good evening cypher con are you doing up
there having a good time I was not at
cypher con last time and I regret it
this has been great i love the villages
that's where my favorite part out there
so i'm going to blaze through this stuff
so we can get on with the rest of the
presentation to get back out to the
villages and who's doing the wireless
CTF yeah are you winning good for you
not me ok it's a team effort good for
you well my name is Shannon Fritz and I
want to talk to you a little bit about
cybersecurity starter kit how to talk to
your businesses about improving security
I work for a company called concurrency
and their I'm a solutions architect my
job is to basically come up with new
solutions for our customers and lately
it's been about security right security
is everywhere I have a security
background which is pretty convenient i
also i'm an enterprise security MVP
which if you haven't heard about the MVP
program that's probably because it's a
microsoft thing and that's not very
popular over here but we talked with
businesses who run Windows and Windows
servers and in the enterprise security
program I get the opportunity to talk to
a lot of people inside of Microsoft
about the products and solutions that
they work with and help them with
feedback from our customers and do
improvements on how those things work so
accent currency we basically help
customers transform their businesses by
investing more in the products that they
already own doing better salute of
deployments and configurations of those
of those tools and when it comes to
security the conversations that I have
with our customers often times come down
to I don't know what to do you know
others I know that we're at risk I know
that we need to do something better but
I'm not totally sure where to start and
some of those businesses frankly don't
have the budget or the staff to deal
with it and so what they're coming to us
with is this question of like what
should we do it feels pretty ambiguous
and so what I wanted to do is put
together a couple of slides and
presentation on how to deal with that so
I want to give you so
examples that you can take back to the
businesses talk with the the people
there about what they can do and
actually give you some examples that you
can take back i also want to show you
four areas that I think that you could
immediately start making changes in the
business based on attacks that I think
taking some mitigation steps will help
improve the security very quickly so if
you've seen information is beautiful
they do a good job of showing a lot of
data in a pretty way this shows records
shows breaches that have resulted in a
loss of 30,000 records or more and in
just the last two years there's so many
of them that it's basically just a big
blob on the screen and if we switch the
coloring to show the kinds of breaches
that occur on here the pink ones are
basically all hats right deliberate
circumvention of security to steal these
records and this tells me that it's not
necessarily someone just being lazy and
configuring something in an open way it
oftentimes it's because of that right
somebody did something wrong and it's
very easy to circumvent a system but the
deliberate hacks is the things that
people are really concerned about and
rightly so right and afterwards when the
companies have been hitting the
headlines and they find out that yeah
we've been recently lost a bunch of
stuff this is this is what I think they
feel like right I don't really want to
feel this way my customers don't want to
feel this way so I think that we need to
start doing something about it and what
we can do is first realize that yeah we
can do better than what we are doing and
I think a lot of times there's a shame
associated with that realization right
like on man our security is really bad
let's not talk about it maybe it'll go
away and so many times that head in the
sand that turtling is what companies
have been doing and it's starting to
catch up with us so once you can admit
that you can do better you can then
realize that we can always do better and
there's nothing really wrong with the
fact that you can do better you know if
you have a company with no security
practice then maybe it's time to start
one if you already have a security
practice then you can probably still
build on that so when you start taking
this path you have to kind of stop
talking about
and start doing it right you need to
make a plan and start executing against
it so when you're starting out you
really want to build a team you want to
involve people because if it's if it's
you at your desk knowing that security
sucks and you don't talk to people about
it you're not going to do anything about
it and you need to make sure to involve
the right people you involve not only
the IT folks because I IT is not the
only aspect of security we're talking
about business process we're talking
about the implementations of your the
products that you're delivering we're
talking about culture in the
organization all of those commit or
contribute to the security culture of
the organization and rather than
starting from scratch and figuring this
all out on your own you should really
stand on the shoulders of giants right
you can find frameworks out there like
the NIST CSF that is a really good
reference for the kinds of things that
you can pay attention to so if you look
at the nest CSF it has this cycle of
things that you can go through to
improve security we're talking about
