Uploaded byPaula Januszkiewicz
RSA Conference 2017 session: Hacker’s Perspective on Your Windows Infrastructure: Mandatory Check List
The document discusses cybersecurity best practices for Windows infrastructure, emphasizing the importance of understanding potential vulnerabilities and hacker tactics. Key recommendations include implementing password management, regular audits, security awareness training, and proper network segmentation to mitigate risks. The session aims to equip attendees with practical measures to enhance their security posture against potential attacks.
More Related Content
Similar to RSA Conference 2017 session: Hacker’s Perspective on Your Windows Infrastructure: Mandatory Check List
RSA Conference 2017 session: Hacker’s Perspective on Your Windows Infrastructure: Mandatory Check List
- 1. SESSION ID:SESSION ID: #RSAC PaulaJanuszkiewicz Hacker’s Perspective on Your Windows Infrastructure: Mandatory Check List TECH-W10 CEO, Security Expert, Penetration Tester & Trainer, MVP CQURE @paulacqure | paula@cqure.us
- 2.
- 3.
- 4.
- 5. #RSAC Session Goal Be familiarwith the possibilities of the operating system From the user mode and kernel mode We are NOT talking about the forensics! … just doing a little hacking + conclusions My goal: See one of the ways hacker can act
- 6.
- 7.
- 8.
- 9. #RSAC Attack Users Users Users rarelyhave software up to date Awareness issues ... But for hacker it may be not enough Administrators Local account Password reuse for workstations Different password for workstations Domain account Domain user being local administrator Domain administrator
- 10. #RSAC The meaning ofscripts
- 11. #RSAC Make your backdoorpersistent Services DLLs Startup (Menu Start) Task Scheduler LSA Providers Run, Run Once GPO Notification Package Winlogon Image Hijacking Drivers Etc.
- 12.
- 13. #RSAC Stay undetected If youare not ready to attack: stay stealth and do not change the system behavior Hide your traces Processes Files Infrastructure performance Network traffic Server / Client Platform Performance
- 14.
- 15.
- 16.
- 17. #RSAC Use victims toattack more targets Create the remotely controlled network Automate next scans Create your own botnet What can be the hacker’s goal in your infrastructure?
- 18.
- 19. #RSAC Apply Offline access protection,implementation of solutions like BitLocker. Implementation of the process execution prevention (AppLocker etc.) Log centralization, log reviews - searching for the anomalies, certain log error codes. Performing the regular audits of code running on the servers (fe. Autoruns). Maintenance: Backup implementation and regular updating. Review of the services running on the accounts that are not built in. Change them to gMSAs where possible, set up SPNs. Get rid of NETBIOS. Try to avoid NTLMv2, especially if you do not have AppLocker in place or SMB Signing. Client protection: Implement of the anti-exploit solutions.
- 20. #RSAC Apply What YouHave Learned Today Next week you should: Implement Local Admin Password Management or other password management solution Build the plan of the periodical configuration reviews and penetration tests (security checks) In the first three months following this presentation you should: Implement the Security Awareness Program among employees and technical training for administrators Review the configuration of client-side firewall and enabling the programs that can communicate through the network Limit of the amount of services running on the servers (SCW and manual activities) Within six month you should: Implement scoping (role management) for permissions and employee roles (SQL Admins, Server Admins etc.) Review network segmentation (+ IPSec Isolation, DNSSec etc.)
- 21. #RSAC Apply What YouHave Learned Today Next week you should: Implement Local Admin Password Management or other password management solution Build the plan of the periodical configuration reviews and penetration tests (security checks) In the first three months following this presentation you should: Implement the Security Awareness Program among employees and technical training for administrators Review the configuration of client-side firewall and enabling the programs that can communicate through the network Limit of the amount of services running on the servers (SCW and manual activities) Within six month you should: Implement scoping (role management) for permissions and employee roles (SQL Admins, Server Admins etc.) Review network segmentation (+ IPSec Isolation, DNSSec etc.)