Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
•Download as PPTX, PDF•
0 likes•161 views
You know you are at risk, but it’s ambiguous. You want improve security but are uncertain where best to start. Here are some examples to make a case for improving security and four specific areas to start making improvements now. To get started, please contact us at www.concurrency.com.
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Viewers also liked
Viewers also liked (20)
Similar to Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
Similar to Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016 (20)
Recently uploaded
Recently uploaded (20)
Naked and Vulnerable - A Cybersecurity Starter Kit from Camp IT Dec 2016
- 1. Naked and Vulnerable A Cybersecurity Starter Kit
- 2. @MrShannonFritz Who is this Guy? • I’m Shannon Fritz • I’m a Microsoft Enterprise Security MVP • I’m on twitter @MrShannonFritz • I’m a Solutions Architect at Concurrency • We transform businesses
- 3. Modern Applications Modern IT Management Identity, Management Identity, Application, Information Communications Customer Engagement Identity, Application, Information Communications Cloud Data Center Network, Identity Analytics & Data Identity, Application, Information Communication Digital Transformation RealizedMobility SecurityMobility Security
- 4. @MrShannonFritz A Cybersecurity Starter Kit • Why you’re here oYou know you are at risk, but it’s ambiguous oYou want improve security oYou uncertain where best to start • What you’ll get oSome examples to make a case for improving security oFour specific areas to start making improvements now
- 7. @MrShannonFritz Starting Out • First, ADMIT that the organization CAN do better • Second, KNOW that you can ALWAYS do better • Then, make a PLAN
- 8. @MrShannonFritz Get Specific • Identify specific things to address oWhat risk are you concerned with? oWhy is it bad? • Select the low hanging fruit • Make it measurable
- 9. @MrShannonFritz Get Specific - Threats • Possible Risk Considerations oDDoS / BotNet oSocial Engineering oRansomware oCredential Theft TIP: Do NOT start with ‘insider’ threats
- 10. @MrShannonFritz Get Specific - Assessments • Possible Starting Points oNetwork Segmentation oBad Configurations oAPIs and Protocols oSoftware Versions / Patching oExcessive Privileges oCredential Management
- 11. @MrShannonFritz Get Specific - Assessment ID System Owner BusinessProcess HardwareProduct SoftwareProduct Configuration Threat Vulnerability Controls Impact (Low-Med-High) Complexity (Low-Med-High) Risk (Low-Med-Hgih) Priority 00001 Workstations and Servers Denise Smith X Privilege Escalation Local Administrators LAPS High Low High 1 00002 Active Directory Qiong Wu X Unauthorized Use Privileged Accounts MIM PAM Med Med Low 4 00003 Workstations and Servers Naoki Sato X Code Execution Patching SCCM X Med Med 3 00004 Business Culture Daniel Roth X Social Engineering Phishing KnowBe4 High Low High 2 00005 WiFi Andrea Dunker X Unauthorized Use Pre-shared Key 802.1X Low High Med 5 00006 Workstations and Servers Eric Gruber X Business Data Loss Malicious Software Device Guard High High Med 6 Discover Assess
- 12. @MrShannonFritz Prove It • If you need to, Prove the risk! • Exploit the vulnerability • Record your process TIP: DO NO HARM Do not use your own access or Personal Relationships CYA – Get permission, or Hire a Penetration Tester
- 13. @MrShannonFritz Why Prove It? • Risks of Proof oSomeone can get angry (or Die?) oYou can get in trouble (Fired / Legal) • Benefits of Proof oGets peoples attention oGets business buy-in oMakes Security Real / Real Cool
- 14. @MrShannonFritz Analyze it • What did you get? • How did you get it? • What went wrong so you could get it? • Who is responsible for what went wrong?
- 15. @MrShannonFritz Remediate it • Team up with the responsible people and collaborate • Define ‘Remediation Objectives’ • Create official projects with funding, assigned resources and deadlines. • Test Again!