identifying things in your organization
that it represent risk you know is there
a certain state of a product in your
organization that's wrong is it a
process you do do you you know make a
bad practice of doing wire transfers
without you know without securing that
information and then how do you protect
those asset is there you know
configurations and firewalls is their
certificates what can you do two sticks
here or to protect it and if something
goes wrong how do you detect that and
once it goes wrong how do you respond to
it who do you need to call to bring in
to either get those services back online
who has to deal with public relations
alright so there's a whole myriad of
things that you need to deal with for
for each of these including recovery and
once you can do the recovery sometimes
that means not just bringing the
services back online but also kind of
repairing your image right so there's a
whole variety of things that it gets
involved with the security practice but
the NIF CSF itself is not a standard
right it's not something that you're
going to go and become CSF certified it
is based on standards so if you're
trying to meet standards for things like
audits
the nest GSF references most of those
kinds of standards and gives deliberate
or gives direct guidance on the things
to do to meet those standards but the
nice thing is that it's not really
specific to any industry right it was
originally created to help protect
critical infrastructure right things
like the power grid and things that the
country needed to stay afloat not just
the business but the recommendations
that are inside the frameworks are still
relevant to multiple industries so to
get specific we basically have to call
out what we're concerned with what is it
that has us up at night what is it that
we think is really at risk it's a good
place to start because it probably means
there's something that you know that
needs to be done and when you realize
what it is you can start calling out why
it's bad what is it that would go where
what would happen to the business if
this thing was exploited and and start
making out that list and once you have a
list of things that you're concerned
with really start with the little things
below hanging fruit the things that you
can start making that small incremental
change that is a measurable thing you
really want to be able to demonstrate
improvement not just a gut feeling that
something is better but something
tangible because once you can start
seeing the past series of improvements
you can start really seeing that trend
going to the business to start making
making things better and if you're not
sure where to start this might be a list
of things to consider if you're a
service provider you know look at denial
of service attacks and botnets like if
you are a providing services on a web
portal could you handle like the
Internet of Things turning on you right
like what happened with that within DNS
is it possible that someone in your
organization could be tricked by social
engineering I would think that everybody
would agree yeah like it's very possible
whether that's through an malicious
email attachment or maybe it's somebody
with a nice-looking badge that walks up
with says hey I'm the IT guy and I need
to update the certificate side your
computer guy just plug this in real
quick is it possible that so many
organization would believe that and let
that happen it's
it's very likely in many organizations
and ransomware if if you did get
malicious payload and it were to go
through and you know give you some
cryptolocker or Lackey or something is
that it likely to spread and cause
damage to business and if it did how
could you come back food do you have a
plan and credential that this is the one
that I think is by and large the most
well-known problem in most businesses
today is related to credential theft so
among these things insider threats are
real right but when you're starting a
security practice I would really
recommend you do not start there does
anyone know why you wouldn't start with
an insider threat why I would say that
it's a big room nobody wants to say I
would say not to start with an insider
threat because if you are beginning the
security practice first you're going to
make mistakes right you haven't done it
before so you're going to be figuring it
out and the and because of that you
don't want the first mistake to be does
you saying hey IT guy I don't trust you
to stay out of my email yeah I don't
trust you to stay out of the stuff you
shouldn't be in you don't want to put
out their sense of non trust right you
want to make sure that you're building
an organization of trust good
relationships and you start with the
people that have the administrative
rights in the end the power in the
organization to make these changes and
those are the people you inherently
trust right now and they're not the ones
that we need to defend against at least
at the outset right eventually you can
start looking at the risk of insider
threats but in the beginning you could
start making improvements very easily
that address the external threats
eventually once you start getting better
at it you have an actual security
practice that was standards and stuff in
place then you can start looking at some
of the insider things but in the
beginning it's not a great place to
start because you're going to build
you're going to foster that mistrust in
the organization you really want to you
