)
2. Lateral Movement
a. Steal Credentials
b. Compromise more hosts &
credentials
3. Privilege Escalation
a. Get Domain Admin credentials
4. Execute Attacker Mission
a. Steal data, destroy systems, etc.
b. Persist Presence
24-48 Hours

15. #RSAC
Credential Theft Demonstration
DC
Client
Domain.Local
Attack Operator DomainAdmin
http://aka.ms/credtheftdemo

16. #RSAC
Protecting Active Directory and Admin privileges
1. Separate Admin
account for admin tasks
3. Unique Local Admin Passwords
for Workstations
http://Aka.ms/LAPS
2. Privileged Access Workstations (PAWs)
Phase 1 - Active Directory admins
http://Aka.ms/CyberPAW
4. Unique Local Admin
Passwords for Servers
http://Aka.ms/LAPS
30 Days 90 Days Beyond
First response to the most frequently used attack techniques

17. #RSAC
Protecting Active Directory and Admin privileges
2. Time-bound privileges (no permanent admins)
http://aka.ms/PAM http://aka.ms/AzurePIM
1. Privileged Access Workstations (PAWs)
Phases 2 and 3 –All Admins and additional hardening
(Credential Guard, RDP Restricted Admin, etc.)
http://aka.ms/CyberPAW
4. Just Enough Admin
(JEA) for DC Maintenance
http://aka.ms/JEA
9872521
6. Attack Detection
http://aka.ms/ata
5. Lower attack surface
of Domain and DCs
http://aka.ms/HardenAD
Build visibility and control of administrator activity, increase protection
against typical follow-up attacks
3. Multi-factor for elevation
30 Days 90 Days Beyond

18. #RSAC
Protecting Active Directory and Admin privileges
2. Smartcard or Passport
Authentication for all admins
http://aka.ms/Passport
1. Modernize Roles and
Delegation Model
3. Admin Forest for Active
Directory administrators
http://aka.ms/ESAE
5. Shielded VMs for virtual
DCs (Server 2016 Hyper-V
Fabric)
http://aka.ms/shieldedvms
4. Code Integrity
Policy for DCs
(Server 2016)
Move to proactive security posture
30 Days 90 Days Beyond

19. #RSAC
Roadmap for Securing Privileged Access
Attack Demo
http://aka.ms/credtheftdemo
SPA Roadmap
http://aka.ms/SPARoadmap