this is susan bradley for cso online there's not a day that goes by that i don't read a
headline about another ransomware attack and every time i read it i wonder am i next
what are the ways that the attackers got in can i learn from how they got in
recently attackers went after the colonial pipeline and caused gas deliveries to be delayed
as with other attacks i always want to know how did they come in and recently i read an article
that indicated that the attackers used a single compromise password in order to gain access there
was an old vpn account that allowed employees to remotely access the computer network this account
was no longer in use at the time of the attack but still could be used to access the network
the account's password had been discovered inside a batch of leaked passwords on the dark web
so perhaps the colonial pipeline employee used it somewhere else and it was used in a breach attempt
bottom line one account one password a whole lot of disruption
so what can you do in your own environment to better protect yourself think of those
leftover accounts those passwords that you've used a long time ago and perhaps haven't changed as
with everything you can use a powershell command to pull a report to indicate which accounts
haven't logged in in the last 90 days launch an administrator administrative password
excuse me launch an administrative powershell launch the command and you can get a list of those
accounts that haven't logged in in the last 90 days sometimes they're service accounts otherwise
they're actual user accounts so go through spit out a list and review that access there's all
sorts of tools on the web that you can use to also query active directory you can use to find
clean up old computer accounts and also user accounts there's a site called joewear.net
and he has quite a few tools to review active directory next you want to look at if you're
involved with azure i would suggest that you look at risk policies conditional access rules
that identify risky users and make sure that there's additional policies around that user
so if you have someone who is of high risk who has lots of attempts against their account you can do
additional remediation to help protect that then you want to look at your password policy
time and time again this password policy that you set in your environment will often either
teach your users to set good policies or and unfortunately often have them set bad passwords
if you have an annoying password policy that makes you change your password over and over again and
only requires one additional character as a change often you end up where you have reused passwords
or they only change one letter or they reuse it over and over again so again look at your password
practices in your firm see if you're doing everything that you can to ensure that people
don't reuse the same password over and over again and especially don't use them and don't change
them properly as always the attackers are out to get you and they want to use your accounts
to gain access make sure it's as hard as you can that they're blocked and they can't gain
access into your network through your users until next time this is susan bradley for cso online