want to build a team inside so for
specific things to look at related to
those kinds of risks and threats you
might look at things like your network
make sure that the network is segment in
a way that if I jump on your wireless
network from the parking lot I can't
connect directly to the domain
controllers like it's probably a good
idea but that doesn't happen very often
that's that segmentation doesn't always
exist
bad and poor and common configurations
right if you just go through and do the
quick lazy installation oftentimes that
leaves it open for back doors and other
kinds of things so just looking at the
kinds of products and solutions and
tools you have in place as well as to
know other services you subscribe to
making sure the configurations have some
security oversight if you're a
development shop and you're building
applications or services are you using
api's or protocols that are old you know
are you able to keep up with them if
you're using like openssl are you still
no able to get hit by you know some of
the heartbleed or something like that
taking a look at those those libraries
and patching is kind of an obvious one
that we think of but many times I go
into organizations that don't really
have a strict man that method of doing
the deployments you know we kind of do
it quarterly we kind of do it when you
get around to it you know if a patch
happens to get installed and I guess it
gets installed and we tried our already
p to everything to do it manually that's
not a good way to manage patches and it
causes lots and lots of problems because
exploiting those kinds of
vulnerabilities is not that hard anymore
right I mean this is probably the right
room asks anybody heard of metasploit
right how easy is it to inject in it and
a payload and a vulnerability right you
go to the library you choose it and then
you deploy it so patching is actually a
very big deal that people think that it
will be fine because we'll just go to a
service pack 2 or something but it's a
terrible idea and excessive privileges
is another very big one to look at
because it's very easy to just start
getting domain admin rights to every
service account because it just probably
needs it or at least gets me over the
hump and then they leave it as as that
and if you can find a service account
running as a service on a machine like
that is the that is a gold mine right
you jump on that box still the creds and
how you're done you just want and
credential management falls into that
too if you are not doing a good job on
allowing users to do things like manage
their own passwords and use credentials
or require credentials that are harder
to crack then we've been talking about
that all day once you've gone through
this list and you start building out
things like you know the the services
that are in your environment you need to
take care of start making the literal
list
this list one of the most important
columns on here is actually that owner
column if you can define the owners of
the service in your organization that is
going to drive progress if you say pull
IT owns this or finance owns this
nobody's going to be responsible for it
and nobody is going to have to answer
when the timeline slips so this is about
accountability and making sure that you
set realistic goals and you have
somebody who can make a decision now I'm
not saying that's empirical right you're
not going to go and just say this is how
it is because I own it you know you
still probably have to get by and right
we're talking about getting trust from
people and once they have that owner set
you can start doing things like defining
what is the threat what could happen if
this particular item was exploited and
then the vulnerability is what could
cause it so if we're we're talking about
like privilege escalation being the
wrist local administrators could cause
privilege escalation so that is the
vulnerability and then controls what can
you do to prevent that risk once you
have those categorized then I would say
you'd start saying well what is the
impact for how bad could that be like is
this thing going to take down a web
server or is it going to own my entire
domain like how bad is it and this is
kind of subjected you get to classify
this how you like risk is more how
likely is that to happen like sure if
this happened everything could break but
the likelihood of it happening is pretty
small because of these controls we have
in place so it might be a little
likelihood but a high impact right and
then the last is complexity this is
where you you think of if I needed to
implement this mitigation technique how
hard would it be how much time and
resources product solutions or whatever
it might take to do how complexes it's
to play and with those three metrics you
can start building your priority you can
say this one is a high impact it's very
likely but it's super easy to fix that's
priority number one because you can just
do it and fix a big problem right and
this will help you set deadlines it will
help you set the order of things and
start getting the right people in place
so you can start working on next
this is probably the most controversial
slide in the deck because the idea is
that you might need to prove that that
risk is real and i'm not saying you
should go rogue in your organization
just start hacking all the things
because it's fun this is actually very
dangerous to do if you don't think about
it but you might find yourself in a
