this is susan bradley for cso online if you're a customer of solarwinds orion monitoring products
you probably are already way ahead of me and already doing what you need to do to block network
network access to servers in your domain for those companies who do not use seller win software
i'm sure you've seen the news and the headlines for you this is actually an opportunity to review
your own processes and determine if you'd been able to know if your servers and your software
had compromised backdoor code as noted in the instructions provided by the department of defense
what should you do so do you have the technical expertise to investigate the systems
perhaps you have cyber insurance in which case i would say immediately contact your cyber insurance
policy carrier see what process they tell you to do can you do forensic images of the systems
there's a piece of software called access data ftk imager and allows you to take forensic images
of hard drives cds dvds it actually allows you to preview the contents mount an image for read only
and create hash values of files so you can better investigate
you don't want to do your investigation on the
actual live system you want to make sure you image that system and take it offline
now the good news is microsoft has partnered with other key partners to actually seize the domain in
question and black hold it so that or actually make a kill switch out of it so that it can't
be used in attacks now that said take the time to investigate whether or not you could look in your
firewall log files for any kind of investigative signs
some of these attacks have been going on for months so the first question
you should ask yourself do you have the resources in your your system and
log files to hold data for that long if not look to a long-term solution such as splunk
or azure sentinel to store this these log files so you can later on investigate
both splunk and azure sentinel have actual queries that you can go through your firewall logs
to investigate whether you've had a tax if you don't use those products reach out to your
firewall vendors and ask them for resources and again even if you weren't specifically targeted
in this attack think in terms of what resources do you need if you needed to do this kind of analysis
next a topic that i'd recommend that you look up is something called
kerber roasting and you want to make sure that you can turn on logging for kerber roasting
now kerber roasting is not a new topic it's actually been around as long as 2014 and
there's some really good resources out there on adsecurity.org so you can read up more on what
the risk of kerberosing is and how you can better protect yourself from it
one of the key ways you can mitigate against this is ensuring that service accounts passwords
are longer than 25 characters and are not easily guessable then you can also
look to see manage service accounts and group managed service accounts are also a
good method to ensure that the service accounts passwords are long complex and change regularly
now i also found it of interest that the solarwinds attack sequence the attackers
actually verified that there were no securities um software on the system
such as uh they were looking to to make sure that there was not win dbg auto runs wireshark
when defend sense or cavp on the system so it was interesting that they knew if there were cis
internal tools on the system they didn't want to install themselves and run on those systems
so again think in terms of do you monitor your systems do you use tools such as sysinternals
in particular do you install sysmon on your systems and think in terms of what
do you do for monitoring ask yourselves could you have determined if your systems
were backdoored like this i want you to take the time to review what you might have done
to be alerted to intrusion activity in your network think what if you were in that spot
we may not be able to prevent these attacks in the future
i don't think we actually will be able to prevent these attacks but hopefully
we should be able to be alerted to them until next time take the time to check out the other
videos on the igg tech talk youtube channel this is susan bradley stay safe stay secure