- 16. @MrShannonFritz Repeat it • Define the concern • Prove it is a Risk • Analyze the Proof • Remediate and Test it
- 17. Four Attacks to Mitigate FirstSource: Praetorian
- 18. @MrShannonFritz The Study • 100 red team penetration tests • 75 different companies • 12 month study (to June 2016) • 450 real-world exploits • Most attack vectors are OLD exploits, not 0-days • Top attacks are largely based on Credential Theft
- 19. @MrShannonFritz Attack Stages • Get creds of an individual • Get on the network • Elevate Access • Seize the Target
- 20. @MrShannonFritz Attack 1: Weak Domain User Passwords • Key Problems oAD cannot prevent “bad” passwords, only set length and char set oMany users have Admin rights to their machine • Recommendations oUse a passphrase not password; ie: Increase length to 15 oAllow users to keep passwords for a longer time; ie: 180 days) oImplement an password enforcement solution; ie: blacklist “Password1” oImplement MFA for Admin and Remote access Used in 66% of tests to successfully compromise the target
- 21. @MrShannonFritz Attack 1: Weak Domain User Passwords • Use a passphrase, Keep passwords longer oSet with AD Group Policy • Password enforcement oAzure AD Premium with Password Reset • Implement MFA for Admin oMicrosoft Identity Manager Privileged Access Management (MIM PAM) oAzure AD Privileged Identity Management (AAD PIM) • Implement MFA for Remote oRDS Gateway and Azure MFA oAD FS and/or Azure Application Proxy
- 22. @MrShannonFritz Password Guidance • Use a Passphrase o A statement with punctuation is easy to remember, longer & harder to crack • Randomly Generate a Password o http://aka.ms/password • Use Windows Hello (login with PIN, Fingers, Face) o http://tinyurl.com/winhello • Do you save passwords in your browser? o http://lastpass.com and https://1password.com are far better solutions! • Do you re-use passwords? o http://haveibeenpwned.com tells if your account was leaked • Do you want more guidance? o http://aka.ms/passwordguidance
- 23. @MrShannonFritz Attack 2: Name Resolution Poisoning • Key Problems oExploits behavior of Windows when connecting to a network oClient machine is coaxed into transmitting credentials to attackers oAttacker can replay captured credentials or attempt to crack them • Recommendations oDisable LLMNR and NetBIOS (after testing!) oDisable Proxy autodetection (WPAD) oMonitor the network for illegitimate Broadcast traffic oBlock outbound tcp/53 (dns) and tcp/445 (smb) to the Internet Used in 64% of tests to successfully compromise the target
- 24. @MrShannonFritz Attack 2: Name Resolution Poisoning • Disable LLMNR and NetBIOS oLLMNR – Use AD Group Policy to disable oNetBIOS – On DHCP server enable option “001” set to “0x2” oNetBIOS – On client set a reg key for network adapters (scripting) • Disable Proxy autodetection (WPAD) oAD GPO for Internet Explorer
- 25. @MrShannonFritz Attack 3: Local Admin / Pass the Hash • Key Problems oMany organizations use the same Local Admin password on all systems oThe NTLM hash can be can be used without knowing the password oThe NTLM hash can be used on other systems with the same password • Recommendations oRevise business process around the use of local admin accounts oDeploy Microsoft LAPS oRead the Microsoft PtH v2 Whitepaper oDeploy Microsoft Advanced Threat Analytics (ATA) Used in 64% of tests to successfully compromise the target
- 26. @MrShannonFritz Attack 3: Local Admin / Pass the Hash • Revise business process around the use of local admin accounts oUpdate the “gold image” build process oRestrict/eliminate used of local accounts, monitor and alert • Deploy Microsoft LAPS ohttps://aka.ms/laps - Use GPO to install/configure on Clients & Servers • Read the Microsoft PtH v2 Whitepaper ohttps://microsoft.com/pth • Deploy Microsoft Advanced Threat Analytics (ATA) ohttps://microsoft.com/ata
- 27. @MrShannonFritz Attack 4: Cleartext Passwords in Memory • Key Problems oDomain Credentials are stored in cleartext in the LSASS process oLocal Admin or SYSTEM users can read this memory space oExposes not only the Hash, but the actual password itself • Recommendations oMove Windows Server 2012 R2+ and Windows 10 oInstall and enable Microsoft Security Advisory 2871997 on older OS’s oRemove local admin rights oUpdate the “gold image” Used in 59% of tests to successfully compromise the target
- 28. @MrShannonFritz Attack 4: Cleartext Passwords in Memory • Move Windows Server 2012 R2+ and Windows 10 oThese OS’s do not store the cleartext passwords in memory oWindows 10 can further be protected with Credential Guard • Install and enable Microsoft Security Advisory 2871997 oUpdates available for Windows 7 and 2008 R2 ohttps://support.microsoft.com/en-us/kb/2871997 oHKLMSYSTEMCurrentControlSetControl SecurityProvidersWdigest UseLogonCredential: 0 (REG_DWORD) oUsers with SYSTEM can alter this, monitor for changes (use OMS)
- 29. @MrShannonFritz The Fifth Attack! • Insufficient Network Access Controls • Used in 52% of tests to successfully compromise • Read the whitepaper! https://www.praetorian.com/
- 30. Takeaways • Document and Share your security concerns (internally) • Work from the list, and have others contribute • Prioritize Remediation based on Likelihood and Impact • Start with a narrow scope and short time frame • Your Current Passwords are Weak and Puny • Use Stronger Password Policies, SSPR & MFA • Reusing a Password is Dangerous • Use a Generator and a Manager • Pace yourself! – It’s easy to get overwhelmed. Get some help.
- 31. Thank You! Want to know more? Want our help? sfritz@concurrency.com
Editor's Notes
- Insider Threats are a bad place to start because if you do not manage the risk assessment well, you can foster an adversarial relationship with other parts of the business. When you’re starting out, you do not have the experience to handle this well. It’s an exercise for later.
- Insider Threats are a bad place to start because if you do not manage the risk assessment well, you can foster an adversarial relationship with other parts of the business. When you’re starting out, you do not have the experience to handle this well. It’s an exercise for later.
- Identifying who is responsible is NOT to place BLAME, it is to determine ownership of remediation in a way that is appropriate for the business
- https://www.petri.com/disable_netbios_in_w2k_xp_2003