situation where you need to prove that
this risk is real and when you do that
you want to record what you did but you
have to remember that did not do any
harm here there are other tips that you
want to go through and make sure that
you basically get some permissions
whoever might you might have to report
to to say hey I think I need to do this
this is what I want to try to show the
risk it shouldn't do anything because
you know the bounds of what you're going
to work in but you might even go so far
as to hire a pen test I'm not a pen
testers anybody at pentester in here
these guys you can hire these guys to
come in and help you figure out what's
wrong right and they can prove it for
you and if you if you are going to do
some social experiments you know try and
trick somebody into changing your
passwords don't go in there and say hey
I'm Joe from the IT department I want
you to change the buses password and
they say haha I tricked you it doesn't
work like that you're trying to not use
internal step right you need to use it
outside source get to your spouse to do
it or something and then if you can say
yeah my wife just called in and said
that hey I needed to change my husband's
password because he's sick or something
and they actually do it like that's bad
right they shouldn't be able to do that
but there's risk doing the proof there's
there's real tangible actual risks and
doing this proof so I'm just trying to
over-exuberance n xu 8 that you need to
make sure that what you're doing isn't
going to get you in trouble because
think about if you work in health care
or something and you do this risk test
and you do something wrong not only
could use someone get mad at you but
like someone might die right so don't do
something without really thinking about
it first but there are some real
benefits to doing this first it really
gets people's attention when you can say
hey I just got another bosses password
and it was really easy because you made
a phone call at a crying baby in the
background
but it also gets by in right if people
say yes that risk is real I also know
it's real because you actually did it
and it makes security real and real cool
because like how did you do that that
curiosity gets people going and they
want to dig into it with you and you say
yeah this was a problem this is what I
did this is how we can fix it it's okay
what does that take to do and then you
start that process once you get to
whatever the goal was you need to make
this list of what you got how you got it
and what went wrong so that you could
get it this last line here about
identifying who is responsible for what
went wrong it's not about placing blame
on someone again we're not trying to
vilify somebody inside the organization
what you want to do is find out who can
manages that that component that would
have prevented this exploit and really
collaborate with them your team up with
them and say so we did this thing and if
we had this in place it would have
stopped it do you know why that's not a
place like it and they tell you most the
time they know that and they will say
yes I know but and the reasons our
budget time responsibility approval all
those sorts of things but if you can
demonstrate that this is actually a risk
and that person says yes I know and I've
been telling you for so long can we
please finally do something about it
that might be the thing that gets you
over the hump sometimes when you're
building up this once you've done this
proof then you really need to define the
remediation objectives what can you do
to repair that or prevent that in the
future and then this will allow you to
start making a project something that
has a scope it has a timeline it has
resources assigned and actually get the
process done you know I go to places
that you can't just like have one guy
just go do something cuz he feels like
it right you got to go through the chain
and then at the end of it you have to
test it again you have to make sure that
what you did remediated in fact did and
just like water going down the hill
right you hit that thing that you
stopped it look for the way around it
and then you can go back again and you
basically do this loop where you can
define what the good
is proved that it's a risk exploited and
and get the proof and then go back again
and this will allow you to start making
those incremental changes without having
to I hate the phrase boil the ocean but
do it all at once right we don't want to
go through and make a master cyber
security plan of the organization that's
a three-year deployment people want to
see tangible and incremental changes and
that's that's largely what I'm talking
about here so before I go into the
attacks list is anybody have any
questions on death you can feel free to
talk and ask me at any point here yes
how do you get c-level executives and
management to buy into that well
depending on your position in the
company they might be the direct person
that you go to with that plan I'm if you
take out to the component about proving
it I think that the entire set in there
is very palatable and most organizations
are ready to do the identify and protect
detects respond those kinds of tasks
companies are ready to do we actually do
those kinds of engagement of the
customers right now we have them calling
us and scheduling workshops to go on
through that kind of discussion now we
don't as an organization go through and
do penetration testing so we don't go
