this is susan bradley for cs online it seems like every week there's something in the news about
ransomware and this week i saw several stories that made me remember we're still very much
a easy target for ransomware first off i saw on the cso online site themselves an article from
um sophos talking about how attackers gain access to the network and lurk
in the network for weeks and they snoop around and prepare to attack your network they understand our
network sometimes better than we are they're allowed to download and install back doors
and they gain access into places that we probably don't realize
another change in how ransomware attackers are pivoting is rather than a pure ransomware attack
they are now leaking data to extort funds before they provide the actual ransom in themselves
the attackers have access to our network again for many weeks before they launch the attacks
they examine the network and review how best to attack us they use powershell commands to perform
lateral movements and often it's hard to determine the initial threat vector how the attacker
actually got in did they come in through email which is typical did they come in through rdp
another typical way did they come in through vpn possibly vulnerable vpn software sometimes it's
hard to turn to determine that initial threat vector but once they're in they usually light
low for a while and then determine the best way to attack your network one way that they do is they
abuse privileges inside your windows network now windows privileges are something we use
all the time but attackers have a way to know which ones they can abuse and use and in this
chart and you can blow it up to make it a little bit bigger there's certain specific privileges
that tend to be used quite a bit by attackers and these are the ones you want to run logging on
or specifically see if you can establish your baseline in your organization so you want to see
what is normal for your organization for example in essie create token privilege and then if
something becomes abnormal like suddenly you see quite a few these privileges occur in your system
you want that to be an alert so that you can say wait a sec something is not right in my network
so establishing a baseline of these windows privileges is key to understanding your network
another way that attackers often come into our networks is through word or excel documents and
especially macros now you need to step back for a second and determine how to set up your network
i guarantee you that not everyone in your office environment needs to have access
to macros they're going to be people that while they may need word they don't need to run a macro
so therefore it's key that you use techniques such as group policy or windows intune to set
boundaries for these users determine exactly who in the office needs to run macros set
up an organizational unit set up gpo admx templates and specifically have those users
allowed to run macros make sure it's set to have them digitally signed
make sure that the anything that comes from the internet are untrusted and throws off an error
message and worst case scenario you go all the way up to an e5 license on those risky people that
perhaps are targeted perhaps need to run macros but are potentially a targeted person in your
environment and you want to run an e5 license for those people and you'll get specifically an
application called application guard for office now you have to have this on machines that are
have virtualization have certain requirements you have to have a windows 10 enterprise edition
you have to have an e5 license and you have to have a certain enterprise channel of
office but once you do that you can enable application guard for office and when the
risky application comes into your environment you'll get a it'll be a virtual machine or
isolation that is set up and looks at the excel or word document before it opens up on the system
and as you open the application it'll actually this the screenshot will indicate that it's
opening up your microsoft 365 environment in a virtualization or application guard environment
weaponized documents have been used in over 60 percent of office attacks
what attackers are doing as well as they're pretending to come from known cloud applications
for example they'll pretend to be from docusign or box or doc.com or some kind of office 365.
so they'll trick the user into thinking this is a proper document
instead they're pulling a malicious office document down from the cloud again
this use of has increased by 58 over the last year
and cloud apps are now one in three fishing campaigns do you get the idea that the attackers
know that we're moving to the cloud know that we still use office documents know that we have
these spots where they can attack us know that we have weaknesses in understanding our environment
and that's why you need to take the time to understand your environment
monitor log look at those windows privileges determine who in the office truly needs office
macros for anyone who doesn't turn them off until next time this is susan bradley for cso online