through and say we're going to prove
that we can hack our way in we bring in
people like you guys to come in and do
that but then we work with doing the
next steps which is the remediation
tasks but when it comes to doing things
like the proving it you can you can
choose things that are not terribly
risky right I'm not saying that you
should go prove that you can hack your
sequel servers and steal all the data
and put it on pastebin or something what
I'm talking about more is sometimes the
process change like one of the examples
that we had is there's a terribly easy
for somebody to just walk into our
office with a package go right past
everybody and sit down at the HR lady's
desk like why is that okay that is not
okay because once you get physical
access and machines like we all know
games over at that point right so we
need to make sure that's not okay
and that's a cultural thing where we
need to involve the HR department
sometimes it's involves marketing where
we can get the message out to the
organization about you know being
suspicious and being okay with saying
hey what do you what are you doing here
I don't know who you are you're not the
HR person you know and if they get that
suspicion of something wrong does do
members of the organization know what to
do who to go to what to ask and that
oftentimes is step one and once you
start that up you can start doing things
like fishing campaigns against yourself
so that you get people to start
questioning and being able and okay with
questioning so many times that sack the
organization is about security and their
first thought is like these people are
clicking on these emails like a bunch of
idiots yeah they're just clicking out
everything we need to stop it and every
time they click on something i'm going
to write them up that's not that's not
going to work I mean if you're just
going to tell me I'm a dummy every time
I do something wrong I'm just not going
to tell you when I do something wrong
and so if you can make it so that when
somebody finds something that's wrong it
says look at this flag right then you
reward them for they become heroes and
then people get interested in like how
did you get that how did you find that
and it starts building that awareness
and that's more or less what we're
talking about here is starting with
those sorts of things any other okay so
the second half here I want to go over
some some attacks that I think are the
first couple that we should worry about
doing some mitigation against if you
haven't heard of a Praetorian they are a
company that has a red team division
they do some penetration testing and
they did this white paper study that was
released a little bit ago where they had
100 pen tests over the course of about a
year and they were doing several
real-world exploits in their tests and
of course what they found is that the
majority of their exploits were all old
they were not based on zero-day attacks
these were things that had been around
for a very long time and it was
basically a result of patches not being
done or misconfigurations but largely
and by far the attacks were based or
rooted in credentials that
so if we start with credentials and we
were basically talking about passwords
so on one slide to talk about all the
password advice and kind of in one place
we basically just want to use longer
passwords for our end users for the most
part and on punctuation the spaces is ok
it's alright to go ahead and just type
out a sentence the longer the password
the better and when we start using
longer passwords the biggest feedback
that we get for people as I don't want
to type that it's so much to type all
the time as an organization who controls
the access to systems in your
environment what we can start doing is
give people single sign-on I mean we're
used to it inside of an enterprise and
now as we move to more web-based
services single sign-on it's kind of a
big deal because we go to web pages have
to type a password all the time well for
one if we're using the machines that are
joined to like after ad and we're out
using office 365 which is pretty pretty
common we can give single sign-on into
those systems so that the users don't
have to type their passwords as much but
we're logging into their machines they
don't even have to take their password
if they're using something like lettuce
kalou so when is hello allows you to
basically use gestures pins and
biometrics to sign into the machines
these can just sit down and it unlocks
if you need to do things like generate
passwords i mean there's obviously
password generators machine-generated
passwords are far superior to anything
that us humans can do because we use the
English language so we generate
passwords based on English and then
people like Robert reef go out there and
they create algorithms to just crack our
passwords based on what we're probably
going to type so if you go and use a
password generator you're going to be in
much better shape still use something
long but just generate one in other
cases password managers are a great
solution for users humans to go ahead
and use complex passwords without having
to know or type them I use LastPass all
the time but there's plenty of other
options out there but they allow users
to go to the web portals and just
right-click and sign in sometimes
they'll automatically fill it in but
you're not saving the password in the
browser and you can access it from your
mobile device and you can access this
from from your machines as well but
reusing passwords is probably the worst
thing you can do view reuse a password
particularly your work account the users
could be listed in some sort of a breach
then when that password is out there it
shows the username and password and if
it happens to be a work domain is the
username I'm going to go to that owa
site try and sign in starts snooping
around and see what I can find search
for VPN get the Welcome message that
tells you how to get on the Wi-Fi all of
the secrets are in their inbox and then
lot of the guidance that goes through
the rest of the deck is actually under
this akms / password guidance site has
it's got some white paper information
there i'll tell you in more detail some
of the rationale behind this stuff
following through the the attack kill
chain when we're talking about
credentials most of the major milestones
in here are related to credentials so if
i can get a password i can get an
account i can make my next move so
protecting credentials is a really big
deal see pictures to get your shot all
right so attack number one weak
passwords this is who surprised by this
anyone good oh you weren't enough so
weak passwords accounted for well over
half of the attacks that that Praetorian
perform and the bigger problems that we
have with weak passwords and why they're
pretty weak come down to things like I
can't really block bad passwords in
Active Directory I can require certain
complexities but I can't say don't use
pass that word it meets the complexity
requirement we can't when users reuse
passwords it makes it so that the
passwords can be discovered right if
they're included in a leak like maybe
they used their where credentials at
Ashley Madison or something right that
would mean that they can get into your
work account now and then things like
users logging into multiple web and SAS
services they start getting desensitized
to props about enter username and
password you know if you've heard of
burp suite you know you can be a man in
the middle and just pop a JavaScript and
say hey why don't you sign in the office
365 or sign into facebook and they'll go
oh hey I just get this all the time and
they just type it and you say thanks and
move on and simple guessing of passwords
this actually is taken out of a study
rapid7 did where they have a manual
guessing process when they first try to
do a count they can just say you know
season year bang and they got about
twenty-five percent success rate that
they're going to get it in an
organization not a specific account but
if I want to get into an organization
and I can do something like slurping
address list off linkedin i can start
running against the owa logins and i'll
probably get in with something had
twenty-five percent of the time of the
end of the cases that they're going so
that's a bad that's a bad number but to
make matters worse when those users
credentials are found there's a pretty
good chances you're going to find those
users on their machines with a local
administrator account and local admins
are going to take you all the way to
your end goal about forty five percent
of the time if they get those
credentials so it's the weak passwords
represent a really big risk so ways that
we can remediate that again using a
password sentence just making the
password itself better prevent things
like cracking and reversing the
passwords it doesn't protect you from
things like leaks passwords but if you
want to implement a better password
policy one thing is you can just make
the ADA policy so that it has to be
longer and then start doing things like
to play hello so they can use those
longer passwords but if you want to
prevent the common and well-known
passwords you'll want to use some sort
of a password management solutions so if
you're using something like office 365
you can get Azure ad premium which comes
with a self-service password portal it's
not something to deploy it's just a web
page that they go to and when they go to
sign in you can require users to reset
their passwords and azure ad will first
say is this a well-known common
passwords and they'll say you got you
something better than that it will
prevent you from using it multi-factor
authentication for administrative
activities so you're privileged accounts
when you want to do something from an
administrative perspective we can start
doing things like require MFA so there's
way that you can integrate then Pam or
using Azure eighties pim service so we
need to say you want to manage your the
officers do c510 it for exchange online
or something when you go to login with
your global admin account you have to go
into msn
so that way if your credential does get
leaked you still at least have to pass
MFA as well and yes there's way to trick
people to do that but it does make it
harder to get in right for remote access
as well we would want to put mfa's so if
you're doing things like remote desktop
or VPN there are ways to use an NPS
integration so you can do radius
authentication and use as rama paper off
to that and we can also use the app
proxy for taking on prem web services or
ad FS so that we can do a reverse
application proxy on prem and put MFA in
front of that too second it's at name
resolution poisoning this one isn't
exactly talking to credentials directly
but its purpose is basically to trick
the way that Windows is accessing the
network when you get connected to the
network the first thing it does the
talks with dhcp server and the dhcp
server says here's all your information
you need to get connected and we can use
that that expectation as a
man-in-the-middle to have you connect to
the attackers service and then we can
start stealing credentials or have these
hashes from those machines as well and
when when that this happens then it
actually allows users to start accessing
other systems because we can start
getting on those machines and basically
start doing a lateral movement on that
box but the intent behind this is often
to use it as a jumping point right and
when we get on that machine that's not
our end goal our goal is to get into
something better but being able to trick
the client machines allows us to do that
so to prevent that is a little bit more
complicated than a changing process but
we can do some things so on our on the
corpnet we would probably want to stop
things like talking to DNS externally
your clients on network should be
talking to your domain controllers to
get the answers for name resolution
instead of talking to the internet and
they probably have no good reason to be
doing file shares through your firewall
so we can block that as well the link
local mocha multicast name resolution
that's basically when the client is on
the network and it tries to do name
resolution that the DNS services now the
client might send a broadcast message
out on the network to its peers and say
well the DNS server doesn't know the
answer do you and if I'm an attacker on
the same subnet say yeah totally
no there's the answer it's me right and
then you get redirected to yourself so
and the same thing is true for the
netbios name service if if ll MNR fails
then it will roll back and try a new
Tonetta so we want to stop these two
things from happening for the most part
we can use group policies to enact this
netbios if you actually just do it on
the dhcp server the client on that
network will not will not try to do
netbios lookups w pad is another one by
default w pet is actually blocked in DNS
servers in windows so that it will not
host that record but it doesn't mean
that someone on your DHCP someone who's
like baking a DHCP server I wouldn't
give this instruction across the DHCP
registration to say I asked me for W pad
then I'm going to challenge you for
kerberos authentication to get to the w
pad file and then get your hash right so
we can use a group policy for that but
we can also disable the service that
actually does it so regardless of
whether or not you're getting that
instruction from dhcp we actually won't
won't listen to that command one caveat
though is stopping that service also
stops IP helpers so if you do any kind
of ipv6 tunneling in particular direct
axis I actually have a history with
direct access so this one stood out to
me if my clients are using direct access
disabling that service doesn't actually
work for them but there are other remote
access solutions they could start using
too okay third attack when we talk about
local administrators and pass the hash
the the big problem that the reason this
is a big problem is because many many
times they see organizations that use
the same common password across all the
workstations and sometimes the same
password across the servers as well so
if i can get onto a workstation as a
local administrator i can dump the
administrator named account and get that
hash and then i can use that hash to
connect to other systems in fact i can
often use that to reverse it because the
passwords on there will probably set you
know 10 years ago or more and passwords
that were six eight characters long
we're probably fine well now they're not
right if it's a character's it saw its
easy to do so when when they put
in their operating system deployment
process is everywhere and that password
is more powerful than the domain
administrators and another way that this
happens is oftentimes a group policy if
you go back far enough in an
organization sometimes they might have a
group policy preference that actually
sets that local password so this is
actually bad because we can just slurp
the group policy off the file share and
use the PowerShell script to just
reverse the password hash that's in the
group policy preference and have the
credential and then we can access any
machine in the environment so for
remediation of recommendations on this
look at the way that you're using or
assigning those local administrator
passwords if you want to remove that
access you want to have those passwords
be different and we can go and deploy
something like lapse which is really
just a group policy extension you can do
play that through ad and then the client
machine or the server for that matter
we'll go ahead and roll its password on
every group policy update and you can
configure how complex how long and how
frequent it should do that it's a free
thing you just go to the technet gallery
and download that ATA is a advanced
threat analytics and it monitors
activity in an Active Directory it works
through this gateway in center process
we're on the domain controllers or next
to the domain controllers you have a
server that basically does network
packet captures on the domain
controllers and then it will use that
information to do analysis on what's
happening on the DC what kind of
authentication requests or any other
traffic that's going to the DC and it
can use that to detect things like pass
a hash at the ticket gold and take a
skeleton key all that kind of stuff and
then if you if you want to read more
about a Microsoft does actually have a
white paper that you can read that has a
lot of information in it that they
basically tell you how the whole thing
works but I'm sure you've seen past the
hash nemore and then the fourth attack
we're talking about the the last was
basically passwords on disk this is
passwords in memory so if you've you've
heard of me me cats before you've
probably heard about this in the domain
conventional just being stored in the
plaintext this is
them again a local administrator on that
machine can just run a tool and then
scrape that memory space and get the
credential not only the hash with the
actual plain tex credential so we don't
have to crack it we just have to ask for
it nicely and then the bigger problem
with that is there's oftentimes no
prevention of using tools like that
especially organizations that are a have
local administrator they're not really
thinking about stopping people from
doing stuff because you know people need
to get their work done they need to
install stuff so they let him go ahead
and do this and you really can't stop
this on windows 7 or 2012 r2 and older
because the mitigation techniques that
you can do for this exists there are
patches that you can install but to
enable them you have to flip a registry
key and the local administrator can flip
a registry key you know so this goes
under the system hive but a local admin
can become system and just say act never
mind about that and then that mitigation
goes away so it's a bit of a preventive
measure so that it's a little harder to
get in and do this but it's not not
foolproof if we look at Server 2016 in
windows 10 credential guard and device
guard take that out of the equation
where local administrators don't have
that kind of access and there is
actually a fifth attack but that fifth
attack is in the Praetorian white paper
so if you want to check that out i would
go to their website and look at it
they're basically talking about network
segmentation there and in the network
segmentation where you go through and
make sure that you know you have apples
and things to prevent access to
protected areas of the network so in
recaps you kind of summarize what we
talked about to start out in doing a
better job improving securing the
organization you really have to document
what it is you're concerned about
specifically who owns it and what you
what you want to do about it and then
you know it's not necessarily something
you're going to go posting external I
like look at what we're doing to improve
security right use need to talk about it
but talk about it internally with that
list and you can start prioritizing what
you're going to do about it figuring out
you know what is the likelihood and the
impact of it and start with those first
and then you know your passwords are
weak and puny you want to make sure that
you
start making a better password policy go
through and improve the way that your
passwords are configured and the way
that your users can manage it if you can
do self-service password reset and mfa
you can start having longer password
policy requirements and then if the user
happens to forget it it's not a call to
the help desk right they can just take
care of it themselves and in fact a
self-service password reset is actually
a good security measure because if the
way you reset passwords is by calling
the helpdesk and talking to a human I
mean they're going to prey on the
niceties of that person to say oh I you
know I really going to get this email
out and I'm about to go up and present
they can't get into my machine you know
if you can take that equation or that
out of the equation then you're going to
be in much better shape and then again
reusing passwords is a terrible idea
password managers and generators you
should really look at and there's a lot
to go through when it comes to improving
security so it's a good idea to get help
both internally and externally that is
something that that that we do at
concurrency but if you like this format
of doing presentations we do a lot of
these kinds of things the next one we're
doing is actually on an IOT how do i
oughtta me so if you like gambling and
and you like booze we we do that at
potawatomi that's recorded I didn't say
that but you're welcome to join us for
that and if you if you want to get a
copy of this deck you can go ahead and
just email me with the subject naked at
cipher con and I will automatically
email it to you it's not going on a list
and not giving it to our marketing guys
I just have a rule set up on my mailbox
so I will just send it right to you and
if you wanted to get some help with
doing it a security assessment that is
one of the things that we do where we
come in for two or three days and we
talked to all the different people in
your organization ranging from you know
the sea level people the IT people
marketing and and whoever has a stake in
insecurity and work with them to build
that backlog and get you going and then
we also did take the the NIST
cybersecurity framework and basically
create a map that says of all have
you've seen that spreadsheet on the
nistrim work we basically took that
spreadsheet and we correlated the
different products and solutions and
services that you might use to implement
those two
recommendations and that comes with a
white paper that talks about the digital
transformation too so with that thank
you very much and if you have any
questions feel free to come up an ass
thanks